Bug 232024 – Add missing overflow checks to DFGIntegerRangeOptimizationPhase::isEquivalentTo()

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Michael Saboff]

In isEquivalentTo() we should check for overflow when adding offsets.

    bool isEquivalentTo(const Relationship& other) const
    {
        ...

        if (m_right->isInt32Constant() && other.m_right->isInt32Constant()) {
            return (thisRight + m_offset) == (otherRight + other.m_offset);
        }
        ...
    }

[Michael Saboff]

Created attachment 441903 [details]
Patch with mini-mode fix.

[Tadeu Zagallo]

Comment on attachment 441903 [details]
Patch with mini-mode fix.

r=me

[Michael Saboff]

<rdar://84329018>

[Michael Saboff]

Ignore the "mini-mode" comment - It was auto filled from Safari.

[Mark Lam]

Comment on attachment 441903 [details]
Patch with mini-mode fix.

View in context: https://bugs.webkit.org/attachment.cgi?id=441903&action=review

> Source/JavaScriptCore/ChangeLog:8
> +        Added overflow chaeck before comparing for equality.

typo: chaeck

[Michael Saboff]

(In reply to Mark Lam from comment #5)
> Comment on attachment 441903 [details]
> Patch with mini-mode fix.
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=441903&action=review
> 
> > Source/JavaScriptCore/ChangeLog:8
> > +        Added overflow chaeck before comparing for equality.
> 
> typo: chaeck

Will fix.

[Michael Saboff]

Committed r284573 (243313@main): <https://commits.webkit.org/243313@main>