Changeset 241550 in webkit

Timestamp:

Feb 14, 2019 9:37:23 AM (5 years ago)

Author:

Tadeu Zagallo

Message:

CachedBitVector's size must be converted from bits to bytes
​https://bugs.webkit.org/show_bug.cgi?id=194441

Reviewed by Saam Barati.

CachedBitVector used its size in bits for memcpy. That didn't cause any
issues when encoding, since the size in bits was also used in the allocation,
but would overflow the actual BitVector buffer when decoding.

• runtime/CachedTypes.cpp:

(JSC::CachedBitVector::encode):
(JSC::CachedBitVector::decode const):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/CachedTypes.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-02-14  Tadeu Zagallo  <tzagallo@apple.com>
+
+        CachedBitVector's size must be converted from bits to bytes
+        https://bugs.webkit.org/show_bug.cgi?id=194441
+
+        Reviewed by Saam Barati.
+
+        CachedBitVector used its size in bits for memcpy. That didn't cause any
+        issues when encoding, since the size in bits was also used in the allocation,
+        but would overflow the actual BitVector buffer when decoding.
+
+        * runtime/CachedTypes.cpp:
+        (JSC::CachedBitVector::encode):
+        (JSC::CachedBitVector::decode const):
+
 2019-02-13  Brian Burg  <bburg@apple.com>
 

trunk/Source/JavaScriptCore/runtime/CachedTypes.cpp

@@ -755 +755 @@
     void encode(Encoder& encoder, const BitVector& bitVector)
     {
-        m_size = bitVector.size();
-        if (!m_size)
+        m_numBits = bitVector.size();
+        if (!m_numBits)
             return;
-        uint8_t* buffer = this->allocate(encoder, m_size);
-        memcpy(buffer, bitVector.bits(), m_size);
+        size_t sizeInBytes = BitVector::byteCount(m_numBits);
+        uint8_t* buffer = this->allocate(encoder, sizeInBytes);
+        memcpy(buffer, bitVector.bits(), sizeInBytes);
     }
 
     void decode(Decoder&, BitVector& bitVector) const
     {
-        if (!m_size)
+        if (!m_numBits)
             return;
-        bitVector.ensureSize(m_size);
-        memcpy(bitVector.bits(), this->buffer(), m_size);
-    }
-
-private:
-    unsigned m_size;
+        bitVector.ensureSize(m_numBits);
+        size_t sizeInBytes = BitVector::byteCount(m_numBits);
+        memcpy(bitVector.bits(), this->buffer(), sizeInBytes);
+    }
+
+private:
+    size_t m_numBits;
 };