114366 2013-04-10 10:55:17 -0700 DFG: Negative size for new Array() interpreted as large unsigned int 2013-04-11 09:19:02 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff commit-queue darin oldest_to_newest 872953 0 msaboff 2013-04-10 10:55:17 -0700 The DFG generated code treats array sizes as unsigned integers when the computation for an array can produce a negative value. The lint interpreter and baseline JIT appear to work correctly with negative sizes, that is they both throw RangeError exceptions. From <rdar://problem/12850273> 873074 1 197353 msaboff 2013-04-10 11:59:31 -0700 Created attachment 197353 Patch 873076 2 197353 fpizlo 2013-04-10 12:06:02 -0700 Comment on attachment 197353 Patch r=me too 873168 3 197353 commit-queue 2013-04-10 12:59:48 -0700 Comment on attachment 197353 Patch Clearing flags on attachment: 197353 Committed r148130: <http://trac.webkit.org/changeset/148130> 873169 4 commit-queue 2013-04-10 12:59:49 -0700 All reviewed patches have been landed. Closing bug. 873175 5 darin 2013-04-10 13:04:57 -0700 Is this hot enough that UNLIKELY is needed/helpful? 873822 6 msaboff 2013-04-11 07:58:16 -0700 (In reply to comment #5) > Is this hot enough that UNLIKELY is needed/helpful? It makes sense to add UNLIKELY. The case we care about for the bug is when the static_cast<unsigned>(size) >= 100000, but we'll also reach this patch when we can't allocated directly inline and need to get more space. In real world, the failed allocation paths are far more likely. I'll add the UNLIKELY and check it in. 873866 7 msaboff 2013-04-11 09:19:02 -0700 (In reply to comment #6) > (In reply to comment #5) > > Is this hot enough that UNLIKELY is needed/helpful? > > It makes sense to add UNLIKELY. The case we care about for the bug is when the static_cast<unsigned>(size) >= 100000, but we'll also reach this patch when we can't allocated directly inline and need to get more space. In real world, the failed allocation paths are far more likely. > > I'll add the UNLIKELY and check it in. Landed in change set r148207 <http://trac.webkit.org/changeset/148207>. 197353 2013-04-10 11:59:31 -0700 2013-04-10 12:59:48 -0700 Patch 114366.patch text/plain 4182 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTQ4MDY3KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDEzLTA0LTEwICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIERGRzogTmVnYXRpdmUgc2l6ZSBmb3IgbmV3IEFycmF5KCkgaW50ZXJwcmV0ZWQgYXMgbGFy Z2UgdW5zaWduZWQgaW50CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xMTQzNjYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICBBZGRlZCBuZXcgY2hlY2sgaW4gb3BlcmF0aW9uTmV3QXJyYXlXaXRoU2l6ZSgpIGZv ciBhIG5lZ2F0aXZlCisgICAgICAgIHNpemUuICBJZiBzaXplIGlzIG5lZ2F0aXZlIHRocm93IGEg IlJhbmdlRXJyb3I6IEFycmF5IHNpemUgaXMgbm90IGEKKyAgICAgICAgc21hbGwgZW5vdWdoIHBv c2l0aXZlIGludGVnZXIiIGV4Y2VwdGlvbi4KKworICAgICAgICAqIGRmZy9ERkdPcGVyYXRpb25z LmNwcDoKKwogMjAxMy0wNC0wOSAgT2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUuY29tPgogCiAg ICAgICAgIFJvbGxvdXQgbGFzdCBwYXRjaCBhcyBpdCBkZXN0cm95ZWQgZXZlcnl0aGluZwpJbmRl eDogU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdPcGVyYXRpb25zLmNwcAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR09wZXJhdGlvbnMuY3BwCShyZXZpc2lv biAxNDgwNjcpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR09wZXJhdGlvbnMuY3Bw CSh3b3JraW5nIGNvcHkpCkBAIC0xMjkxLDcgKzEyOTEsMTAgQEAgY2hhciogREZHX09QRVJBVElP TiBvcGVyYXRpb25OZXdBcnJheVdpdAogewogICAgIEpTR2xvYmFsRGF0YSogZ2xvYmFsRGF0YSA9 ICZleGVjLT5nbG9iYWxEYXRhKCk7CiAgICAgTmF0aXZlQ2FsbEZyYW1lVHJhY2VyIHRyYWNlcihn bG9iYWxEYXRhLCBleGVjKTsKLSAgICAKKworICAgIGlmIChzaXplIDwgMCkKKyAgICAgICAgcmV0 dXJuIGJpdHdpc2VfY2FzdDxjaGFyKj4odGhyb3dFcnJvcihleGVjLCBjcmVhdGVSYW5nZUVycm9y KGV4ZWMsIEFTQ0lJTGl0ZXJhbCgiQXJyYXkgc2l6ZSBpcyBub3QgYSBzbWFsbCBlbm91Z2ggcG9z