Changeset 278369 in webkit for trunk/Source/JavaScriptCore/wasm/WasmTable.cpp
- Timestamp:
- Jun 2, 2021, 12:02:15 PM (4 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/wasm/WasmTable.cpp
r278351 r278369 90 90 CheckedUint32 newLengthChecked = length(); 91 91 newLengthChecked += delta; 92 uint32_t newLength;93 if (newLengthChecked.safeGet(newLength) == CheckedState::DidOverflow)94 return std::nullopt; 95 92 if (newLengthChecked.hasOverflowed()) 93 return std::nullopt; 94 95 uint32_t newLength = newLengthChecked; 96 96 if (maximum() && newLength > *maximum()) 97 97 return std::nullopt; … … 103 103 CheckedUint32 reallocSizeChecked = allocatedLength(newLengthChecked); 104 104 reallocSizeChecked *= sizeof(*container.get()); 105 uint32_t reallocSize; 106 if (reallocSizeChecked.safeGet(reallocSize) == CheckedState::DidOverflow) 105 if (reallocSizeChecked.hasOverflowed()) 107 106 return false; 108 107 // FIXME this over-allocates and could be smarter about not committing all of that memory https://bugs.webkit.org/show_bug.cgi?id=181425 109 container.realloc(reallocSize );108 container.realloc(reallocSizeChecked); 110 109 } 111 110 for (uint32_t i = m_length; i < allocatedLength(newLength); ++i) {
Note:
See TracChangeset
for help on using the changeset viewer.