Changeset 260720 in webkit

Timestamp:

Apr 25, 2020 9:44:22 PM (4 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] Handle BigInt32 INT32_MIN shift amount
​https://bugs.webkit.org/show_bug.cgi?id=211030

Reviewed by Darin Adler.

JSTests:

• stress/bigint-int32-min-shift.js: Added.

(shouldBe):
(shouldThrow):

Source/JavaScriptCore:

Our BigInt shift-operation does not correctly handle INT32_MIN shift amount, and producing a wrong result.
This patch fixes it.

• runtime/Operations.h:

(JSC::shift):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/bigint-int32-min-shift.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/Operations.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-04-25  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Handle BigInt32 INT32_MIN shift amount
+        https://bugs.webkit.org/show_bug.cgi?id=211030
+
+        Reviewed by Darin Adler.
+
+        * stress/bigint-int32-min-shift.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
 2020-04-25  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-04-25  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Handle BigInt32 INT32_MIN shift amount
+        https://bugs.webkit.org/show_bug.cgi?id=211030
+
+        Reviewed by Darin Adler.
+
+        Our BigInt shift-operation does not correctly handle INT32_MIN shift amount, and producing a wrong result.
+        This patch fixes it.
+
+        * runtime/Operations.h:
+        (JSC::shift):
+
 2020-04-25  Darin Adler  <darin@apple.com>
 

trunk/Source/JavaScriptCore/runtime/Operations.h

@@ -763 +763 @@
         if (rightInt32 < 0) {
             isLeft = !isLeft;
-            rightInt32 = -rightInt32;
+            if (rightInt32 == INT32_MIN)
+                rightInt32 = INT32_MAX; // Shifts one less than requested, but makes no observable difference.
+            else
+                rightInt32 = -rightInt32;
         }
         ASSERT(rightInt32 >= 0);