Bug 231935

Summary: DFGSSALoweringPhase.cpp can create a GetTypedArrayLengthAsInt52 with the wrong return type
Product: WebKit Reporter: Robin Morisset <rmorisset>
Component: JavaScriptCoreAssignee: Robin Morisset <rmorisset>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: ews-watchlist, keith_miller, mark.lam, msaboff, saam, tzagallo
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on: 229353    
Bug Blocks:    
Attachments:
Description Flags
Patch none

Robin Morisset
Reported 2021-10-18 20:00:15 PDT
GetTypedArrayLengthAsInt52 is marked in DFGNodeTypes.h as NodeResultJS. This is a complete lie: it actually returns an Int52. The reason for this lie is that FixupPhase is the part responsible for making its users expect and Int52, and the ByteCodeParser can emit GetTypedArrayLengthAsInt52 before it runs, leading to validation failures. It works because FixupPhase takes care to properly set the return type of every GetTypedArrayLengthAsInt52 it sees.. but DFGSSALoweringPhase.cpp runs after Fixup and can insert a GetTypedArrayLengthAsInt52, and so it must also take care to properly set its return type.
Attachments
Patch (1.95 KB, patch)
2021-10-18 20:03 PDT, Robin Morisset 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Robin Morisset
Comment 1 2021-10-18 20:03:21 PDT
Created attachment 441680 [details] Patch I have not managed to find a test case for this yet.
Robin Morisset
Comment 2 2021-10-21 12:04:38 PDT
*** This bug has been marked as a duplicate of bug 232059 ***
Note You need to log in before you can comment on or make changes to this bug.