Changeset 43583 in webkit for trunk/JavaScriptCore/jit/JITStubs.cpp

Timestamp:

May 12, 2009, 1:27:28 PM (16 years ago)

Author:

[email protected]

Message:

Unsigned underflow on 64bit cannot be treated as a negative number

Reviewed by Geoff Garen

This code included some placeswhere we deliberately create negative offsets
from unsigned values, on 32bit this is "safe", but in 64bit builds much
badness occurs. Solution is to use signed types as nature intended.

File:

• trunk/JavaScriptCore/jit/JITStubs.cpp (modified) (3 diffs)

trunk/JavaScriptCore/jit/JITStubs.cpp

@@ -1586 +1586 @@
     uint32_t argCount = 0;
     if (!arguments) {
-        argCount = (uint32_t)(callFrame[RegisterFile::ArgumentCount].u.i) - 1;
+        int providedParams = callFrame[RegisterFile::ArgumentCount].u.i - 1;
+        argCount = providedParams;
         int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
         Register* newEnd = callFrame->registers() + sizeDelta;
@@ -1593 +1594 @@
             VM_THROW_EXCEPTION();
         }
-        uint32_t expectedParams = asFunction(callFrame[RegisterFile::Callee].jsValue())->body()->parameterCount();
-        uint32_t inplaceArgs = min(argCount, expectedParams);
-        uint32_t i = 0;
+        int32_t expectedParams = asFunction(callFrame[RegisterFile::Callee].jsValue())->body()->parameterCount();
+        int32_t inplaceArgs = min(providedParams, expectedParams);
+        int32_t i = 0;
         Register* argStore = callFrame->registers() + argsOffset;
         
@@ -1602 +1603 @@
             argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams];
         // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this')
-        for (; i < argCount; i++)
-            argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - argCount - 1];
+        for (; i < providedParams; i++)
+            argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - providedParams - 1];
     } else if (!arguments.isUndefinedOrNull()) {
         if (!arguments.isObject()) {