Changeset 110443 in webkit

Timestamp:

Mar 12, 2012 10:31:26 AM (12 years ago)

Author:

commit-queue@webkit.org

Message:

Integer overflow check code in arithmetic operation in classic interpreter
​https://bugs.webkit.org/show_bug.cgi?id=80465

Patch by SangGyu Lee <​sg5.lee@samsung.com> on 2012-03-12
Reviewed by Gavin Barraclough.

• interpreter/Interpreter.cpp:

(JSC::Interpreter::privateExecute):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• interpreter/Interpreter.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2012-03-12  SangGyu Lee  <sg5.lee@samsung.com>
+
+        Integer overflow check code in arithmetic operation in classic interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=80465
+
+        Reviewed by Gavin Barraclough.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
 2012-03-12  Zeno Albisser  <zeno@webkit.org>
 

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -2353 +2353 @@
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
+        if (src1.isInt32() && src2.isInt32() && !((src1.asInt32() | src2.asInt32()) & 0xc0000000)) // no overflow
             callFrame->uncheckedR(dst) = jsNumber(src1.asInt32() + src2.asInt32());
         else {
@@ -2372 +2372 @@
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() >> 15)) // no overflow
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32()) >> 15) // no overflow
                 callFrame->uncheckedR(dst) = jsNumber(src1.asInt32() * src2.asInt32());
         else {
@@ -2440 +2440 @@
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
+        if (src1.isInt32() && src2.isInt32() && !((src1.asInt32() | src2.asInt32()) & 0xc0000000)) // no overflow
             callFrame->uncheckedR(dst) = jsNumber(src1.asInt32() - src2.asInt32());
         else {