[builtins] Increase the maximum string length on 64-bit platforms.

Increase from 2^28 - 16 to 2^30 - 25 for 64-bit platforms.

Bug: v8:6148
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I3529d7ed757a7ab49a001af8641cf888db171cdb
Reviewed-on: https://chromium-review.googlesource.com/570047Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46838}

include/v8.h

@@ -2438,7 +2438,8 @@ enum class NewStringType {
  */
 class V8_EXPORT String : public Name {
  public:
-  static const int kMaxLength = (1 << 28) - 16;
+  static constexpr int kMaxLength =
+      sizeof(void*) == 4 ? (1 << 28) - 16 : (1 << 30) - 1 - 24;
 
   enum Encoding {
     UNKNOWN_ENCODING = 0x1,

src/objects/string.h

@@ -345,7 +345,14 @@ class String : public Name {
   static const uc32 kMaxCodePoint = 0x10ffff;
 
   // Maximal string length.
-  static const int kMaxLength = (1 << 28) - 16;
+  // The max length is different on 32 and 64 bit platforms. Max length for a
+  // 32-bit platform is ~268.4M chars. On 64-bit platforms, max length is
+  // ~1.073B chars. The limit on 64-bit is so that SeqTwoByteString::kMaxSize
+  // can fit in a 32bit int: 2^31 - 1 is the max positive int, minus one bit as
+  // each char needs two bytes, subtract 24 bytes for the string header size.
+
+  // See include/v8.h for the definition.
+  static const int kMaxLength = v8::String::kMaxLength;
 
   // Max length for computing hash. For strings longer than this limit the
   // string length is used as the hash value.
@@ -502,7 +509,7 @@ class SeqOneByteString : public SeqString {
   }
 
   // Maximal memory usage for a single sequential one-byte string.
-  static const int kMaxSize = 512 * MB - 1;
+  static const int kMaxSize = kMaxLength + kHeaderSize;
   STATIC_ASSERT((kMaxSize - kHeaderSize) >= String::kMaxLength);
 
   class BodyDescriptor;
@@ -544,7 +551,7 @@ class SeqTwoByteString : public SeqString {
   }
 
   // Maximal memory usage for a single sequential two-byte string.
-  static const int kMaxSize = 512 * MB - 1;
+  static const int kMaxSize = kMaxLength * 2 + kHeaderSize;
   STATIC_ASSERT(static_cast<int>((kMaxSize - kHeaderSize) / sizeof(uint16_t)) >=
                 String::kMaxLength);
 

src/runtime/runtime-strings.cc

@@ -736,5 +736,10 @@ RUNTIME_FUNCTION(Runtime_StringCharCodeAt) {
   return __RT_impl_Runtime_StringCharCodeAtRT(args, isolate);
 }
 
+RUNTIME_FUNCTION(Runtime_StringMaxLength) {
+  SealHandleScope shs(isolate);
+  return Smi::FromInt(String::kMaxLength);
+}
+
 }  // namespace internal
 }  // namespace v8

src/runtime/runtime.h

@@ -535,7 +535,8 @@ namespace internal {
   F(StringNotEqual, 2, 1)                 \
   F(FlattenString, 1, 1)                  \
   F(StringCharFromCode, 1, 1)             \
-  F(StringCharCodeAt, 2, 1)
+  F(StringCharCodeAt, 2, 1)               \
+  F(StringMaxLength, 0, 1)
 
 #define FOR_EACH_INTRINSIC_SYMBOL(F) \
   F(CreateSymbol, 1, 1)              \

test/mjsunit/compiler/string-add-try-catch.js

@@ -4,7 +4,7 @@
 
 // Flags: --allow-natives-syntax
 
-var a = "a".repeat(268435440);
+var a = "a".repeat(%StringMaxLength());
 
 (function() {
   function foo(a, b) {

test/mjsunit/compiler/string-concat-try-catch.js

@@ -4,7 +4,7 @@
 
 // Flags: --allow-natives-syntax
 
-var a = "a".repeat(268435440);
+var a = "a".repeat(%StringMaxLength());
 
 (function() {
   function foo(a) {

test/mjsunit/regress/regress-336820.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --max-old-space-size=400
+// Flags: --max-old-space-size=1600
 
 assertThrows((function() {
   s = "Hello World!\n";

test/mjsunit/regress/regress-5404.js

@@ -13,9 +13,9 @@ foo("a");
 %OptimizeFunctionOnNextCall(foo);
 foo("a");
 
-var a = "a".repeat(268435440);
-assertThrows(function() { foo(a); });
+var a = "a".repeat(%StringMaxLength());
+assertThrows(function() { foo(a); }, RangeError);
 
 %OptimizeFunctionOnNextCall(foo);
-assertThrows(function() { foo(a); });
+assertThrows(function() { foo(a); }, RangeError);
 assertOptimized(foo);

test/mjsunit/regress/regress-678917.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --max-old-space-size=400
+// Flags: --max-old-space-size=1600
 
 s1 = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
 s1 += s1;

test/mjsunit/regress/regress-crbug-740398.js

@@ -2,12 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var longString = (function() {
-  var str = "";
-  for (var i = 0; i < 24; i++) {
-    str += "abcdefgh12345678" + str;
-  }
-  return str;
+  return "a".repeat(%StringMaxLength());
 })();
 
 assertThrows(() => { return { get[longString]() { } } }, RangeError);

test/mjsunit/string-oom-array-join.js

@@ -2,10 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var a = "a";
-for (var i = 0; i < 23; i++) a += a;
+// Flags: --allow-natives-syntax
+
+var a = "a".repeat(%StringMaxLength() / 10);
 var b = [];
-for (var i = 0; i < (1<<5); i++) b.push(a);
+for (var i = 0; i < 11; i++) b.push(a);
 
 function join() {
   b.join();

test/mjsunit/string-oom-replace-global-regexp-with-string.js

@@ -2,12 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
 
-
-var a = 'a';
-for (var i = 0; i < 5; i++) a += a;
-var b = 'b';
-for (var i = 0; i < 23; i++) b += b;
+var a = 'a'.repeat(32);
+var b = 'b'.repeat(%StringMaxLength() / 32 + 1);
 
 function replace1() {
   a.replace(/./g, b);
@@ -16,8 +14,7 @@ function replace1() {
 assertThrows(replace1, RangeError);
 
 
-var a = 'a';
-for (var i = 0; i < 16; i++) a += a;
+var a = 'a'.repeat(Math.sqrt(%StringMaxLength()) + 1);
 
 function replace2() {
   a.replace(/a/g, a);

test/mjsunit/string-oom-replace-regexp-global-with-function.js

@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var a = "a";
-for (var i = 0; i < 5; i++) a += a;
-var b = "b";
-for (var i = 0; i < 23; i++) b += b;
+// Flags: --allow-natives-syntax
+
+var a = 'a'.repeat(32);
+var b = 'b'.repeat(%StringMaxLength() / 32 + 1);
 
 function replace() {
   a.replace(/a/g, function() { return b });