Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 12196a032b7678f9b8f60a483ae22c01cc14af97
https://github.com/WebKit/WebKit/commit/12196a032b7678f9b8f60a483ae22c01cc14af97
Author: Yusuke Suzuki <[email protected]>
Date: 2026-07-16 (Thu, 16 Jul 2026)
Changed paths:
A JSTests/stress/string-substr-int-min-length-clamp.js
M Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
Log Message:
-----------
[JSC][DFG][x86_64] String.prototype.substr INT_MIN length clamp miscompile
creates invalid JSString length and Release abort/OOB-read evidence
https://bugs.webkit.org/show_bug.cgi?id=317480
rdar://180105216
Reviewed by Sosuke Suzuki.
x86_64 move(TrustedImm32, register) uses xor for 0 creation, which
clobbers cflag, causing a problem if cflag is used with cmov etc.
This patch adds moveWithoutClobberingFlags and use it when we need to
care about clfag. While moveWithoutClobberingFlags with TrustedImm64 is
not used right now, we may need it due to the exact same reason so
adding it.
Test: JSTests/stress/string-substr-int-min-length-clamp.js
* JSTests/stress/string-substr-int-min-length-clamp.js: Added.
(shouldBe):
* Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::moveWithoutClobberingFlags):
(JSC::MacroAssemblerX86_64::moveConditionally32):
(JSC::MacroAssemblerX86_64::moveConditionallyTest32):
Canonical link: https://commits.webkit.org/317364@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
