<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>206619</bug_id>
          
          <creation_ts>2020-01-22 15:24:28 -0800</creation_ts>
          <short_desc>[JSC] Bits from Operand should fit in bits reserved in AbstractHeap&apos;s Payload</short_desc>
          <delta_ts>2020-01-23 04:50:12 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          <see_also>https://bugs.webkit.org/show_bug.cgi?id=206650</see_also>
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Yusuke Suzuki">ysuzuki</reporter>
          <assigned_to name="Yusuke Suzuki">ysuzuki</assigned_to>
          <cc>ews-watchlist</cc>
    
    <cc>keith_miller</cc>
    
    <cc>mark.lam</cc>
    
    <cc>msaboff</cc>
    
    <cc>saam</cc>
    
    <cc>tzagallo</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1609775</commentid>
    <comment_count>0</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2020-01-22 15:24:28 -0800</bug_when>
    <thetext>[JSC] Bits from Operand should fit in bits reserved in AbstractHeap&apos;s Payload</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1609778</commentid>
    <comment_count>1</comment_count>
      <attachid>388475</attachid>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2020-01-22 15:29:17 -0800</bug_when>
    <thetext>Created attachment 388475
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1609779</commentid>
    <comment_count>2</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2020-01-22 15:29:20 -0800</bug_when>
    <thetext>&lt;rdar://problem/58270260&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1609935</commentid>
    <comment_count>3</comment_count>
      <attachid>388475</attachid>
    <who name="Keith Miller">keith_miller</who>
    <bug_when>2020-01-22 19:25:31 -0800</bug_when>
    <thetext>Comment on attachment 388475
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=388475&amp;action=review

r=me with suggestion.

&gt; Source/JavaScriptCore/bytecode/Operands.h:41
&gt; +enum class OperandKind : uint32_t { Argument, Local, Tmp }; // Keep bit-width in sync with Operand::operandKindBits&apos; definition.

Nit You can add a `LastOperandKind = Tmp` then compute kindBits from that via getMSBSet.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1610006</commentid>
    <comment_count>4</comment_count>
      <attachid>388475</attachid>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2020-01-23 01:20:59 -0800</bug_when>
    <thetext>Comment on attachment 388475
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=388475&amp;action=review

&gt;&gt; Source/JavaScriptCore/bytecode/Operands.h:41
&gt;&gt; +enum class OperandKind : uint32_t { Argument, Local, Tmp }; // Keep bit-width in sync with Operand::operandKindBits&apos; definition.
&gt; 
&gt; Nit You can add a `LastOperandKind = Tmp` then compute kindBits from that via getMSBSet.

