166475 2016-12-24 11:50:53 -0800 WebAssembly: parseVarUInt1 should take a uint32_t not a uint8_t 2016-12-24 13:52:42 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 166448 InRadar P2 Normal --- 1 saam saam benjamin fpizlo ggaren gskachkov jfbastien keith_miller mark.lam msaboff oliver ticaiolima webkit-bug-importer ysuzuki oldest_to_newest 1262669 0 saam 2016-12-24 11:50:53 -0800 We're loosing the top 3 bytes here, and that's bad. We loose them because we do static_cast<uint32_t>(uint8_t). This is bad if say I parseVarUint1 and expect the result to be zero. Right now, if somebody passed in: 0xffffff00 We'd think it's zero because of how we drop the top 3 bytes. That's clearly wrong. 1262670 1 webkit-bug-importer 2016-12-24 11:51:05 -0800 <rdar://problem/29803564> 1262681 2 saam 2016-12-24 13:52:33 -0800 The bug is actually here: ``` 232 template<typename SuccessType> 233 ALWAYS_INLINE bool Parser<SuccessType>::parseVarUInt1(uint8_t& result) 234 { 235 uint32_t temp; 236 if (!parseVarUInt32(temp)) 237 return false; 238 result = static_cast<uint8_t>(temp); 239 return temp <= 1; 240 } ``` We should check the value before the cast! I'll just fix this as part of: https://bugs.webkit.org/show_bug.cgi?id=166448 1262682 3 saam 2016-12-24 13:52:42 -0800 *** This bug has been marked as a duplicate of bug 166448 ***