Changeset 287626 in webkit

Timestamp:

Jan 5, 2022, 10:20:59 AM (5 years ago)

Author:

Russell Epstein

Message:

Cherry-pick r286283. rdar://problem/87125362

[JSC] jumpForTypedArrayOutOfBounds should use asAnyInt since it uses isAnyInt
​https://bugs.webkit.org/show_bug.cgi?id=233610
rdar://85820476

Reviewed by Saam Barati.

JSTests:

• stress/anyint-index.js: Added. (foo):

Source/JavaScriptCore:

Since we are using isAnyInt, then we should use asAnyInt. asUInt32 will crash
if the value is double AnyInt etc.

• dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@286283 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-612-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/anyint-index.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

branches/safari-612-branch/JSTests/ChangeLog

@@ +1 @@
+2022-01-05  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r286283. rdar://problem/87125362
+
+    [JSC] jumpForTypedArrayOutOfBounds should use asAnyInt since it uses isAnyInt
+    https://bugs.webkit.org/show_bug.cgi?id=233610
+    rdar://85820476
+    
+    Reviewed by Saam Barati.
+    
+    JSTests:
+    
+    * stress/anyint-index.js: Added.
+    (foo):
+    
+    Source/JavaScriptCore:
+    
+    Since we are using isAnyInt, then we should use asAnyInt. asUInt32 will crash
+    if the value is double AnyInt etc.
+    
+    * dfg/DFGSpeculativeJIT.cpp:
+    (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286283 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
+
+            [JSC] jumpForTypedArrayOutOfBounds should use asAnyInt since it uses isAnyInt
+            https://bugs.webkit.org/show_bug.cgi?id=233610
+            rdar://85820476
+
+            Reviewed by Saam Barati.
+
+            * stress/anyint-index.js: Added.
+            (foo):
+
 2022-01-05  Russell Epstein  <repstein@apple.com>
 

branches/safari-612-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2022-01-05  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r286283. rdar://problem/87125362
+
+    [JSC] jumpForTypedArrayOutOfBounds should use asAnyInt since it uses isAnyInt
+    https://bugs.webkit.org/show_bug.cgi?id=233610
+    rdar://85820476
+    
+    Reviewed by Saam Barati.
+    
+    JSTests:
+    
+    * stress/anyint-index.js: Added.
+    (foo):
+    
+    Source/JavaScriptCore:
+    
+    Since we are using isAnyInt, then we should use asAnyInt. asUInt32 will crash
+    if the value is double AnyInt etc.
+    
+    * dfg/DFGSpeculativeJIT.cpp:
+    (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286283 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
+
+            [JSC] jumpForTypedArrayOutOfBounds should use asAnyInt since it uses isAnyInt
+            https://bugs.webkit.org/show_bug.cgi?id=233610
+            rdar://85820476
+
+            Reviewed by Saam Barati.
+
+            Since we are using isAnyInt, then we should use asAnyInt. asUInt32 will crash
+            if the value is double AnyInt etc.
+
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
+
 2022-01-05  Russell Epstein  <repstein@apple.com>
 

branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -3248 +3248 @@
         size_t length = view->length();
         Node* indexNode = m_jit.graph().child(node, 1).node();
-        if (indexNode->isAnyIntConstant() && indexNode->asUInt32() < length)
+        if (indexNode->isAnyIntConstant() && static_cast<uint64_t>(indexNode->asAnyInt()) < length)
             return JITCompiler::Jump();
 #if USE(LARGE_TYPED_ARRAYS)