Changeset 286283 in webkit

Timestamp:

Nov 29, 2021, 8:43:51 PM (5 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] jumpForTypedArrayOutOfBounds should use asAnyInt since it uses isAnyInt
​https://bugs.webkit.org/show_bug.cgi?id=233610
rdar://85820476

Reviewed by Saam Barati.

JSTests:

• stress/anyint-index.js: Added.

(foo):

Source/JavaScriptCore:

Since we are using isAnyInt, then we should use asAnyInt. asUInt32 will crash
if the value is double AnyInt etc.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/anyint-index.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] jumpForTypedArrayOutOfBounds should use asAnyInt since it uses isAnyInt
+        https://bugs.webkit.org/show_bug.cgi?id=233610
+        rdar://85820476
+
+        Reviewed by Saam Barati.
+
+        * stress/anyint-index.js: Added.
+        (foo):
+
 2021-11-29  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] jumpForTypedArrayOutOfBounds should use asAnyInt since it uses isAnyInt
+        https://bugs.webkit.org/show_bug.cgi?id=233610
+        rdar://85820476
+
+        Reviewed by Saam Barati.
+
+        Since we are using isAnyInt, then we should use asAnyInt. asUInt32 will crash
+        if the value is double AnyInt etc.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
+
 2021-11-29  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -3538 +3538 @@
         size_t length = view->length();
         Node* indexNode = m_jit.graph().child(node, 1).node();
-        if (indexNode->isAnyIntConstant() && indexNode->asUInt32() < length)
+        if (indexNode->isAnyIntConstant() && static_cast<uint64_t>(indexNode->asAnyInt()) < length)
             return JITCompiler::Jump();
 #if USE(LARGE_TYPED_ARRAYS)