No longer OOM on invalid string length.

src/json-stringifier.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 248 matching lines @@
 BasicJsonStringifier::BasicJsonStringifier(Isolate* isolate)
     : isolate_(isolate),
       current_index_(0),
       is_ascii_(true),
       overflowed_(false) {
   factory_ = isolate_->factory();
   accumulator_store_ = Handle<JSValue>::cast(
                            factory_->ToObject(factory_->empty_string()));
   part_length_ = kInitialPartLength;
   current_part_ = factory_->NewRawOneByteString(part_length_);
+  ASSERT(!current_part_.is_null());
   tojson_string_ = factory_->toJSON_string();
   stack_ = factory_->NewJSArray(8);
 }
 
 
 MaybeObject* BasicJsonStringifier::Stringify(Handle<Object> object) {
   switch (SerializeObject(object)) {
     case UNCHANGED:
       return isolate_->heap()->undefined_value();
     case SUCCESS: {
@@ skipping 23 matching lines @@
   if (worst_case_length > 32 * KB) {  // Slow path if too large.
     BasicJsonStringifier stringifier(isolate);
     return stringifier.Stringify(object);
   }
 
   FlattenString(object);
   ASSERT(object->IsFlat());
   if (object->IsOneByteRepresentationUnderneath()) {
     Handle<String> result =
         isolate->factory()->NewRawOneByteString(worst_case_length);
+    ASSERT(!result.is_null());
     DisallowHeapAllocation no_gc;
     return StringifyString_<SeqOneByteString>(
         isolate,
         object->GetFlatContent().ToOneByteVector(),
         result);
   } else {
     Handle<String> result =
         isolate->factory()->NewRawTwoByteString(worst_case_length);
+    ASSERT(!result.is_null());
     DisallowHeapAllocation no_gc;
     return StringifyString_<SeqTwoByteString>(
         isolate,
         object->GetFlatContent().ToUC16Vector(),
         result);
   }
 }
 
 
 template <typename ResultType, typename Char>
@@ skipping 385 matching lines @@
 void BasicJsonStringifier::ShrinkCurrentPart() {
   ASSERT(current_index_ < part_length_);
   current_part_ = SeqString::Truncate(Handle<SeqString>::cast(current_part_),
                                       current_index_);
 }
 
 
 void BasicJsonStringifier::Accumulate() {
   if (accumulator()->length() + current_part_->length() > String::kMaxLength) {
     // Screw it.  Simply set the flag and carry on.  Throw exception at the end.
-    // We most likely will trigger a real OOM before even reaching this point.
     set_accumulator(factory_->empty_string());
     overflowed_ = true;
   } else {
     set_accumulator(factory_->NewConsString(accumulator(), current_part_));
   }
 }
 
 
 void BasicJsonStringifier::Extend() {
   Accumulate();
   if (part_length_ <= kMaxPartLength / kPartLengthGrowthFactor) {
     part_length_ *= kPartLengthGrowthFactor;
   }
   if (is_ascii_) {
     current_part_ = factory_->NewRawOneByteString(part_length_);
   } else {
     current_part_ = factory_->NewRawTwoByteString(part_length_);
   }
+  ASSERT(!current_part_.is_null());
   current_index_ = 0;
 }
 
 
 void BasicJsonStringifier::ChangeEncoding() {
   ShrinkCurrentPart();
   Accumulate();
   current_part_ = factory_->NewRawTwoByteString(part_length_);
+  ASSERT(!current_part_.is_null());
   current_index_ = 0;
   is_ascii_ = false;
 }
 
 
 template <typename SrcChar, typename DestChar>
 int BasicJsonStringifier::SerializeStringUnchecked_(const SrcChar* src,
                                                     DestChar* dest,
                                                     int length) {
   DestChar* dest_start = dest;
@@ skipping 108 matching lines @@
       SerializeString_<false, uint8_t>(object);
     } else {
       SerializeString_<false, uc16>(object);
     }
   }
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_JSON_STRINGIFIER_H_