tree d33dfd56571ac58eac409554319ceacc8a4acb21
parent 5d02745b8400f22c08ff07eebb5126f6409ceb61
author rmorisset@apple.com <rmorisset@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571698036 +0000
committer rmorisset@apple.com <rmorisset@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571698036 +0000

Throw the right exception upon memory exhaustion in Array::slice
https://bugs.webkit.org/show_bug.cgi?id=202650

Reviewed by Saam Barati.

JSTests:

* stress/array-slice-memory-exhaustion.js: Added.
(foo):

Source/JavaScriptCore:

Trivial change: just use tryCreate instead of create, and throw an exception if it fails.
No security implication: we were just crashing instead of throwing a catchable exception.

* runtime/ArrayBuffer.cpp:
(JSC::ArrayBuffer::slice const):
(JSC::ArrayBuffer::sliceImpl const):
* runtime/ArrayBuffer.h:
* runtime/JSArrayBufferPrototype.cpp:
(JSC::arrayBufferProtoFuncSlice):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251392 268f45cc-cd09-0410-ab3c-d52691b4dbfc