Title: [284807] branches/safari-612-branch/Source/_javascript_Core
- Revision
- 284807
- Author
- [email protected]
- Date
- 2021-10-25 12:09:56 -0700 (Mon, 25 Oct 2021)
Log Message
Cherry-pick r284573. rdar://problem/84329018
Add missing overflow checks to DFGIntegerRangeOptimizationPhase::isEquivalentTo()
https://bugs.webkit.org/show_bug.cgi?id=232024
Reviewed by Tadeu Zagallo.
Added overflow check before comparing for equality.
* dfg/DFGIntegerRangeOptimizationPhase.cpp:
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284573 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-612-branch/Source/_javascript_Core/ChangeLog (284806 => 284807)
--- branches/safari-612-branch/Source/_javascript_Core/ChangeLog 2021-10-25 19:09:53 UTC (rev 284806)
+++ branches/safari-612-branch/Source/_javascript_Core/ChangeLog 2021-10-25 19:09:56 UTC (rev 284807)
@@ -1,5 +1,32 @@
2021-10-25 Null <[email protected]>
+ Cherry-pick r284573. rdar://problem/84329018
+
+ Add missing overflow checks to DFGIntegerRangeOptimizationPhase::isEquivalentTo()
+ https://bugs.webkit.org/show_bug.cgi?id=232024
+
+ Reviewed by Tadeu Zagallo.
+
+ Added overflow check before comparing for equality.
+
+ * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284573 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-10-20 Michael Saboff <[email protected]>
+
+ Add missing overflow checks to DFGIntegerRangeOptimizationPhase::isEquivalentTo()
+ https://bugs.webkit.org/show_bug.cgi?id=232024
+
+ Reviewed by Tadeu Zagallo.
+
+ Added overflow check before comparing for equality.
+
+ * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+
+2021-10-25 Null <[email protected]>
+
Cherry-pick r284506. rdar://problem/84340372
canDoFastSpread should also check that the Structure is from the global object we're watching
Modified: branches/safari-612-branch/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp (284806 => 284807)
--- branches/safari-612-branch/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp 2021-10-25 19:09:53 UTC (rev 284806)
+++ branches/safari-612-branch/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp 2021-10-25 19:09:56 UTC (rev 284807)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -228,8 +228,17 @@
if (*this == other)
return true;
- if (m_right->isInt32Constant() && other.m_right->isInt32Constant())
- return (m_right->asInt32() + m_offset) == (other.m_right->asInt32() + other.m_offset);
+ if (m_right->isInt32Constant() && other.m_right->isInt32Constant()) {
+ int thisRight = m_right->asInt32();
+ int otherRight = other.m_right->asInt32();
+
+ if (sumOverflows<int>(thisRight, m_offset))
+ return false;
+ if (sumOverflows<int>(otherRight, other.m_offset))
+ return false;
+
+ return (thisRight + m_offset) == (otherRight + other.m_offset);
+ }
return false;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
