Turn on icu_case_mapping by default

src/js/i18n.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // ECMAScript 402 API implementation.
 
 /**
  * Intl object is a single object that has some named properties,
  * all of which are constructors.
  */
@@ skipping 1106 matching lines @@
 
 
 AddBoundMethod(GlobalIntlCollator, 'compare', compare, 2, 'collator', false);
 
 /**
  * Verifies that the input is a well-formed ISO 4217 currency code.
  * Don't uppercase to test. It could convert invalid code into a valid one.
  * For example \u00DFP (Eszett+P) becomes SSP.
  */
 function isWellFormedCurrencyCode(currency) {
-  return typeof currency == "string" && currency.length == 3 &&
+  return typeof currency === "string" && currency.length === 3 &&
       IS_NULL(%regexp_internal_match(/[^A-Za-z]/, currency));
 }
 
 
 /**
  * Returns the valid digit count for a property, or throws RangeError on
  * a value out of the range.
  */
 function getNumberOption(options, property, min, max, fallback) {
   var value = options[property];
@@ skipping 879 matching lines @@
     language = GetDefaultICULocaleJS();
   } else if (IS_STRING(locales)) {
     language = canonicalizeLanguageTag(locales);
   } else {
     var locales = initializeLocaleList(locales);
     language = locales.length > 0 ? locales[0] : GetDefaultICULocaleJS();
   }
 
   // StringSplit is slower than this.
   var pos = %StringIndexOf(language, '-', 0);
-  if (pos != -1) {
+  if (pos !== -1) {
     language = %_Call(StringSubstring, language, 0, pos);
   }
 
   var CUSTOM_CASE_LANGUAGES = ['az', 'el', 'lt', 'tr'];
   var langIndex = %ArrayIndexOf(CUSTOM_CASE_LANGUAGES, language, 0);
-  if (langIndex == -1) {
+  if (langIndex === -1) {

[jungshik at Google, 2017/01/10 01:22:45]

I tightened the comparison here just in case although it's not likely to help
with the crash. Nonetheless, it should be a good hygiene, I guess.

     // language-independent case conversion.
     return isToUpper ? %StringToUpperCaseI18N(s) : %StringToLowerCaseI18N(s);
   }
   return %StringLocaleConvertCase(s, isToUpper,
                                   CUSTOM_CASE_LANGUAGES[langIndex]);

[jungshik at Google, 2017/01/10 01:22:45]

In runtime-i18n.cc, CUSTOM_CASE_LANGUAGES[langIndex] is assumed to be
SeqOneByteString with the following code: 


RUNTIME_FUNCTION(Runtime_StringLocaleConvertCase) {
  HandleScope scope(isolate);
  DCHECK_EQ(args.length(), 3);
  CONVERT_ARG_HANDLE_CHECKED(String, s, 0);
  CONVERT_BOOLEAN_ARG_CHECKED(is_upper, 1);
  CONVERT_ARG_HANDLE_CHECKED(SeqOneByteString, lang, 2);  <=== crash

  // All the languages requiring special handling ("az", "el", "lt", "tr")
  // have a 2-letter language code.
  DCHECK(lang->length() == 2);
  uint8_t lang_str[3];
  memcpy(lang_str, lang->GetChars(), 2);
  lang_str[2] = 0;
  s = String::Flatten(s);


And, I loaded one of minidump into WinDBG and it appears that that's where it
crashed. Is my assumption wrong about SeqOneByteString when it's one of
CUSTOM_CASE_LANGUAGES above?  

 }
 
 /**
  * Compares this and that, and returns less than 0, 0 or greater than 0 value.
  * Overrides the built-in method.
  */
 OverrideFunction(GlobalString.prototype, 'localeCompare', function(that) {
     if (IS_NULL_OR_UNDEFINED(this)) {
       throw %make_type_error(kMethodInvokedOnNullOrUndefined);
     }
@@ skipping 148 matching lines @@
   }
 );
 
 %FunctionRemovePrototype(FormatDateToParts);
 
 utils.Export(function(to) {
   to.FormatDateToParts = FormatDateToParts;
 });
 
 })