From 787cd95fef92b4599a83a83337b5b0006141134b Mon Sep 17 00:00:00 2001
From: Frank Tang <ftang@chromium.org>
Date: Fri, 18 Oct 2019 14:50:08 -0700
Subject: [PATCH] Fix crash bug with some numberingSystem and
 dateStyle/timeStyle

Bug: v8:9849
Change-Id: Ib7812e27dcacb30fd2610badbf79dee190fdec15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1869078
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64436}
---
 src/objects/js-date-time-format.cc | 32 +++++++++++++++++++++++++++++-
 test/intl/regress-9849.js          | 15 ++++++++++++++
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 test/intl/regress-9849.js

diff --git a/src/objects/js-date-time-format.cc b/src/objects/js-date-time-format.cc
index d30586b428..835f3dc43a 100644
--- a/src/objects/js-date-time-format.cc
+++ b/src/objects/js-date-time-format.cc
@@ -1152,10 +1152,40 @@ std::unique_ptr<icu::SimpleDateFormat> DateTimeStylePattern(
       UNREACHABLE();
     }
   }
+
+  UErrorCode status = U_ZERO_ERROR;
+  // Somehow we fail to create the instance.
+  if (result.get() == nullptr) {
+    icu::Locale modified_locale(icu_locale);
+    // Fallback to the locale without "nu".
+    if (!icu_locale.getUnicodeKeywordValue<std::string>("nu", status).empty()) {
+      status = U_ZERO_ERROR;
+      modified_locale.setUnicodeKeywordValue("nu", nullptr, status);
+      return DateTimeStylePattern(date_style, time_style, modified_locale, hc,
+                                  generator);
+    }
+    status = U_ZERO_ERROR;
+    // Fallback to the locale without "hc".
+    if (!icu_locale.getUnicodeKeywordValue<std::string>("hc", status).empty()) {
+      status = U_ZERO_ERROR;
+      modified_locale.setUnicodeKeywordValue("hc", nullptr, status);
+      return DateTimeStylePattern(date_style, time_style, modified_locale, hc,
+                                  generator);
+    }
+    status = U_ZERO_ERROR;
+    // Fallback to the locale without "ca".
+    if (!icu_locale.getUnicodeKeywordValue<std::string>("ca", status).empty()) {
+      status = U_ZERO_ERROR;
+      modified_locale.setUnicodeKeywordValue("ca", nullptr, status);
+      return DateTimeStylePattern(date_style, time_style, modified_locale, hc,
+                                  generator);
+    }
+    return nullptr;
+  }
   icu::UnicodeString pattern;
   pattern = result->toPattern(pattern);
 
-  UErrorCode status = U_ZERO_ERROR;
+  status = U_ZERO_ERROR;
   icu::UnicodeString skeleton =
       icu::DateTimePatternGenerator::staticGetSkeleton(pattern, status);
   CHECK(U_SUCCESS(status));
diff --git a/test/intl/regress-9849.js b/test/intl/regress-9849.js
new file mode 100644
index 0000000000..0b406a0381
--- /dev/null
+++ b/test/intl/regress-9849.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let d = new Date(271733878);
+d.toLocaleString('en-u-nu-arab');
+d.toLocaleString('en-u-nu-arab', {dateStyle : 'full', timeStyle : 'full'});
+d.toLocaleString('en-u-nu-roman');
+d.toLocaleString('en-u-nu-roman', {dateStyle : 'full', timeStyle : 'full'});
+d.toLocaleString('sr-u-nu-roman');
+d.toLocaleString('sr-u-nu-roman', {dateStyle : 'full', timeStyle : 'full'});
+d.toLocaleString('sr-Cyrl-u-nu-roman');
+d.toLocaleString('sr-Cyrl-u-nu-roman', {dateStyle : 'full', timeStyle : 'full'});
+d.toLocaleString('zh-u-nu-roman', {dateStyle : 'full', timeStyle : 'full'});
+d.toLocaleString('ja-u-nu-cyrl', {dateStyle : 'full', timeStyle : 'full'});