Changeset 244057 in webkit

Timestamp:

Apr 8, 2019, 4:33:05 PM (7 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] to_index_string should not assume incoming value is Uint32
​https://bugs.webkit.org/show_bug.cgi?id=196713

Reviewed by Saam Barati.

JSTests:

• stress/to-index-string-should-not-assume-incoming-value-is-uint32.js: Added.

(foo):

Source/JavaScriptCore:

The slow path of to_index_string assumes that incoming value is Uint32. But we should not have
this assumption since DFG may decide we should have it double format. This patch removes this
assumption, and instead, we should assume that incoming value is AnyInt and the range of this
is within Uint32.

• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/to-index-string-should-not-assume-incoming-value-is-uint32.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] to_index_string should not assume incoming value is Uint32
+        https://bugs.webkit.org/show_bug.cgi?id=196713
+
+        Reviewed by Saam Barati.
+
+        * stress/to-index-string-should-not-assume-incoming-value-is-uint32.js: Added.
+        (foo):
+
 2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-04-08  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] to_index_string should not assume incoming value is Uint32
+        https://bugs.webkit.org/show_bug.cgi?id=196713
+
+        Reviewed by Saam Barati.
+
+        The slow path of to_index_string assumes that incoming value is Uint32. But we should not have
+        this assumption since DFG may decide we should have it double format. This patch removes this
+        assumption, and instead, we should assume that incoming value is AnyInt and the range of this
+        is within Uint32.
+
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+
 2019-04-08  Justin Fan  <justin_fan@apple.com>
 

trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

@@ -996 +996 @@
     BEGIN();
     auto bytecode = pc->as<OpToIndexString>();
-    RETURN(jsString(exec, Identifier::from(exec, GET(bytecode.m_index).jsValue().asUInt32()).string()));
+    JSValue indexValue = GET(bytecode.m_index).jsValue();
+    ASSERT(indexValue.isAnyInt());
+    ASSERT(indexValue.asAnyInt() <= UINT32_MAX);
+    ASSERT(indexValue.asAnyInt() >= 0);
+    uint32_t index = static_cast<uint32_t>(indexValue.asAnyInt());
+    RETURN(jsString(exec, Identifier::from(exec, index).string()));
 }