Bug 158793

Summary: OOM Assertion failure in Array.prototype.toString
Product: WebKit Reporter: André Bargull <andre.bargull>
Component: JavaScriptCoreAssignee: Benjamin Poulain <benjamin>
Status: RESOLVED FIXED    
Severity: Normal CC: benjamin, commit-queue, keith_miller, mark.lam, msaboff, ossy, saam
Priority: P2    
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=171630
Bug Depends on: 159807    
Bug Blocks:    
Attachments:
Description Flags
Patch none

André Bargull
Reported 2016-06-15 10:23:29 PDT
SVN: rev202088 Build with: perl Tools/Scripts/build-jsc --gtk --debug The following test case triggers this assertion error: --- ASSERTION FAILED: length >= 0 --- Test case: --- var p = "a".repeat(0x7ffffff) var r = [ p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p ].toString(); --- Stack trace: --- #0 0x00007ffff6de7098 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:317 #1 0x0000000000443945 in JSC::JSString::create (vm=..., value=...) at ../../Source/JavaScriptCore/runtime/JSString.h:136 #2 0x0000000000444033 in JSC::jsString (vm=0x7fffb09f1000, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:562 #3 0x00000000004440aa in JSC::jsString (exec=0x7fffffffcb30, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:628 #4 0x00007ffff6c358fb in JSC::JSStringJoiner::join (this=0x7fffffffcad0, state=...) at ../../Source/JavaScriptCore/runtime/JSStringJoiner.cpp:120 #5 0x00007ffff6ae5dc3 in JSC::arrayProtoFuncToString (exec=0x7fffffffcb30) at ../../Source/JavaScriptCore/runtime/ArrayPrototype.cpp:385 ... --- Also reproducible with: --- var s = "a".repeat(0x3fffffff); var r = RegExp.prototype.toString.call({ source: s, flags: s, }); ---
Attachments
Patch (9.67 KB, patch)
2016-06-23 20:37 PDT, Benjamin Poulain 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Benjamin Poulain
Comment 1 2016-06-23 20:37:43 PDT
Created attachment 281956 [details] Patch
Saam Barati
Comment 2 2016-06-23 20:43:30 PDT
Comment on attachment 281956 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=281956&action=review r=me > LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js:3 > +// Based on André Bargull's test case. weird characters here? > LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-2.js:3 > +// Based on André Bargull's test case. ditto
Benjamin Poulain
Comment 3 2016-06-23 21:18:44 PDT
Comment on attachment 281956 [details] Patch > > LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js:3 > > +// Based on André Bargull's test case. > > weird characters here? > > > LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-2.js:3 > > +// Based on André Bargull's test case. > > ditto That's just bugzilla. It never does well with UTF8.
WebKit Commit Bot
Comment 4 2016-06-23 21:39:48 PDT
Comment on attachment 281956 [details] Patch Clearing flags on attachment: 281956 Committed r202415: <http://trac.webkit.org/changeset/202415>
WebKit Commit Bot
Comment 5 2016-06-23 21:39:52 PDT
All reviewed patches have been landed. Closing bug.
Csaba Osztrogonác
Comment 6 2016-07-15 02:59:17 PDT
(In reply to comment #4) > Comment on attachment 281956 [details] > Patch > > Clearing flags on attachment: 281956 > > Committed r202415: <http://trac.webkit.org/changeset/202415> These new tests consume huge memory, my PC with 8Gb memory started to swap and became unresponsible for long time when I exectuted run-javascriptcore-tests. :( It would be good not adding tests need 16-32-64Gb memory to be able to run. :(
Note You need to log in before you can comment on or make changes to this bug.