From 44380f804da46fb265ab290ed97ee5352a39917a Mon Sep 17 00:00:00 2001
From: Frank Tang <ftang@chromium.org>
Date: Tue, 4 Feb 2020 15:48:34 -0800
Subject: [PATCH] Fix SEGMAP_ERR by rolling ICU?

Fix Intl.ListFormat long strings cause SEGMAP_ERR
Add slow regression test.

Bug: chromium:1044570
Change-Id: I20e3523832ac3c69e88c11bd530122bbe782ad01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2032712
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66140}
---
 test/intl/intl.status        |  3 +++
 test/intl/regress-1044570.js | 11 +++++++++++
 2 files changed, 14 insertions(+)
 create mode 100644 test/intl/regress-1044570.js

diff --git a/test/intl/intl.status b/test/intl/intl.status
index 6437de45db..436be10958 100644
--- a/test/intl/intl.status
+++ b/test/intl/intl.status
@@ -39,6 +39,9 @@
 
   # http://crbug/v8/9930
   'date-format/format_range_hour_cycle': [FAIL],
+
+  # Slow tests.
+  'regress-1044570': [PASS, SLOW, NO_VARIANTS],
 }],  # ALWAYS
 
 ['variant == no_wasm_traps', {
diff --git a/test/intl/regress-1044570.js b/test/intl/regress-1044570.js
new file mode 100644
index 0000000000..8e7b7bef0a
--- /dev/null
+++ b/test/intl/regress-1044570.js
@@ -0,0 +1,11 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test no crash with array of very long string.
+const num = 0xAFFFFFF;
+const lfm = new Intl.ListFormat();
+const s = 'a'.repeat(num);
+// Ensure the following won't crash. The length will be 0
+// because it will be too long to return correct result.
+assertEquals(0, lfm.format(Array(16).fill(s)).length);