Changeset 45693 in webkit for trunk/JavaScriptCore

Timestamp:

Jul 9, 2009, 7:44:34 PM (16 years ago)

Author:

[email protected]

Message:

Bug 27016 - