Bug 286369
| Summary: | Pad IPInt argumINTBytecode to an even size | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | daniel_liu4 |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
daniel_liu4
During local initialization, we default initialize locals all the way until we hit the end of our local table. Because of IPInt's design, the local table is aligned to an even size, meaning that we may read out of bounds by 1 from the metadata vector. We need to pad this vector with an extra dummy element to make sure we don't go out of bounds.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/143407486>
daniel_liu4
Pull request: https://github.com/WebKit/WebKit/pull/39392
EWS
Committed 289308@main (7214ee02bbf6): <https://commits.webkit.org/289308@main>
Reviewed commits have been landed. Closing PR #39392 and removing active labels.