Log Message
Fix inadvertent tag corruption in functionAddressOf https://bugs.webkit.org/show_bug.cgi?id=226503
Patch by Mikhail R. Gadelha <[email protected]> on 2021-06-09 Reviewed by Darin Adler. Original patch by Angelos Oikonomopoulos. The cast was sign-extending the JSValue address in 32 bits, so that addresses that had the most significant set gave us a sign-extended result in asNumber which was then converted to an invalid NaN by the bitcast. Instead, cast the address to uintptr_t, and the result will be promoted uint64_t without sign-extending the address. * jsc.cpp: (JSC_DEFINE_HOST_FUNCTION):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (278659 => 278660)
--- trunk/Source/_javascript_Core/ChangeLog 2021-06-09 14:47:55 UTC (rev 278659)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-06-09 15:21:39 UTC (rev 278660)
@@ -1,3 +1,22 @@
+2021-06-09 Mikhail R. Gadelha <[email protected]>
+
+ Fix inadvertent tag corruption in functionAddressOf
+ https://bugs.webkit.org/show_bug.cgi?id=226503
+
+ Reviewed by Darin Adler.
+
+ Original patch by Angelos Oikonomopoulos.
+
+ The cast was sign-extending the JSValue address in 32 bits, so that addresses
+ that had the most significant set gave us a sign-extended result in
+ asNumber which was then converted to an invalid NaN by the bitcast.
+
+ Instead, cast the address to uintptr_t, and the result will be promoted
+ uint64_t without sign-extending the address.
+
+ * jsc.cpp:
+ (JSC_DEFINE_HOST_FUNCTION):
+
2021-06-08 Yusuke Suzuki <[email protected]>
[JSC] Use DataIC for AccessCase
Modified: trunk/Source/_javascript_Core/jsc.cpp (278659 => 278660)
--- trunk/Source/_javascript_Core/jsc.cpp 2021-06-09 14:47:55 UTC (rev 278659)
+++ trunk/Source/_javascript_Core/jsc.cpp 2021-06-09 15:21:39 UTC (rev 278660)
@@ -1480,7 +1480,7 @@
if (!value.isCell())
return JSValue::encode(jsUndefined());
// Need to cast to uint64_t so bitwise_cast will play along.
- uint64_t asNumber = reinterpret_cast<uint64_t>(value.asCell());
+ uint64_t asNumber = reinterpret_cast<uintptr_t>(value.asCell());
EncodedJSValue returnValue = JSValue::encode(jsNumber(bitwise_cast<double>(asNumber)));
return returnValue;
}
_______________________________________________ webkit-changes mailing list [email protected] https://lists.webkit.org/mailman/listinfo/webkit-changes
