Changeset 287546 in webkit

Timestamp:

Jan 3, 2022 9:46:10 AM (7 months ago)

Author:

ysuzuki@apple.com

Message:

[JSC] Fix Intl.PluralRules.selectRange input validation
​https://bugs.webkit.org/show_bug.cgi?id=234817

Reviewed by Alexey Shvayka.

JSTests:

• stress/intl-pluralrules-select-range-validate-inputs.js: Added.

(shouldThrow):
(Intl.PluralRules.prototype.selectRange.shouldThrow):

Source/JavaScriptCore:

Add specified argument validation[1] to Intl.PluralRules.selectRange.

[1]: ​https://tc39.es/proposal-intl-numberformat-v3/out/pluralrules/proposed.html#sec-intl.pluralrules.prototype.selectrange

• runtime/IntlPluralRules.cpp:

(JSC::IntlPluralRules::selectRange const):

• runtime/IntlPluralRulesPrototype.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/intl-pluralrules-select-range-validate-inputs.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/IntlPluralRules.cpp (modified) (1 diff)
• Source/JavaScriptCore/runtime/IntlPluralRulesPrototype.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2022-01-03  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Fix Intl.PluralRules.selectRange input validation
+        https://bugs.webkit.org/show_bug.cgi?id=234817
+
+        Reviewed by Alexey Shvayka.
+
+        * stress/intl-pluralrules-select-range-validate-inputs.js: Added.
+        (shouldThrow):
+        (Intl.PluralRules.prototype.selectRange.shouldThrow):
+
 2022-01-03  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2022-01-03  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Fix Intl.PluralRules.selectRange input validation
+        https://bugs.webkit.org/show_bug.cgi?id=234817
+
+        Reviewed by Alexey Shvayka.
+
+        Add specified argument validation[1] to Intl.PluralRules.selectRange.
+
+        [1]: https://tc39.es/proposal-intl-numberformat-v3/out/pluralrules/proposed.html#sec-intl.pluralrules.prototype.selectrange
+
+        * runtime/IntlPluralRules.cpp:
+        (JSC::IntlPluralRules::selectRange const):
+        * runtime/IntlPluralRulesPrototype.cpp:
+        (JSC::JSC_DEFINE_HOST_FUNCTION):
+
 2022-01-03  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/runtime/IntlPluralRules.cpp

@@ -280 +280 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    if (start > end) {
-        throwRangeError(globalObject, scope, "start is larger than end"_s);
-        return { };
-    }
+    if (std::isnan(start) || std::isnan(end))
+        return throwRangeError(globalObject, scope, "Passed numbers are out of range"_s);
+
+    if (end < start)
+        return throwRangeError(globalObject, scope, "start is larger than end"_s);
+
+    if (isNegativeZero(end) && start >= 0)
+        return throwRangeError(globalObject, scope, "start is larger than end"_s);
 
     UErrorCode status = U_ZERO_ERROR;

trunk/Source/JavaScriptCore/runtime/IntlPluralRulesPrototype.cpp

@@ -111 +111 @@
         return JSValue::encode(throwTypeError(globalObject, scope, "Intl.PluralRules.prototype.selectRange called on value that's not a PluralRules"_s));
 
-    double start = callFrame->argument(0).toNumber(globalObject);
+    JSValue startValue = callFrame->argument(0);
+    JSValue endValue = callFrame->argument(1);
+
+    if (startValue.isUndefined() || endValue.isUndefined())
+        return throwVMTypeError(globalObject, scope, "start or end is undefined"_s);
+
+    double start = startValue.toNumber(globalObject);
     RETURN_IF_EXCEPTION(scope, { });
 
-    double end = callFrame->argument(1).toNumber(globalObject);
+    double end = endValue.toNumber(globalObject);
     RETURN_IF_EXCEPTION(scope, { });