Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5771bb5b8ed95fecaf3058d0e2bcf0b4e4c8b7b1
https://github.com/WebKit/WebKit/commit/5771bb5b8ed95fecaf3058d0e2bcf0b4e4c8b7b1
Author: Shu-yu Guo <[email protected]>
Date: 2025-11-20 (Thu, 20 Nov 2025)
Changed paths:
M Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototype.cpp
M Source/JavaScriptCore/runtime/JSONObject.cpp
M Source/JavaScriptCore/runtime/StringPrototype.cpp
M Source/JavaScriptCore/runtime/StringPrototypeInlines.h
M Source/WTF/wtf/text/StringImpl.cpp
M Source/WTF/wtf/text/StringImpl.h
Log Message:
-----------
[JSC] Add and use StringImpl::isValidLength in toLocale{Lower,Upper}Case
https://bugs.webkit.org/show_bug.cgi?id=302684
rdar://157756523
Reviewed by Mark Lam.
StringImpl::MaxLength is INT32_MAX, but the real max length is slightly smaller
for 16bit strings to avoid overflowing the unsigned allocation size. This
overflow was fixed a long time ago with manual checked arithmetic.
This difference shows up in toLocale{Lower,Upper}Case, where an 8bit string near
the max length can be inflated to 16bit. Currently we crash instead of throwing
OOM to user code.
This PR does the following:
- Renames StringImpl::maxInternalLength to a public constexpr
isValidLength<CharType>(size_t) method.
- Throws OOMs in toLocale{Lower,Upper}Case to user code.
No new tests are added as resource exhaustion tests are brittle and slow.
Canonical link: https://commits.webkit.org/303363@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
