Changeset 284623 in webkit for trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

Timestamp:

Oct 21, 2021, 10:54:48 AM (4 years ago)

Author:

[email protected]

Message:

Add missing overflow check to DFGIntegerRangeOptimizationPhase::filterConstant()
​https://bugs.webkit.org/show_bug.cgi?id=232058

Reviewed by Robin Morisset.

Added overflow check.

• dfg/DFGIntegerRangeOptimizationPhase.cpp:

File:

• trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

@@ -569 +569 @@
         switch (other.m_kind) {
         case Equal:
+            if (differenceOverflows<int>(otherEffectiveRight, thisRight))
+                return *this;
+
             // Return a version of *this that is Equal to other's constant.
             return Relationship(m_left, m_right, Equal, otherEffectiveRight - thisRight);