RESOLVED FIXED 184772
Use CheckedArithmetic for length computation in JSArray::unshiftCountWithAnyIndexingType 
https://bugs.webkit.org/show_bug.cgi?id=184772
Summary Use CheckedArithmetic for length computation in JSArray::unshiftCountWithAnyI...
Robin Morisset
Reported 2018-04-19 06:12:38 PDT
<rdar://problem/39146327>
Attachments
Patch (2.97 KB, patch)
2018-04-19 06:20 PDT, Robin Morisset 		no flags
DetailsFormatted DiffDiff
Patch (4.18 KB, patch)
2018-04-19 06:45 PDT, Robin Morisset 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Robin Morisset
Comment 1 2018-04-19 06:20:13 PDT
Created attachment 338318 [details] Patch
Robin Morisset
Comment 2 2018-04-19 06:45:26 PDT
Created attachment 338319 [details] Patch
Robin Morisset
Comment 3 2018-04-19 06:47:32 PDT
The second patch uploaded was for a different bug, I marked it obsolete and un-obsoleted the first patch.
Robin Morisset
Comment 4 2018-05-01 07:19:50 PDT
ping review.
WebKit Commit Bot
Comment 5 2018-05-01 09:04:00 PDT
Comment on attachment 338318 [details] Patch Clearing flags on attachment: 338318 Committed r231198: <https://trac.webkit.org/changeset/231198>
WebKit Commit Bot
Comment 6 2018-05-01 09:04:01 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.