Changeset 284807 in webkit

Timestamp:

Oct 25, 2021, 12:09:56 PM (5 years ago)

Author:

Alan Coon

Message:

Cherry-pick r284573. rdar://problem/84329018

Add missing overflow checks to DFGIntegerRangeOptimizationPhase::isEquivalentTo()
​https://bugs.webkit.org/show_bug.cgi?id=232024

Reviewed by Tadeu Zagallo.

Added overflow check before comparing for equality.

• dfg/DFGIntegerRangeOptimizationPhase.cpp:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284573 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-612-branch/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGIntegerRangeOptimizationPhase.cpp (modified) (2 diffs)

branches/safari-612-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-10-25  Null  <null@apple.com>
+
+        Cherry-pick r284573. rdar://problem/84329018
+
+    Add missing overflow checks to DFGIntegerRangeOptimizationPhase::isEquivalentTo()
+    https://bugs.webkit.org/show_bug.cgi?id=232024
+    
+    Reviewed by Tadeu Zagallo.
+    
+    Added overflow check before comparing for equality.
+    
+    * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284573 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-10-20  Michael Saboff  <msaboff@apple.com>
+
+            Add missing overflow checks to DFGIntegerRangeOptimizationPhase::isEquivalentTo()
+            https://bugs.webkit.org/show_bug.cgi?id=232024
+
+            Reviewed by Tadeu Zagallo.
+
+            Added overflow check before comparing for equality.
+
+            * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+
 2021-10-25  Null  <null@apple.com>
 

branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -229 +229 @@
             return true;
 
-        if (m_right->isInt32Constant() && other.m_right->isInt32Constant())
-            return (m_right->asInt32() + m_offset) == (other.m_right->asInt32() + other.m_offset);
+        if (m_right->isInt32Constant() && other.m_right->isInt32Constant()) {
+            int thisRight = m_right->asInt32();
+            int otherRight = other.m_right->asInt32();
+
+            if (sumOverflows<int>(thisRight, m_offset))
+                return false;
+            if (sumOverflows<int>(otherRight, other.m_offset))
+                return false;
+
+            return (thisRight + m_offset) == (otherRight + other.m_offset);
+        }
         return false;
     }