Bug 65869 – JSC should always throw when function arg list is too long

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Peter Kasting]

After http://trac.webkit.org/changeset/62432 fixed https://bugs.webkit.org/show_bug.cgi?id=41351 by making JSC truncate excessive arguments to function.apply (matching Spidermonkey), I filed https://bugzilla.mozilla.org/show_bug.cgi?id=578705 about changing Spidermonkey to simply always throw an exception for a too-long argument list.

That bug has now been marked Fixed, so I think at this point Spidermonkey and V8 throw exceptions consistently, meaning JSC should probably be changed to match.

[Geoffrey Garen]

<rdar://problem/9926380>

[Mark Hahnenberg]

Created attachment 103508 [details]
Patch

[Oliver Hunt]

Comment on attachment 103508 [details]
Patch

I think it would be ebtter to just use createStackoverflow (or whatever the function is called) because that's kind of what we're pretending the issue is.

Also you should probably test the behaviour of

function test() { print(arguments.length); }
function f() {
    test.apply(null, arguments);
}
f(0,0,0,0,0,0,0,0,...<70000 arguments>)

As the jit inlines apply(..., arguments)

[Mark Hahnenberg]

Created attachment 103521 [details]
Patch

[WebKit Review Bot]

Comment on attachment 103521 [details]
Patch

Clearing flags on attachment: 103521

Committed r92797: <http://trac.webkit.org/changeset/92797>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Mark Hahnenberg]

Created attachment 103557 [details]
Changing broken tests.

[Mark Hahnenberg]

I missed a few of the tests the change affected, so we need to fix those as well.

[WebKit Review Bot]

Comment on attachment 103557 [details]
Changing broken tests.

Clearing flags on attachment: 103557

Committed r92807: <http://trac.webkit.org/changeset/92807>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.