Changeset 167548 in webkit

Timestamp:

Apr 19, 2014, 2:13:46 PM (12 years ago)

Author:

fpizlo@apple.com

Message:

Make it easier to check if an integer sum would overflow
​https://bugs.webkit.org/show_bug.cgi?id=131900

Reviewed by Darin Adler.

Source/JavaScriptCore:

• dfg/DFGOperations.cpp:
• runtime/Operations.h:

(JSC::jsString):

Source/WTF:

• wtf/CheckedArithmetic.h:

(WTF::checkedSum):
(WTF::sumOverflows):

Location:

trunk/Source

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/dfg/DFGOperations.cpp (modified) (2 diffs)
• JavaScriptCore/runtime/Operations.h (modified) (2 diffs)
• WTF/ChangeLog (modified) (1 diff)
• WTF/wtf/CheckedArithmetic.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-04-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Make it easier to check if an integer sum would overflow
+        https://bugs.webkit.org/show_bug.cgi?id=131900
+
+        Reviewed by Darin Adler.
+
+        * dfg/DFGOperations.cpp:
+        * runtime/Operations.h:
+        (JSC::jsString):
+
 2014-04-19  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -969 +969 @@
     VM& vm = exec->vm();
     NativeCallFrameTracer tracer(&vm, exec);
-    
-    if (static_cast<int32_t>(left->length() + right->length()) < 0) {
+
+    if (sumOverflows<int32_t>(left->length(), right->length())) {
         throwOutOfMemoryError(exec);
         return nullptr;
@@ -983 +983 @@
     NativeCallFrameTracer tracer(&vm, exec);
 
-    Checked<int32_t, RecordOverflow> length = a->length();
-    length += b->length();
-    length += c->length();
-    if (length.hasOverflowed()) {
+    if (sumOverflows<int32_t>(a->length(), b->length(), c->length())) {
         throwOutOfMemoryError(exec);
         return nullptr;

trunk/Source/JavaScriptCore/runtime/Operations.h

@@ -45 +45 @@
     if (!length2)
         return s1;
-    if ((length1 + length2) < 0)
+    if (sumOverflows<int32_t>(length1, length2))
         return throwOutOfMemoryError(exec);
 
@@ -69 +69 @@
         return jsString(exec, jsString(vm, u1), jsString(vm, u2));
 
-    if ((length1 + length2) < 0)
-        return throwOutOfMemoryError(exec);
-    if ((length1 + length2 + length3) < 0)
+    if (sumOverflows<int32_t>(length1, length2, length3))
         return throwOutOfMemoryError(exec);
 

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2014-04-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Make it easier to check if an integer sum would overflow
+        https://bugs.webkit.org/show_bug.cgi?id=131900
+
+        Reviewed by Darin Adler.
+
+        * wtf/CheckedArithmetic.h:
+        (WTF::checkedSum):
+        (WTF::sumOverflows):
+
 2014-04-18  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/WTF/wtf/CheckedArithmetic.h

@@ -717 +717 @@
 typedef Checked<size_t, RecordOverflow> CheckedSize;
 
+template<typename T, typename U>
+Checked<T, RecordOverflow> checkedSum(U value)
+{
+    return Checked<T, RecordOverflow>(value);
+}
+template<typename T, typename U, typename... Args>
+Checked<T, RecordOverflow> checkedSum(U value, Args... args)
+{
+    return Checked<T, RecordOverflow>(value) + checkedSum<T>(args...);
+}
+
+// Sometimes, you just want to check if some math would overflow - the code to do the math is
+// already in place, and you want to guard it.
+
+template<typename T, typename... Args> bool sumOverflows(Args... args)
+{
+    return checkedSum<T>(args...).hasOverflowed();
+}
+
 }
 
@@ -731 +750 @@
 using WTF::CheckedUint64;
 using WTF::CheckedSize;
+using WTF::checkedSum;
+using WTF::sumOverflows;
 
 #endif