Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b2233ac176432e7d890d5d7aef59e1e34b111e24
https://github.com/WebKit/WebKit/commit/b2233ac176432e7d890d5d7aef59e1e34b111e24
Author: Yijia Huang <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M JSTests/stress/temporal-duration-round-zero-length-nudge-window.js
M Source/JavaScriptCore/API/tests/TemporalCoreTest.cpp
M Source/JavaScriptCore/runtime/temporal/core/DurationArithmetic.cpp
M Source/JavaScriptCore/runtime/temporal/core/DurationArithmetic.h
M Source/JavaScriptCore/runtime/temporal/core/ISOArithmetic.cpp
Log Message:
-----------
[JSC][Temporal] Fix undefined behavior, a loose bound, and remove dead code
https://bugs.webkit.org/show_bug.cgi?id=321415
rdar://184484038
Reviewed by Sosuke Suzuki.
NudgeResult and Nudged left members uninitialized, and roundRelativeDuration
default-constructs a NudgeResult before the branch that fills it in.
addDaysToISODate guarded with isInBounds<int32_t>, but yearMonthDayFromDays
adds a ~1.47e8
day offset internally, so anything above 2000667119 overflows a signed int
inside it.
Bounded by 1e9 instead, well above the 1e8-day representable range. No
observable change.
nudgeToZonedTime's step 8 asserted TimeDurationSign(daySpan) = sign, but sign
is only +/-1
while TimeDurationSign also returns 0. With sign = -1, step 3's endDate = start
- 1 can land
on a calendar day the zone skips entirely, collapsing daySpan to 0 and crashing
debug
builds. 170ee738c6f1 removed the same violable assertion from
nudgeToCalendarUnit per
tc39/proposal-temporal#3310; there the span is divided by and needs a
RangeError, here it is
only subtracted, so tolerating zero suffices.
unitIndexInTable and unitInTable were constexpr in the header with definitions
in the .cpp,
so no other translation unit could use them. Now static in
DurationArithmetic.cpp.
balanceDuration, totalSeconds and totalSubseconds have no production callers;
only
TemporalCoreTest.cpp reached them.
Test: Source/JavaScriptCore/API/tests/TemporalCoreTest.cpp
Canonical link: https://commits.webkit.org/318900@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
