Changeset 242114 in webkit

Timestamp:

Feb 26, 2019, 4:25:34 PM (8 years ago)

Author:

mark.lam@apple.com

Message:

wasmToJS() should purify incoming NaNs.
​https://bugs.webkit.org/show_bug.cgi?id=194807
<rdar://problem/48189132>

Reviewed by Saam Barati.

JSTests:

• wasm/regress/wasmToJS-should-purify-NaNs.js: Added.

Source/JavaScriptCore:

• runtime/JSCJSValue.h:

(JSC::jsNumber):

• runtime/TypedArrayAdaptors.h:

(JSC::IntegralTypedArrayAdaptor::toJSValue):

• wasm/js/WasmToJS.cpp:

(JSC::Wasm::wasmToJS):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/wasm/regress/wasmToJS-should-purify-NaNs.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSCJSValue.h (modified) (3 diffs)
• Source/JavaScriptCore/runtime/TypedArrayAdaptors.h (modified) (2 diffs)
• Source/JavaScriptCore/wasm/js/WasmToJS.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-02-26  Mark Lam  <mark.lam@apple.com>
+
+        wasmToJS() should purify incoming NaNs.
+        https://bugs.webkit.org/show_bug.cgi?id=194807
+        <rdar://problem/48189132>
+
+        Reviewed by Saam Barati.
+
+        * wasm/regress/wasmToJS-should-purify-NaNs.js: Added.
+
 2019-02-26  Guillaume Emont  <guijemont@igalia.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-02-26  Mark Lam  <mark.lam@apple.com>
+
+        wasmToJS() should purify incoming NaNs.
+        https://bugs.webkit.org/show_bug.cgi?id=194807
+        <rdar://problem/48189132>
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSCJSValue.h:
+        (JSC::jsNumber):
+        * runtime/TypedArrayAdaptors.h:
+        (JSC::IntegralTypedArrayAdaptor::toJSValue):
+        * wasm/js/WasmToJS.cpp:
+        (JSC::Wasm::wasmToJS):
+
 2019-02-26  Dominik Infuehr  <dinfuehr@igalia.com>
 

trunk/Source/JavaScriptCore/runtime/JSCJSValue.h

@@ -2 +2 @@
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003-2018 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003-2019 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
@@ -24 +24 @@
 
 #include "JSExportMacros.h"
+#include "PureNaN.h"
 #include <functional>
 #include <math.h>
@@ -549 +550 @@
 {
     ASSERT(JSValue(d).isNumber());
+    ASSERT(!isImpureNaN(d));
     return JSValue(d);
 }

trunk/Source/JavaScriptCore/runtime/TypedArrayAdaptors.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -46 +46 @@
     static JSValue toJSValue(Type value)
     {
+        static_assert(!std::is_floating_point<Type>::value, "");
         return jsNumber(value);
     }

trunk/Source/JavaScriptCore/wasm/js/WasmToJS.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2016-2018 Apple Inc. All rights reserved.
+ * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -250 +250 @@
                     case F32:
                     case F64:
-                        arg = jsNumber(bitwise_cast<double>(buffer[argNum]));
+                        arg = jsNumber(purifyNaN(bitwise_cast<double>(buffer[argNum])));
                         break;
                     }