Summary: | Crash under JSC::JSCell::toNumber(JSC::ExecState*) | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Chris Dumez <cdumez> | ||||||||
Component: | Bindings | Assignee: | Chris Dumez <cdumez> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | cdumez, commit-queue, graouts, mark.lam, rniwa, webkit-bug-importer | ||||||||
Priority: | P2 | Keywords: | InRadar | ||||||||
Version: | WebKit Nightly Build | ||||||||||
Hardware: | Unspecified | ||||||||||
OS: | Unspecified | ||||||||||
See Also: | https://bugs.webkit.org/show_bug.cgi?id=182988 | ||||||||||
Attachments: |
|
Description
Chris Dumez
2018-02-20 13:48:43 PST
Created attachment 334301 [details]
Patch
Comment on attachment 334301 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=334301&action=review > Source/WebCore/ChangeLog:15 > + No new tests, extended new test. Did you mean "extended existing test"? > Source/WebCore/bindings/js/JSDOMConvertNumbers.h:388 > static JSC::JSValue convert(Type value) > { > - return JSC::jsNumber(value); > + return JSC::jsNumber(JSC::purifyNaN(value)); > } If you look in JSCJSValue.h, you'll see that jsNumber() can also take integer values. Is IDLUnrestrictedDouble::ImplementationType guaranteed to be a double? If not, then maybe you should have 2 versions of convert: one for integral types and one for double. > Source/WebCore/testing/TypeConversions.h:147 > + double testImpureNaNUnrestrictedDouble() const { return bitwise_cast<double>(0xffff000000000000ll); } > + double testImpureNaN2UnrestrictedDouble() const { return bitwise_cast<double>(0x7ff8000000000001ll); } > + double testQuietNaNUnrestrictedDouble() const { return std::numeric_limits<double>::quiet_NaN(); } Maybe you should add a case for PureNaN as well just to make sure that it is also working as expected. Comment on attachment 334301 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=334301&action=review >> Source/WebCore/ChangeLog:15 >> + No new tests, extended new test. > > Did you mean "extended existing test"? Yep. Will fix. >> Source/WebCore/bindings/js/JSDOMConvertNumbers.h:388 >> } > > If you look in JSCJSValue.h, you'll see that jsNumber() can also take integer values. Is IDLUnrestrictedDouble::ImplementationType guaranteed to be a double? If not, then maybe you should have 2 versions of convert: one for integral types and one for double. AFAICT IDLUnrestrictedDouble::ImplementationType has to be a double. >> Source/WebCore/testing/TypeConversions.h:147 >> + double testQuietNaNUnrestrictedDouble() const { return std::numeric_limits<double>::quiet_NaN(); } > > Maybe you should add a case for PureNaN as well just to make sure that it is also working as expected. Good point, will add. Created attachment 334304 [details]
Patch
Comment on attachment 334304 [details]
Patch
r=me if EWS bots are happy.
Comment on attachment 334304 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=334304&action=review > Source/WebCore/bindings/js/JSDOMConvertNumbers.h:363 > + ASSERT(!std::isnan(value)); I will add this assertion in a follow-up because it hits for the following test: LayoutTests/media/track/track-add-remove-cue.html Seems to be related to VTTCue.startTime where we do not match the spec and sometimes return NaN. Created attachment 334313 [details]
Patch
Comment on attachment 334313 [details] Patch Clearing flags on attachment: 334313 Committed r228851: <https://trac.webkit.org/changeset/228851> All reviewed patches have been landed. Closing bug. |