Bug 35070

Summary: Addition of 2 strings of length 2^31 may result in a string of length 0.
Product: WebKit Reporter: Gavin Barraclough <barraclough>
Component: JavaScriptCoreAssignee: Gavin Barraclough <barraclough>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Attachments:
Description Flags
Patch, missing new results for layout test. oliver: review+

Gavin Barraclough
Reported 2010-02-17 19:40:24 PST
(Should throw an exception).
Attachments
Patch, missing new results for layout test. (6.09 KB, patch)
2010-02-17 19:59 PST, Gavin Barraclough 		oliver: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Gavin Barraclough
Comment 1 2010-02-17 19:59:52 PST
Created attachment 48962 [details] Patch, missing new results for layout test. Minor performance regression (necessary bug fix).
Oliver Hunt
Comment 2 2010-02-17 20:07:19 PST
Comment on attachment 48962 [details] Patch, missing new results for layout test. r=me, i am somewhat concerned the testcase is going to take too long...
Gavin Barraclough
Comment 3 2010-02-17 21:08:11 PST
Landed in r54925 without test case; string-concatenate-outofmemory is currently disabled, will work separately at re-enabling this.
Note You need to log in before you can comment on or make changes to this bug.