Title: [274538] trunk/Source/_javascript_Core
- Revision
- 274538
- Author
- [email protected]
- Date
- 2021-03-16 17:10:27 -0700 (Tue, 16 Mar 2021)
Log Message
Fixed undefined behavior bug in Const32Value::checkNegConstant().
https://bugs.webkit.org/show_bug.cgi?id=223284
Reviewed by Darin Adler.
This was causing a failure in testb3 on a release build.
Also do the same for Const64Value::checkNegConstant().
* b3/B3Const32Value.cpp:
(JSC::B3::Const32Value::checkNegConstant const):
* b3/B3Const64Value.cpp:
(JSC::B3::Const64Value::checkNegConstant const):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (274537 => 274538)
--- trunk/Source/_javascript_Core/ChangeLog 2021-03-17 00:08:34 UTC (rev 274537)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-03-17 00:10:27 UTC (rev 274538)
@@ -1,3 +1,18 @@
+2021-03-16 Mark Lam <[email protected]>
+
+ Fixed undefined behavior bug in Const32Value::checkNegConstant().
+ https://bugs.webkit.org/show_bug.cgi?id=223284
+
+ Reviewed by Darin Adler.
+
+ This was causing a failure in testb3 on a release build.
+ Also do the same for Const64Value::checkNegConstant().
+
+ * b3/B3Const32Value.cpp:
+ (JSC::B3::Const32Value::checkNegConstant const):
+ * b3/B3Const64Value.cpp:
+ (JSC::B3::Const64Value::checkNegConstant const):
+
2021-03-16 Alexey Shvayka <[email protected]>
Cache cross-origin methods / accessors of Window and Location per lexical global object
Modified: trunk/Source/_javascript_Core/b3/B3Const32Value.cpp (274537 => 274538)
--- trunk/Source/_javascript_Core/b3/B3Const32Value.cpp 2021-03-17 00:08:34 UTC (rev 274537)
+++ trunk/Source/_javascript_Core/b3/B3Const32Value.cpp 2021-03-17 00:10:27 UTC (rev 274538)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -100,7 +100,7 @@
Value* Const32Value::checkNegConstant(Procedure& proc) const
{
- if (m_value == -m_value)
+ if (m_value == std::numeric_limits<int32_t>::min())
return nullptr;
return negConstant(proc);
}
Modified: trunk/Source/_javascript_Core/b3/B3Const64Value.cpp (274537 => 274538)
--- trunk/Source/_javascript_Core/b3/B3Const64Value.cpp 2021-03-17 00:08:34 UTC (rev 274537)
+++ trunk/Source/_javascript_Core/b3/B3Const64Value.cpp 2021-03-17 00:10:27 UTC (rev 274538)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -100,7 +100,7 @@
Value* Const64Value::checkNegConstant(Procedure& proc) const
{
- if (m_value == -m_value)
+ if (m_value == std::numeric_limits<int64_t>::min())
return nullptr;
return negConstant(proc);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