Sounds nice. Fixed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1610009</commentid>
    <comment_count>5</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2020-01-23 01:39:19 -0800</bug_when>
    <thetext>Committed r254968: &lt;https://trac.webkit.org/changeset/254968&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1610052</commentid>
    <comment_count>6</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2020-01-23 04:50:12 -0800</bug_when>
    <thetext>Follow-up fix. https://trac.webkit.org/changeset/254975/webkit</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>388475</attachid>
            <date>2020-01-22 15:29:17 -0800</date>
            <delta_ts>2020-01-22 19:25:31 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-206619-20200122152916.patch</filename>
            <type>text/plain</type>
            <size>5691</size>
            <attacher name="Yusuke Suzuki">ysuzuki</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjU0OTQ1CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw
dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA5
YzU0ZWQ5MDgyODliZTIwOWRkOWVhY2YzMmU3YTc2MjA4MjVmZGY5Li4wMTI4YzMzNTViY2Q2YTUx
NWVlYzZmMmU0ZmNhZmU2NWQ2ZmEyOWZhIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv
cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs
MyArMSwyNiBAQAorMjAyMC0wMS0yMiAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29t
PgorCisgICAgICAgIFtKU0NdIEJpdHMgZnJvbSBPcGVyYW5kIHNob3VsZCBmaXQgaW4gYml0cyBy
ZXNlcnZlZCBpbiBBYnN0cmFjdEhlYXAncyBQYXlsb2FkCisgICAgICAgIGh0dHBzOi8vYnVncy53
ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMDY2MTkKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVt
LzU4MjcwMjYwPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg
ICAgIFdlIGV4dGVuZGVkIEpTQzo6T3BlcmFuZCB0byBoYXZlIGFuIGFkZGl0aW9uYWwgZmllbGQg
cmVwcmVzZW50aW5nIE9wZXJhbmRLaW5kLgorICAgICAgICBIb3dldmVyLCB3ZSBoYXZlIHJlc3Ry
aWN0aW9uIGluIERGRzo6QWJzdHJhY3RIZWFwJ3MgUGF5bG9hZCB0aGF0IE9wZXJhbmQncyByYXcK
KyAgICAgICAgYml0cyBmb3JtYXQgbmVlZCB0byBmaXQgaW4gcmVzZXJ2ZWQgYml0cyBpbiBQYXls
b2FkJ3MgcmF3IGJpdHMgZm9ybWF0LCA0OSBiaXRzLgorICAgICAgICBTaW5jZSB3ZSBvcmRlcmVk
IGZpZWxkcyBvZiBPcGVyYW5kICJtX2tpbmQiIGFuZCAibV9vcGVyYW5kIiwgaW4gbGl0dGxlIGVu
ZGlhbgorICAgICAgICBhcmNoaXRlY3R1cmUsIHJhdyBiaXRzIGZvcm1hdCBvZiBPcGVyYW5kIGNh
