Bug 196850 - [JSC] op_has_indexed_property should not assume subscript part is Uint32
Summary: [JSC] op_has_indexed_property should not assume subscript part is Uint32
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Yusuke Suzuki
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2019-04-11 21:27 PDT by Yusuke Suzuki
Modified: 2019-04-11 23:35 PDT (History)
6 users (show)

See Also:


Attachments
Patch (7.40 KB, patch)
2019-04-11 21:29 PDT, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (7.40 KB, patch)
2019-04-11 21:40 PDT, Yusuke Suzuki
saam: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Yusuke Suzuki 2019-04-11 21:27:55 PDT
[JSC] op_has_indexed_property should not assume subscript part is Uint32
Comment 1 Yusuke Suzuki 2019-04-11 21:29:42 PDT
Created attachment 367284 [details]
Patch
Comment 2 Yusuke Suzuki 2019-04-11 21:30:29 PDT
<rdar://problem/49726277>
Comment 3 Yusuke Suzuki 2019-04-11 21:40:11 PDT
Created attachment 367286 [details]
Patch
Comment 4 Saam Barati 2019-04-11 22:30:25 PDT
Comment on attachment 367286 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=367286&action=review

> Source/JavaScriptCore/jit/JITOperations.cpp:2070
> +    ASSERT(subscript.asAnyInt() <= UINT32_MAX);

Maybe it’s worth a helper function since this is the second time you’re adding this code

> Source/JavaScriptCore/jit/JITOperations.cpp:2074
> +    uint32_t index = static_cast<uint32_t>(subscript.asAnyInt());

Ditto
Comment 5 Yusuke Suzuki 2019-04-11 22:54:23 PDT
Comment on attachment 367286 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=367286&action=review

>> Source/JavaScriptCore/jit/JITOperations.cpp:2070
>> +    ASSERT(subscript.asAnyInt() <= UINT32_MAX);
> 
> Maybe it’s worth a helper function since this is the second time you’re adding this code

Sounds nice! Like, asUint32AsAnyInt() / isUInt32AsAnyInt().
Comment 6 Yusuke Suzuki 2019-04-11 23:35:21 PDT
Committed r244211: <https://trac.webkit.org/changeset/244211>