Changeset 278660 in webkit

Timestamp:

Jun 9, 2021, 8:21:39 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Fix inadvertent tag corruption in functionAddressOf
​https://bugs.webkit.org/show_bug.cgi?id=226503

Patch by Mikhail R. Gadelha <Mikhail R. Gadelha> on 2021-06-09
Reviewed by Darin Adler.

Original patch by Angelos Oikonomopoulos.

The cast was sign-extending the JSValue address in 32 bits, so that addresses
that had the most significant set gave us a sign-extended result in
asNumber which was then converted to an invalid NaN by the bitcast.

Instead, cast the address to uintptr_t, and the result will be promoted
uint64_t without sign-extending the address.

• jsc.cpp:

(JSC_DEFINE_HOST_FUNCTION):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• jsc.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-06-09  Mikhail R. Gadelha  <mikhail@igalia.com>
+
+        Fix inadvertent tag corruption in functionAddressOf
+        https://bugs.webkit.org/show_bug.cgi?id=226503
+
+        Reviewed by Darin Adler.
+
+        Original patch by Angelos Oikonomopoulos.
+
+        The cast was sign-extending the JSValue address in 32 bits, so that addresses
+        that had the most significant set gave us a sign-extended result in
+        asNumber which was then converted to an invalid NaN by the bitcast.
+
+        Instead, cast the address to uintptr_t, and the result will be promoted
+        uint64_t without sign-extending the address.
+
+        * jsc.cpp:
+        (JSC_DEFINE_HOST_FUNCTION):
+
 2021-06-08  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/jsc.cpp

@@ -1481 +1481 @@
         return JSValue::encode(jsUndefined());
     // Need to cast to uint64_t so bitwise_cast will play along.
-    uint64_t asNumber = reinterpret_cast<uint64_t>(value.asCell());
+    uint64_t asNumber = reinterpret_cast<uintptr_t>(value.asCell());
     EncodedJSValue returnValue = JSValue::encode(jsNumber(bitwise_cast<double>(asNumber)));
     return returnValue;