biBleGNlZWQgNDkgYml0cyBpZiBtX29wZXJhbmQgaXMKKyAgICAgICAgbGFyZ2UgZW5vdWdoLgor
CisgICAgICAgIFRoaXMgcGF0Y2ggZml4ZXMgdGhlIG9yZGVyIHRvIGVuc3VyZSB0aGF0IE9wZXJh
bmQncyByYXcgYml0IGZvcm1hdCBhbHdheXMgZml0cworICAgICAgICBpbiA0OSBiaXRzLgorCisg
ICAgICAgICogYnl0ZWNvZGUvT3BlcmFuZHMuaDoKKyAgICAgICAgKEpTQzo6T3BlcmFuZDo6T3Bl
cmFuZCk6CisgICAgICAgIChKU0M6Ok9wZXJhbmQ6OmFzQml0cyBjb25zdCk6CisgICAgICAgICog
ZGZnL0RGR0Fic3RyYWN0SGVhcC5oOgorCiAyMDIwLTAxLTIyICBDYWlvIExpbWEgIDx0aWNhaW9s
aW1hQGdtYWlsLmNvbT4KIAogICAgICAgICBbQVJNdjddIEFzc2VtYmxlciBpcyBnZW5lcmF0aW5n
IHdyb25nIGluc3RydWN0aW9uIGZvciBsZHIgcjIsIFtyMywgIzddCmRpZmYgLS1naXQgYS9Tb3Vy
Y2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvT3BlcmFuZHMuaCBiL1NvdXJjZS9KYXZhU2NyaXB0
Q29yZS9ieXRlY29kZS9PcGVyYW5kcy5oCmluZGV4IGFjZWZmNTc5ODcxMDJkZmE2NDJhN2M2ZjE3
OTc0MzYyNzg5M2Q3YzcuLmMyOGQzNWQwZjcyYzFmN2YzOGU2YzVmNjM4MWU5MjA3MDM2OTY4NmEg
MTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29kZS9PcGVyYW5kcy5oCisr
KyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29kZS9PcGVyYW5kcy5oCkBAIC0zOCwyMSAr
MzgsMjggQEAgdGVtcGxhdGU8dHlwZW5hbWUgVD4gc3RydWN0IE9wZXJhbmRWYWx1ZVRyYWl0czsK
IGNvbnN0ZXhwciB1bnNpZ25lZCBtYXhOdW1DaGVja3BvaW50VG1wcyA9IDQ7CiAKIC8vIEEgT3Bl
cmFuZEtpbmQ6OlRtcCBpcyBvbmUgdGhhdCBleGlzdHMgZm9yIGV4aXRpbmcgdG8gYSBjaGVja3Bv
aW50IGJ1dCBkb2VzIG5vdCBleGlzdCBiZXR3ZWVuIGJ5dGVjb2Rlcy4KLWVudW0gY2xhc3MgT3Bl
cmFuZEtpbmQgeyBBcmd1bWVudCwgTG9jYWwsIFRtcCB9OworZW51bSBjbGFzcyBPcGVyYW5kS2lu
ZCA6IHVpbnQzMl90IHsgQXJndW1lbnQsIExvY2FsLCBUbXAgfTsgLy8gS2VlcCBiaXQtd2lkdGgg
aW4gc3luYyB3aXRoIE9wZXJhbmQ6Om9wZXJhbmRLaW5kQml0cycgZGVmaW5pdGlvbi4KIAogY2xh
c3MgT3BlcmFuZCB7CiBwdWJsaWM6CisgICAgc3RhdGljIGNvbnN0ZXhwciB1bnNpZ25lZCBraW5k
Qml0cyA9IDI7CisgICAgc3RhdGljIGNvbnN0ZXhwciB1bnNpZ25lZCBtYXhCaXRzID0gMzIgKyBr
aW5kQml0czsKKwogICAgIE9wZXJhbmQoKSA9IGRlZmF1bHQ7CiAgICAgT3BlcmFuZChjb25zdCBP
cGVyYW5kJikgPSBkZWZhdWx0OwogCiAgICAgT3BlcmFuZChWaXJ0dWFsUmVnaXN0ZXIgb3BlcmFu
ZCkKLSAgICAgICAgOiBtX2tpbmQob3BlcmFuZC5pc0xvY2FsKCkgPyBPcGVyYW5kS2luZDo6TG9j
YWwgOiBPcGVyYW5kS2luZDo6QXJndW1lbnQpCi0gICAgICAgICwgbV9vcGVyYW5kKG9wZXJhbmQu
b2Zmc2V0KCkpCisgICAgICAgIDogT3BlcmFuZChvcGVyYW5kLmlzTG9jYWwoKSA/IE9wZXJhbmRL
aW5kOjpMb2NhbCA6IE9wZXJhbmRLaW5kOjpBcmd1bWVudCwgb3BlcmFuZC5vZmZzZXQoKSkKICAg
