jsc: throw RangeError from JSON.parse when a string value cannot be allocated

scripts/build/deps/webkit.ts

@@ -8,7 +8,7 @@
 // importing), every x64 at the nehalem floor (no separate -baseline variant),
 // typed-array constructor ClassInfo kept address-unique under LTO, and the
 // Windows ICU data table filtered + per-item zstd compressed.
-export const WEBKIT_VERSION = "c9296e353e365ecf0de82f273bb0a88a3df465be";
+export const WEBKIT_VERSION = "autobuild-preview-pr-317-23fb575d";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.

test/js/bun/util/json-parse-oom.test.ts

@@ -0,0 +1,88 @@
+import { expect, test } from "bun:test";
+import { bunEnv, bunExe, isASAN, isDebug, isLinux } from "harness";
+import { join } from "node:path";
+
+// JSON.parse copies every string value longer than 16 chars into a fresh
+// StringImpl. That copy used the crash-or-succeed StringImplMalloc::malloc
+// path, so a near-OOM process died with SIGILL inside fastCompactMalloc
+// instead of throwing. The fix routes through StringImpl::tryCreateUninitialized
+// and surfaces a RangeError, same as "x".repeat(tooLarge).
+//
+// RLIMIT_AS is the only portable way to make tryMalloc actually fail, and it
+// cannot be combined with AddressSanitizer's 16 TB shadow reservation. Debug
+// builds take several seconds per fixture just to zero-fill and toString() the
+// ~200 MB inputs, so this runs only on release Linux lanes.
+test.skipIf(!isLinux || isASAN || isDebug)(
+  "JSON.parse throws RangeError instead of crashing when a string value cannot be allocated",
+  async () => {
+    const fixture = join(import.meta.dir, "json-parse-oom-fixture.js");
+    const limitKiB = 5 * 1024 * 1024;
+    // The filler loop in the fixture exhausts address space down to N/4, so any
+    // size should hit the OOM path, but mimalloc's arena layout varies. Sweep a
+    // couple of sizes and every parsePrimitiveValue caller (top-level literal,
+    // reviver-mode literal, array element, object property value); every run
+    // that reaches INPUT-OK must either succeed or throw RangeError, never
+    // crash. The fixture's filler uses allocUnsafe, which reserves address
+    // space without committing pages, so the children's combined RSS stays
+    // well under the host's memory and they can run concurrently.
+    const cases: Array<[shape: string, mb: number]> = [
+      ["root", 200],
+      ["root", 400],
+      ["array", 300],
+      ["object", 300],
+      ["reviver", 300],
+    ];
+
+    const results = await Promise.all(
+      cases.map(async ([shape, mb]) => {
+        const size = mb * 1024 * 1024;
+        await using proc = Bun.spawn({
+          cmd: [
+            "/bin/sh",
+            "-c",
+            `ulimit -v ${limitKiB} && ulimit -c 0 && exec "$0" "$1" "$2" "$3"`,
+            bunExe(),
+            fixture,
+            String(size),
+            shape,
+          ],
+          env: bunEnv,
+          stdout: "pipe",
+          stderr: "pipe",
+        });
+        const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+        return { shape, size, stdout, stderr, exitCode, signal: proc.signalCode };
+      }),
+    );
+
+    let sawCaught = false;
+    const reachedShapes = new Set<string>();
+    for (const { shape, size, stdout, stderr, exitCode, signal } of results) {
+      if (!stdout.includes("INPUT-OK")) continue;
+      reachedShapes.add(shape);
+
+      // Once the input is built, JSON.parse must not kill the process.
+      expect({ shape, size, stdout: stdout.trim(), stderr: stderr.trim(), exitCode, signal }).toMatchObject({
+        shape,
+        size,
+        signal: null,
+      });
+
+      if (stdout.includes("CAUGHT:")) {
+        expect(stdout).toContain("CAUGHT:RangeError:Out of memory");
+        expect(exitCode).toBe(0);
+        sawCaught = true;
+      } else {
+        expect(stdout).toContain("PARSED");
+        expect(exitCode).toBe(1);
+      }
+    }
+
+    // Every shape must reach JSON.parse; a SETUP-FAIL means the address-space
+    // cap was too tight for that case and nothing was exercised there.
+    expect([...reachedShapes].sort()).toEqual([...new Set(cases.map(([s]) => s))].sort());
+    // And at least one of those runs must have taken the out-of-memory branch,
+    // otherwise the sweep never exercised the path this test is for.
+    expect(sawCaught).toBe(true);
+  },
+);