Bug 143345 - cloop overflow test is broken in recent clang
Summary: cloop overflow test is broken in recent clang
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-02 14:31 PDT by Richard O'Grady
Modified: 2015-04-02 14:31 PDT (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Richard O'Grady 2015-04-02 14:31:25 PDT
cloop.rb's cloopAddOverflowTest() uses this check: "((#{signBit}(b) != #{signBit}(a)) && (#{signBit}(b-a) == #{signBit}(a)))" to detect overflow, and similarly for subtraction.

In clang r221045, an optimization was introduced which breaks this for the case where we are incrementing a value by 1.

Repro on Linux (with clang r221045 or above):

$ CC=clang
$ CXX=clang
$ build-jsc --cloop --release --gtk

Then execute this in jsc: 
for (var i = 0x7fffffff; i < 0x80000000; i++) {print(i);}

Notice that i wraps around to become negative.

Using safeAdd() and safeSub() from CheckedArithmetic.h avoids the problem.