Bug 110893 - Potential crash in YARR JIT generated code when building 64 bit
Summary: Potential crash in YARR JIT generated code when building 64 bit
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Michael Saboff
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-02-26 11:02 PST by Michael Saboff
Modified: 2013-02-26 11:39 PST (History)
0 users

See Also:


Attachments
Patch (1.59 KB, patch)
2013-02-26 11:07 PST, Michael Saboff
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Saboff 2013-02-26 11:02:36 PST
The index and length parameters to a generated regular expression match function are unsigned 32 bit ints.  The ABI allows them to be any value.  We should clear the upper 32 bits.
Comment 1 Michael Saboff 2013-02-26 11:07:48 PST
Created attachment 190327 [details]
Patch

This patch has already been reviewed.
Comment 2 Michael Saboff 2013-02-26 11:39:44 PST
Committed r144083: <http://trac.webkit.org/changeset/144083>