Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d5ba0ecec9c4681b9800c4a59d423357c4217d8d
https://github.com/WebKit/WebKit/commit/d5ba0ecec9c4681b9800c4a59d423357c4217d8d
Author: Sergey Rubanov <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A JSTests/stress/date-constructor-out-of-range-components.js
M Source/JavaScriptCore/runtime/JSDateMath.cpp
Log Message:
-----------
[JSC] Reject Date components that do not fit in the ECMAScript time range
https://bugs.webkit.org/show_bug.cgi?id=323443
Reviewed by Yusuke Suzuki.
localTimeToMS and the other Date math sinks only checked isfinite
before narrowing milliseconds to int64_t. A finite year such as
1000000000 produces a time far outside that type. Release already
TimeClipped that to NaN. UBSan reported the conversion.
Skip the narrowing when the value is outside ±8.64e15 plus one day.
TimeClip is still the spec gate. The extra day covers local offset
around the clip so getters on new Date(8.64e15) stay valid.
* Source/JavaScriptCore/runtime/JSDateMath.cpp:
* JSTests/stress/date-constructor-out-of-range-components.js: Added.
Canonical link: https://commits.webkit.org/320788@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
