Title: [153621] branches/safari-537-branch/Source/_javascript_Core
- Revision
- 153621
- Author
- [email protected]
- Date
- 2013-08-01 15:53:05 -0700 (Thu, 01 Aug 2013)
Log Message
Merge patch for <rdar://problem/14527940>.
Modified Paths
Diff
Modified: branches/safari-537-branch/Source/_javascript_Core/ChangeLog (153620 => 153621)
--- branches/safari-537-branch/Source/_javascript_Core/ChangeLog 2013-08-01 22:42:39 UTC (rev 153620)
+++ branches/safari-537-branch/Source/_javascript_Core/ChangeLog 2013-08-01 22:53:05 UTC (rev 153621)
@@ -1,3 +1,17 @@
+2013-08-01 Mark Hahnenberg <[email protected]>
+
+ GetByVal on Arguments does the wrong size load when checking the Arguments object length
+ https://bugs.webkit.org/show_bug.cgi?id=119281
+
+ Reviewed by Geoffrey Garen.
+
+ This leads to out of bounds accesses and subsequent crashes.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
2013-07-29 Lucas Forschler <[email protected]>
Merge r153071
Modified: branches/safari-537-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (153620 => 153621)
--- branches/safari-537-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-08-01 22:42:39 UTC (rev 153620)
+++ branches/safari-537-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-08-01 22:53:05 UTC (rev 153621)
@@ -3930,7 +3930,7 @@
// Two really lame checks.
speculationCheck(
Uncountable, JSValueSource(), 0,
- m_jit.branchPtr(
+ m_jit.branch32(
MacroAssembler::AboveOrEqual, propertyReg,
MacroAssembler::Address(baseReg, OBJECT_OFFSETOF(Arguments, m_numArguments))));
speculationCheck(
Modified: branches/safari-537-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (153620 => 153621)
--- branches/safari-537-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2013-08-01 22:42:39 UTC (rev 153620)
+++ branches/safari-537-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2013-08-01 22:53:05 UTC (rev 153621)
@@ -2852,7 +2852,7 @@
// Two really lame checks.
speculationCheck(
Uncountable, JSValueSource(), 0,
- m_jit.branchPtr(
+ m_jit.branch32(
MacroAssembler::AboveOrEqual, propertyReg,
MacroAssembler::Address(baseReg, OBJECT_OFFSETOF(Arguments, m_numArguments))));
speculationCheck(
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