ICB7IH0KIAogICAgIE9wZXJhbmQoT3BlcmFuZEtpbmQga2luZCwgaW50IG9wZXJhbmQpCisjaWYg
Q1BVKExJVFRMRV9FTkRJQU4pCisgICAgICAgIDogbV9vcGVyYW5kKG9wZXJhbmQpCisgICAgICAg
ICwgbV9raW5kKGtpbmQpCisjZWxzZQogICAgICAgICA6IG1fa2luZChraW5kKQogICAgICAgICAs
IG1fb3BlcmFuZChvcGVyYW5kKQorI2VuZGlmCiAgICAgeyAKICAgICAgICAgQVNTRVJUKGtpbmQg
PT0gT3BlcmFuZEtpbmQ6OlRtcCB8fCBWaXJ0dWFsUmVnaXN0ZXIob3BlcmFuZCkuaXNMb2NhbCgp
ID09IChraW5kID09IE9wZXJhbmRLaW5kOjpMb2NhbCkpOwogICAgIH0KQEAgLTY1LDcgKzcyLDEy
IEBAIGNsYXNzIE9wZXJhbmQgewogICAgICAgICBBU1NFUlQobV9raW5kICE9IE9wZXJhbmRLaW5k
OjpUbXApOwogICAgICAgICByZXR1cm4gVmlydHVhbFJlZ2lzdGVyKG1fb3BlcmFuZCk7CiAgICAg
fQotICAgIHVpbnQ2NF90IGFzQml0cygpIGNvbnN0IHsgcmV0dXJuIGJpdHdpc2VfY2FzdDx1aW50
NjRfdD4oKnRoaXMpOyB9CisgICAgdWludDY0X3QgYXNCaXRzKCkgY29uc3QKKyAgICB7CisgICAg
ICAgIHVpbnQ2NF90IGJpdHMgPSBiaXR3aXNlX2Nhc3Q8dWludDY0X3Q+KCp0aGlzKTsKKyAgICAg
ICAgQVNTRVJUKGJpdHMgPCAoMVVMTCA8PCBtYXhCaXRzKSk7CisgICAgICAgIHJldHVybiBiaXRz
OworICAgIH0KICAgICBzdGF0aWMgT3BlcmFuZCBmcm9tQml0cyh1aW50NjRfdCB2YWx1ZSk7CiAK
ICAgICBib29sIGlzVG1wKCkgY29uc3QgeyByZXR1cm4ga2luZCgpID09IE9wZXJhbmRLaW5kOjpU
bXA7IH0KQEAgLTg0LDggKzk2LDEzIEBAIGNsYXNzIE9wZXJhbmQgewogICAgIHZvaWQgZHVtcChQ
cmludFN0cmVhbSYpIGNvbnN0OwogCiBwcml2YXRlOgorI2lmIENQVShMSVRUTEVfRU5ESUFOKQor
ICAgIGludCBtX29wZXJhbmQgeyBWaXJ0dWFsUmVnaXN0ZXI6OmludmFsaWRWaXJ0dWFsUmVnaXN0
ZXIgfTsKKyAgICBPcGVyYW5kS2luZCBtX2tpbmQgeyBPcGVyYW5kS2luZDo6QXJndW1lbnQgfTsK
KyNlbHNlCiAgICAgT3BlcmFuZEtpbmQgbV9raW5kIHsgT3BlcmFuZEtpbmQ6OkFyZ3VtZW50IH07
CiAgICAgaW50IG1fb3BlcmFuZCB7IFZpcnR1YWxSZWdpc3Rlcjo6aW52YWxpZFZpcnR1YWxSZWdp
c3RlciB9OworI2VuZGlmCiB9OwogCiBBTFdBWVNfSU5MSU5FIGJvb2wgT3BlcmFuZDo6b3BlcmF0
b3I9PShjb25zdCBPcGVyYW5kJiBvdGhlcikgY29uc3QKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZh
U2NyaXB0Q29yZS9kZmcvREZHQWJzdHJhY3RIZWFwLmggYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUv
ZGZnL0RGR0Fic3RyYWN0SGVhcC5oCmluZGV4IDE5MDI1NjI5ZDNmNmZkMTJhMGU4NjJiM2IyMmIy
NTcyOGNlYzgzN2MuLmVlNmE0NTNjYjg4OWY3MjhiNGNmNDBjMThkMGVlYzhjZjJkNzZmNjYgMTAw
NjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQWJzdHJhY3RIZWFwLmgKKysr
IGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdBYnN0cmFjdEhlYXAuaApAQCAtMzE5LDYg
KzMxOSw3IEBAIGNsYXNzIEFic3RyYWN0SGVhcCB7CiBwcml2YXRlOgogICAgIHN0YXRpYyBjb25z
dGV4cHIgdW5zaWduZWQgdmFsdWVTaGlmdCA9IDE1OwogICAgIHN0YXRpYyBjb25zdGV4cHIgdW5z