aXRpdmUgaW50ZWdlci4iKSkpKTsKKwogICAgIHJldHVybiBiaXR3aXNlX2Nhc3Q8Y2hhcio+KEpT QXJyYXk6OmNyZWF0ZSgqZ2xvYmFsRGF0YSwgYXJyYXlTdHJ1Y3R1cmUsIHNpemUpKTsKIH0KIApJ bmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0No YW5nZUxvZwkocmV2aXNpb24gMTQ4MTA3KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3Jr aW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTMtMDQtMTAgIE1pY2hhZWwgU2Fib2ZmICA8 bXNhYm9mZkBhcHBsZS5jb20+CisKKyAgICAgICAgREZHOiBOZWdhdGl2ZSBzaXplIGZvciBuZXcg QXJyYXkoKSBpbnRlcnByZXRlZCBhcyBsYXJnZSB1bnNpZ25lZCBpbnQKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExNDM2NgorCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE5ldyB0ZXN0IHRvIG1ha2Ugc3VyZSBE RkcgZ2VuZXJhdGVkIGNvZGUgZm9yIG5ldyBBcnJheSgpIHdpdGggYQorICAgICAgICBjb21wdXRl ZCBuZWdhdGl2ZSBzaXplIHRocm93cyBhbiBleGNlcHRpb24uCisKKyAgICAgICAgKiBmYXN0L2pz L2RmZy1uZWdhdGl2ZS1hcnJheS1zaXplLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICog ZmFzdC9qcy9kZmctbmVnYXRpdmUtYXJyYXktc2l6ZS5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBm YXN0L2pzL3NjcmlwdC10ZXN0cy9kZmctbmVnYXRpdmUtYXJyYXktc2l6ZS5qczogQWRkZWQuCisK IDIwMTMtMDQtMTAgIFZpY3RvciBDb3N0YW4gIDxjb3N0YW5AZ21haWwuY29tPgogCiAgICAgICAg IEJsb2IgY29udGVudCB0eXBlIG5vcm1hbGl6YXRpb24uCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0 L2pzL2RmZy1uZWdhdGl2ZS1hcnJheS1zaXplLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBM YXlvdXRUZXN0cy9mYXN0L2pzL2RmZy1uZWdhdGl2ZS1hcnJheS1zaXplLWV4cGVjdGVkLnR4dAko cmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvanMvZGZnLW5lZ2F0aXZlLWFycmF5LXNp emUtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDEwIEBACitUZXN0cyB0aGF0 IGNyZWF0aW5nIGFuIGFycmF5IHdpdGggYSBuZWdhdGl2ZSBzaXplIHRocm93cyBhbiBleGNlcHRp b24uCisKK09uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBvZiAiUEFTUyIgbWVzc2Fn ZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KKworCitQQVNTIGZvbygpIHRocmV3IGV4 Y2VwdGlvbiBSYW5nZUVycm9yOiBBcnJheSBzaXplIGlzIG5vdCBhIHNtYWxsIGVub3VnaCBwb3Np dGl2ZSBpbnRlZ2VyLi4KK1BBU1Mgc3VjY2Vzc2Z1bGx5UGFyc2VkIGlzIHRydWUKKworVEVTVCBD T01QTEVURQorCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2pzL2RmZy1uZWdhdGl2ZS1hcnJheS1z aXplLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9qcy9kZmctbmVnYXRpdmUt YXJyYXktc2l6ZS5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9qcy9kZmct bmVnYXRpdmUtYXJyYXktc2l6ZS5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDEwIEBACis8 IURPQ1RZUEUgSFRNTCBQVUJMSUMgIi0vL0lFVEYvL0RURCBIVE1MLy9FTiI+Cis8aHRtbD4KKzxo ZWFkPgorPHNjcmlwdCBzcmM9InJlc291cmNlcy9qcy10ZXN0LXByZS5qcyI+PC9zY3JpcHQ+Cis8 L2hlYWQ+Cis8Ym9keT4KKzxzY3JpcHQgc3JjPSJzY3JpcHQtdGVzdHMvZGZnLW5lZ2F0aXZlLWFy cmF5LXNpemUuanMiPjwvc2NyaXB0PgorPHNjcmlwdCBzcmM9InJlc291cmNlcy9qcy10ZXN0LXBv c3QuanMiPjwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgpJbmRleDogTGF5b3V0VGVzdHMvZmFz dC9qcy9zY3JpcHQtdGVzdHMvZGZnLW5lZ2F0aXZlLWFycmF5LXNpemUuanMKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gTGF5b3V0VGVzdHMvZmFzdC9qcy9zY3JpcHQtdGVzdHMvZGZnLW5lZ2F0aXZlLWFycmF5LXNp emUuanMJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2pzL3NjcmlwdC10ZXN0cy9k ZmctbmVnYXRpdmUtYXJyYXktc2l6ZS5qcwkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwyMyBAQAor ZGVzY3JpcHRpb24oCisiVGVzdHMgdGhhdCBjcmVhdGluZyBhbiBhcnJheSB3aXRoIGEgbmVnYXRp dmUgc2l6ZSB0aHJvd3MgYW4gZXhjZXB0aW9uLiIKKyk7CisKK2Z1bmN0aW9uIGZvbygpIHsKKyAg ICB2YXIgdG90YWxMZW5ndGggPSAwOworCisgICAgZm9yICh2YXIgaSA9IDE7IGkgPCA2MDAwOyAr K2kpIHsKKyAgICAgICAgdmFyIGogPSAoaSA+IDQwMDApID8gMiA6IDA7CisgICAgICAgIHZhciBh ID0gbmV3IEFycmF5KDEgLSBqKTsKKworICAgICAgICBpZiAoYS5sZW5ndGggPiAyMTQ3NDgzNjQ3 KQorICAgICAgICAgICAgYnJlYWs7CisKKyAgICAgICAgdG90YWxMZW5ndGggKz0gYS5sZW5ndGg7 CisgICAgfQorCisgICAgcmV0dXJuIHRvdGFsTGVuZ3RoOworfQorCitzaG91bGRUaHJvdygiZm9v KCkiLCB1bmRlZmluZWQpOworCisK