110828 2013-02-25 17:54:55 -0800 For JSVALUE32_64, maxOffsetRelativeToPatchedStorage() doesn't compute the maximum negative offset 2013-02-25 18:12:04 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P1 Normal --- 1 msaboff msaboff oldest_to_newest 841464 0 msaboff 2013-02-25 17:54:55 -0800 For 32 bit builds, the helper maxOffsetRelativeToPatchedStorage() in JSObject.h should only add the "tag" offset for positive offset. 841467 1 190169 msaboff 2013-02-25 17:58:12 -0800 Created attachment 190169 Patch 841481 2 msaboff 2013-02-25 18:12:04 -0800 Committed r143994: <http://trac.webkit.org/changeset/143994> 190169 2013-02-25 17:58:12 -0800 2013-02-25 18:00:26 -0800 Patch 110828.patch text/plain 2071 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTQzOTkyKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDEzLTAyLTI1ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIEZvciBKU1ZBTFVFMzJfNjQsIG1heE9mZnNldFJlbGF0aXZlVG9QYXRjaGVkU3RvcmFnZSgp IGRvZXNuJ3QgY29tcHV0ZSB0aGUgbWF4aW11bSBuZWdhdGl2ZSBvZmZzZXQKKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExMDgyOAorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogcnVudGltZS9KU09iamVjdC5o OgorICAgICAgICAoSlNDOjptYXhPZmZzZXRSZWxhdGl2ZVRvUGF0Y2hlZFN0b3JhZ2UpOiBPbmx5 IGFkZCB0aGUgT0JKRUNUX09GRlNFVE9GKHRhZykgZm9yIHBvc2l0aXZlIG9mZnNldHMuCisgICAg ICAgIFRoYXQgd2F5IHRoaXMgZnVuY3Rpb24gd2lsbCByZXR1cm4gdGhlIG9mZnNldCBmYXJ0aGVz dCBmcm9tIDAgbmVlZGVkIHRvIGFjY2VzcyBlaXRoZXIgdGhlIHBheWxvYWQKKyAgICAgICAgb3Ig dGFnLgorCiAyMDEzLTAyLTI1ICBKZWZmcmV5IFBmYXUgIDxqcGZhdUBhcHBsZS5jb20+CiAKICAg ICAgICAgT3B0aW9uYWxseSBwYXJ0aXRpb24gY2FjaGUgdG8gcHJldmVudCB1c2luZyBjYWNoZSBm b3IgdHJhY2tpbmcKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTT2JqZWN0 LmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNPYmplY3Qu aAkocmV2aXNpb24gMTQzOTkyKQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNP YmplY3QuaAkod29ya2luZyBjb3B5KQpAQCAtMTQyMSwxNSArMTQyMSwxNSBAQCBpbmxpbmUgc2l6 ZV90IG9mZnNldFJlbGF0aXZlVG9QYXRjaGVkU3RvCiAgICAgcmV0dXJuIEpTT2JqZWN0OjpvZmZz ZXRPZklubGluZVN0b3JhZ2UoKSAtIEpTT2JqZWN0OjpidXR0ZXJmbHlPZmZzZXQoKSArIHNpemVv ZihFbmNvZGVkSlNWYWx1ZSkgKiBvZmZzZXRJbklubGluZVN0b3JhZ2Uob2Zmc2V0KTsKIH0KIAot Ly8gUmV0dXJucyB0aGUgbWF4aW11bSBvZmZzZXQgYSBsb2FkIGluc3RydWN0aW9uIHdpbGwgZW5j b2RlLgorLy8gUmV0dXJucyB0aGUgbWF4aW11bSBvZmZzZXQgKGF3YXkgZnJvbSB6ZXJvKSBhIGxv YWQgaW5zdHJ1Y3Rpb24gd2lsbCBlbmNvZGUuCiBpbmxpbmUgc2l6ZV90IG1heE9mZnNldFJlbGF0 aXZlVG9QYXRjaGVkU3RvcmFnZShQcm9wZXJ0eU9mZnNldCBvZmZzZXQpCiB7CisgICAgcHRyZGlm Zl90IGFkZHJlc3NPZmZzZXQgPSBzdGF0aWNfY2FzdDxwdHJkaWZmX3Q+KG9mZnNldFJlbGF0aXZl VG9QYXRjaGVkU3RvcmFnZShvZmZzZXQpKTsKICNpZiBVU0UoSlNWQUxVRTMyXzY0KQotICAgIHJl dHVybiBvZmZzZXRSZWxhdGl2ZVRvUGF0Y2hlZFN0b3JhZ2Uob2Zmc2V0KQotICAgICAgICArIE9C SkVDVF9PRkZTRVRPRihFbmNvZGVkVmFsdWVEZXNjcmlwdG9yLCBhc0JpdHMudGFnKTsKLSNlbHNl Ci0gICAgcmV0dXJuIG9mZnNldFJlbGF0aXZlVG9QYXRjaGVkU3RvcmFnZShvZmZzZXQpOworICAg IGlmIChhZGRyZXNzT2Zmc2V0ID49IDApCisgICAgICAgIHJldHVybiBzdGF0aWNfY2FzdDxzaXpl X3Q+KGFkZHJlc3NPZmZzZXQpICsgT0JKRUNUX09GRlNFVE9GKEVuY29kZWRWYWx1ZURlc2NyaXB0 b3IsIGFzQml0cy50YWcpOwogI2VuZGlmCisgICAgcmV0dXJuIHN0YXRpY19jYXN0PHNpemVfdD4o YWRkcmVzc09mZnNldCk7CiB9CiAKIGlubGluZSBpbnQgaW5kZXhSZWxhdGl2ZVRvQmFzZShQcm9w ZXJ0eU9mZnNldCBvZmZzZXQpCg==