Bug 260559

Summary:	[JSC] Throw OOM error if constructArrayNegativeIndexed() fails to allocate
Product:	WebKit	Reporter:	Alexey Shvayka <ashvayka>
Component:	JavaScriptCore	Assignee:	Alexey Shvayka <ashvayka>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	All
OS:	All
See Also:	https://bugs.webkit.org/show_bug.cgi?id=169786

Description Alexey Shvayka 2023-08-22 16:52:52 PDT

It's confirmed that clients of constructArrayNegativeIndexed() can correctly handle an exception being thrown.

Comment 1 Alexey Shvayka 2023-08-23 13:57:46 PDT

<rdar://problem/114202373>

Comment 2 Alexey Shvayka 2023-08-23 13:58:09 PDT

Pull request: https://github.com/WebKit/WebKit/pull/16988

Comment 3 EWS 2023-08-25 14:29:01 PDT

Committed 267300@main (ddd9cbc5f5a7): <https://commits.webkit.org/267300@main>

Reviewed commits have been landed. Closing PR #16988 and removing active labels.