Changeset 260522 in webkit

Timestamp:

Apr 22, 2020 11:12:34 AM (4 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] JSBigInt inc operation does not produce right HeapBigInt zero
​https://bugs.webkit.org/show_bug.cgi?id=210860

Reviewed by Mark Lam.

JSTests:

• stress/bigint-zero-canonicalized.js: Added.

(shouldBe):

Source/JavaScriptCore:

JSBigInt::inc can produce signed HeapBigInt zero, which is not meeting the invariant of JSBigInt.
This patch fixes it by checking zero status before setting setSign(true).

• runtime/JSBigInt.cpp:

(JSC::JSBigInt::inc):

• runtime/JSCJSValue.cpp:

(JSC::JSValue::dumpInContextAssumingStructure const):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/bigint-zero-canonicalized.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSBigInt.cpp (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSCJSValue.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-04-22  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] JSBigInt inc operation does not produce right HeapBigInt zero
+        https://bugs.webkit.org/show_bug.cgi?id=210860
+
+        Reviewed by Mark Lam.
+
+        * stress/bigint-zero-canonicalized.js: Added.
+        (shouldBe):
+
 2020-04-22  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-04-22  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] JSBigInt inc operation does not produce right HeapBigInt zero
+        https://bugs.webkit.org/show_bug.cgi?id=210860
+
+        Reviewed by Mark Lam.
+
+        JSBigInt::inc can produce signed HeapBigInt zero, which is not meeting the invariant of JSBigInt.
+        This patch fixes it by checking zero status before setting `setSign(true)`.
+
+        * runtime/JSBigInt.cpp:
+        (JSC::JSBigInt::inc):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpInContextAssumingStructure const):
+
 2020-04-22  Devin Rousso  <drousso@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSBigInt.cpp

@@ -447 +447 @@
         return absoluteAddOne(globalObject, x, SignOption::Unsigned);
     JSBigInt* result = absoluteSubOne(globalObject, x, x->length());
+    if (result->isZero())
+        return result;
     result->setSign(true);
     return result;

trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp

@@ -313 +313 @@
             out.print("Structure: ", inContext(*jsCast<Structure*>(asCell()), context));
         else if (isHeapBigInt())
-            out.print("BigInt[heap-allocated]: addr=", RawPointer(asCell()));
+            out.print("BigInt[heap-allocated]: addr=", RawPointer(asCell()), ", length=", jsCast<JSBigInt*>(asCell())->length(), ", sign=", jsCast<JSBigInt*>(asCell())->sign());
         else if (structure->classInfo()->isSubClassOf(JSObject::info())) {
             out.print("Object: ", RawPointer(asCell()));