Bug 110828

Summary:

For JSVALUE32_64, maxOffsetRelativeToPatchedStorage() doesn't compute the maximum negative offset

Product:

WebKit

Reporter:

Michael Saboff <msaboff>

Component:

JavaScriptCore

Assignee:

Michael Saboff <msaboff>

Status:

RESOLVED FIXED

Severity:

Normal

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
Patch	oliver: review+

Michael Saboff

Reported 2013-02-25 17:54:55 PST

For 32 bit builds, the helper maxOffsetRelativeToPatchedStorage() in JSObject.h should only add the "tag" offset for positive offset.

Attachments
Patch (2.02 KB, patch) 2013-02-25 17:58 PST, Michael Saboff	oliver: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Michael Saboff

Comment 1 2013-02-25 17:58:12 PST

Michael Saboff

Comment 2 2013-02-25 18:12:04 PST

Note You need to log in before you can comment on or make changes to this bug.