232058 2021-10-20 17:23:37 -0700 Add missing overflow check to DFGIntegerRangeOptimizationPhase::filterConstant() 2021-10-21 16:02:58 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff ews-watchlist keith_miller mark.lam rmorisset saam tzagallo webkit-bug-importer oldest_to_newest 1806945 0 msaboff 2021-10-20 17:23:37 -0700 From code review, it appears that an overflow check is needed when creating a more specific Relationship. Consider the current code: ... if (sumOverflows<int>(otherRight, other.m_offset)) return *this; int otherEffectiveRight = otherRight + other.m_offset; switch (other.m_kind) { case Equal: // Return a version of *this that is Equal to other's constant. return Relationship(m_left, m_right, Equal, otherEffectiveRight - thisRight); ... We check if other's value + offset overflows, but what about the case where otherEffectiveRight - thisRight might overflow? 1806947 1 msaboff 2021-10-20 17:24:01 -0700 <rdar://84375007> 1806952 2 441964 msaboff 2021-10-20 17:27:11 -0700 Created attachment 441964 Patch 1806957 3 441964 rmorisset 2021-10-20 17:37:20 -0700 Comment on attachment 441964 Patch r=me 1807247 4 ews-feeder 2021-10-21 10:54:55 -0700 Committed r284623 (243344@main): <https://commits.webkit.org/243344@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 441964. 441964 2021-10-20 17:27:11 -0700 2021-10-21 10:54:56 -0700 Patch 232058.patch text/plain 1324 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjg0NTg4KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBA CisyMDIxLTEwLTIwICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIEFkZCBtaXNzaW5nIG92ZXJmbG93IGNoZWNrIHRvIERGR0ludGVnZXJSYW5nZU9wdGltaXph dGlvblBoYXNlOjpmaWx0ZXJDb25zdGFudCgpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0yMzIwNTgKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICBBZGRlZCBvdmVyZmxvdyBjaGVjay4KKworICAgICAgICAqIGRm Zy9ERkdJbnRlZ2VyUmFuZ2VPcHRpbWl6YXRpb25QaGFzZS5jcHA6CisKIDIwMjEtMTAtMjAgIFl1 c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFwcGxlLmNvbT4KIAogICAgICAgICBbSlNDXSBBcml0aEFi cyBzaG91bGQgY2FyZSBhYm91dCBJTlQzMl9NSU4KSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29y ZS9kZmcvREZHSW50ZWdlclJhbmdlT3B0aW1pemF0aW9uUGhhc2UuY3BwCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHSW50ZWdlclJhbmdlT3B0aW1pemF0aW9uUGhh c2UuY3BwCShyZXZpc2lvbiAyODQ1NzMpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RG R0ludGVnZXJSYW5nZU9wdGltaXphdGlvblBoYXNlLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNTY4 LDYgKzU2OCw5IEBAIHB1YmxpYzoKIAogICAgICAgICBzd2l0Y2ggKG90aGVyLm1fa2luZCkgewog ICAgICAgICBjYXNlIEVxdWFsOgorICAgICAgICAgICAgaWYgKGRpZmZlcmVuY2VPdmVyZmxvd3M8 aW50PihvdGhlckVmZmVjdGl2ZVJpZ2h0LCB0aGlzUmlnaHQpKQorICAgICAgICAgICAgICAgIHJl dHVybiAqdGhpczsKKwogICAgICAgICAgICAgLy8gUmV0dXJuIGEgdmVyc2lvbiBvZiAqdGhpcyB0 aGF0IGlzIEVxdWFsIHRvIG90aGVyJ3MgY29uc3RhbnQuCiAgICAgICAgICAgICByZXR1cm4gUmVs YXRpb25zaGlwKG1fbGVmdCwgbV9yaWdodCwgRXF1YWwsIG90aGVyRWZmZWN0aXZlUmlnaHQgLSB0 aGlzUmlnaHQpOwogCg==