Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 97df94ead028cddcfc21e48ec6f2f72d25ec1662
https://github.com/WebKit/WebKit/commit/97df94ead028cddcfc21e48ec6f2f72d25ec1662
Author: Mark Lam <[email protected]>
Date: 2026-08-23 (Sun, 23 Aug 2026)
Changed paths:
A JSTests/stress/unlinked-metadata-table-finalize-overflow.js
M Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.cpp
M Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.h
M Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.cpp
M Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.h
M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
Log Message:
-----------
Handle overflows in UnlinkedMetadataTable::finalize().
https://bugs.webkit.org/show_bug.cgi?id=317632
rdar://172794625
Reviewed by Dan Hecht.
If the number of opcodes (with metadata of substantive size) is large, the
32-bit unsigned
computed buffer offsets in UnlinkedMetadataTable::finalize() can overflow.
This patch
applies the use of CheckedArithmetic to detect and handle any potential
overflows. In the
event of a detected overflow, we'll propagate the failure to allocate the
bytecode metadata
up to the BytecodeGenerator, and treat its as an OOM error during parsing.
Test: JSTests/stress/unlinked-metadata-table-finalize-overflow.js
* JSTests/stress/unlinked-metadata-table-finalize-overflow.js: Added.
(try.f):
(catch):
* Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.cpp:
(JSC::UnlinkedCodeBlockGenerator::finalize):
* Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.h:
* Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.cpp:
(JSC::UnlinkedMetadataTable::finalize):
* Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.h:
* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::generate):
Originally-landed-as: [email protected] (9343a9521f58).
rdar://185367993
Canonical link: https://commits.webkit.org/319678@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
