Array.prototype.join should do overflow checks on string joins.
https://bugs.webkit.org/show_bug.cgi?id=162459
Reviewed by Saam Barati.
JSTests:
* stress/array-join-on-strings-need-overflow-checks.js: Added.
(assert):
(catch):
Source/JavaScriptCore:
Change the 2 JSRopeString::create() functions that do joins to be private, and
force all clients of it to go through the jsString() utility functions that do
overflow checks before creating the ropes.
* dfg/DFGOperations.cpp:
* runtime/ArrayPrototype.cpp:
(JSC::slowJoin):
* runtime/JSString.h:
* runtime/Operations.h:
(JSC::jsString):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@206281 268f45cc-cd09-0410-ab3c-d52691b4dbfc
7 files changed