aWduZWQgdG9wU2hpZnQgPSAxNDsKKyAgICBzdGF0aWNfYXNzZXJ0KCg2NCAtIHZhbHVlU2hpZnQp
ID49IE9wZXJhbmQ6Om1heEJpdHMsICJPcGVyYW5kIHNob3VsZCBmaXQgaW4gUGF5bG9hZCdzIGVu
Y29kZWQgZm9ybWF0Iik7CiAgICAgCiAgICAgUGF5bG9hZCBwYXlsb2FkSW1wbCgpIGNvbnN0CiAg
ICAgewpkaWZmIC0tZ2l0IGEvSlNUZXN0cy9DaGFuZ2VMb2cgYi9KU1Rlc3RzL0NoYW5nZUxvZwpp
bmRleCAyZDg1OTk2OThmMWVhOTBhNzUxNzI5MzhiYzYzYTNhODU1NDM5MThmLi4zMjQ3Nzk2ZjNj
MDg0OGY3M2VmY2ExN2EwMjNiMGQ2N2I1Mjc0NjFhIDEwMDY0NAotLS0gYS9KU1Rlc3RzL0NoYW5n
ZUxvZworKysgYi9KU1Rlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEzIEBACisyMDIwLTAxLTIy
ICBZdXN1a2UgU3V6dWtpICA8eXN1enVraUBhcHBsZS5jb20+CisKKyAgICAgICAgW0pTQ10gQml0
cyBmcm9tIE9wZXJhbmQgc2hvdWxkIGZpdCBpbiBiaXRzIHJlc2VydmVkIGluIEFic3RyYWN0SGVh
cCdzIFBheWxvYWQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp
P2lkPTIwNjYxOQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNTgyNzAyNjA+CisKKyAgICAgICAg
UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBzdHJlc3Mvb3BlcmFuZC1z
aG91bGQtZml0LWluLWFic3RyYWN0LWhlYXAtZW5jb2RlZC1wYXlsb2FkLWZvcm1hdC5qczogQWRk
ZWQuCisKIDIwMjAtMDEtMjIgIFl1c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFwcGxlLmNvbT4KIAog
ICAgICAgICBbSlNDXSBEYXRlTWF0aCBzaG91bGQgYWNjZXB0IG1vcmUgSVNPLTg2MDEgdGltZXpv
bmUgZGVzaWduYXRvcnMgZXZlbiBpZiB0aGV5IGFyZSBub3QgaW5jbHVkZWQgaW4gRUNNQTI2MiB0
byBwcm9kdWNlIGV4cGVjdGVkIHJlc3VsdHMgaW4gdGhlIHdpbGQgY29kZQpkaWZmIC0tZ2l0IGEv
SlNUZXN0cy9zdHJlc3Mvb3BlcmFuZC1zaG91bGQtZml0LWluLWFic3RyYWN0LWhlYXAtZW5jb2Rl
ZC1wYXlsb2FkLWZvcm1hdC5qcyBiL0pTVGVzdHMvc3RyZXNzL29wZXJhbmQtc2hvdWxkLWZpdC1p
bi1hYnN0cmFjdC1oZWFwLWVuY29kZWQtcGF5bG9hZC1mb3JtYXQuanMKbmV3IGZpbGUgbW9kZSAx
MDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uMjBi
ZDVhOWFmODJkYjE4MDk4ZTM5YzY3YTM4MWI5MzRiZTNiY2IyZgotLS0gL2Rldi9udWxsCisrKyBi
L0pTVGVzdHMvc3RyZXNzL29wZXJhbmQtc2hvdWxkLWZpdC1pbi1hYnN0cmFjdC1oZWFwLWVuY29k
ZWQtcGF5bG9hZC1mb3JtYXQuanMKQEAgLTAsMCArMSw0IEBACisvL0AgcnVuRGVmYXVsdCgiLS11
c2VDb25jdXJyZW50SklUPTAiLCAiLS1qaXRQb2xpY3lTY2FsZT0wIikKK2NvbnN0IGEgPSBbXTsK
K2EubGVuZ3RoID0gNjU1MzI7CitPYmplY3QuY29uc3RydWN0b3IoLi4uYSkoKTsK
</data>
<flag name="review"
          id="404207"
          type_id="1"
          status="+"
          setter="keith_miller"
    />
          </attachment>
      

    </bug>

</bugzilla>