Changeset 284573 in webkit

Timestamp:

Oct 20, 2021, 2:45:13 PM (5 years ago)

Author:

msaboff@apple.com

Message:

Add missing overflow checks to DFGIntegerRangeOptimizationPhase::isEquivalentTo()
​https://bugs.webkit.org/show_bug.cgi?id=232024

Reviewed by Tadeu Zagallo.

Added overflow check before comparing for equality.

• dfg/DFGIntegerRangeOptimizationPhase.cpp:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGIntegerRangeOptimizationPhase.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-10-20  Michael Saboff  <msaboff@apple.com>
+
+        Add missing overflow checks to DFGIntegerRangeOptimizationPhase::isEquivalentTo()
+        https://bugs.webkit.org/show_bug.cgi?id=232024
+
+        Reviewed by Tadeu Zagallo.
+
+        Added overflow check before comparing for equality.
+
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+
 2021-10-20  Michael Catanzaro  <mcatanzaro@gnome.org>
 

trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -229 +229 @@
             return true;
 
-        if (m_right->isInt32Constant() && other.m_right->isInt32Constant())
-            return (m_right->asInt32() + m_offset) == (other.m_right->asInt32() + other.m_offset);
+        if (m_right->isInt32Constant() && other.m_right->isInt32Constant()) {
+            int thisRight = m_right->asInt32();
+            int otherRight = other.m_right->asInt32();
+
+            if (sumOverflows<int>(thisRight, m_offset))
+                return false;
+            if (sumOverflows<int>(otherRight, other.m_offset))
+                return false;
+
+            return (thisRight + m_offset) == (otherRight + other.m_offset);
+        }
         return false;
     }