Gracefully handle StringBuffer overflow in RegExp replace operator

[asworkjsc]

e3c1c12

Gracefully handle StringBuffer overflow in RegExp replace operator
https://bugs.webkit.org/show_bug.cgi?id=308836
rdar://171058069

Reviewed by Marcus Plutowski.

When the RegExp replace operator is called, if the output string
overflows the maximum legal length of a javascript string it is
supposed to throw an out-of-memory error, rather than triggering a
controlled crash.

Test: JSTests/stress/string-regexp-replace-oom.js

* JSTests/stress/string-regexp-replace-oom.js: Added.
(Object.__proto__.__proto__.Symbol.replace):
(catch):
* Source/JavaScriptCore/runtime/RegExpPrototype.cpp:
(JSC::getSubstitution):

Canonical link: https://commits.webkit.org/308478@main

b1f4c50

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	🛠 win	✅ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 api-mac-debug	✅ 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	🧪 mac-wk1	✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
✅ 🛠 🧪 merge	🛠 vision-sim	✅ 🧪 mac-wk2-stress	🛠 playstation
	🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

[webkit-early-warning-system]

EWS run on previous version of this PR (hash 5335073)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	🛠 ios	🛠 mac	🛠 wpe	🛠 win	⏳ 🛠 ios-apple
	🛠 ios-sim	✅ 🛠 mac-AS-debug	🧪 wpe-wk2	🧪 win-tests	⏳ 🛠 mac-apple
✅ 🧪 webkitperl	🧪 ios-wk2	🧪 api-mac	🧪 api-wpe		⏳ 🛠 vision-apple
	🧪 ios-wk2-wpt	🧪 api-mac-debug	🛠 gtk3-libwebrtc
🛠 🧪 jsc	🧪 api-ios	🧪 mac-wk1	🛠 gtk
🛠 🧪 jsc-debug-arm64	🛠 ios-safer-cpp	🧪 mac-wk2	🧪 gtk-wk2
	🛠 vision	🧪 mac-AS-debug-wk2	🧪 api-gtk
	🛠 vision-sim	🧪 mac-wk2-stress	🛠 playstation
	⏳ 🧪 vision-wk2	🧪 mac-intel-wk2	🛠 jsc-armv7
	🛠 tv	🛠 mac-safer-cpp	🧪 jsc-armv7-tests
	🛠 tv-sim
	🛠 watch
	🛠 watch-sim

[webkit-early-warning-system]

EWS run on previous version of this PR (hash dd37085)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 win	✅ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	✅ 🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 api-mac-debug	✅ 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	🧪 mac-wk1	✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
🛠 🧪 merge	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	🛠 playstation
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	❌ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

[webkit-early-warning-system]

EWS run on current version of this PR (hash b1f4c50)

Details

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows	Apple Internal
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	🛠 win	✅ 🛠 ios-apple
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	🧪 win-tests	✅ 🛠 mac-apple
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe		✅ 🛠 vision-apple
	✅ 🧪 ios-wk2-wpt	✅ 🧪 api-mac-debug	✅ 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	🧪 mac-wk1	✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64	✅ 🛠 ios-safer-cpp	✅ 🧪 mac-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 api-gtk
✅ 🛠 🧪 merge	🛠 vision-sim	✅ 🧪 mac-wk2-stress	🛠 playstation
	🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 jsc-armv7
	✅ 🛠 tv	✅ 🛠 mac-safer-cpp	✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

[webkit-commit-queue]

Committed 308478@main (e3c1c12): https://commits.webkit.org/308478@main

Reviewed commits have been landed. Closing PR #59595 and removing active labels.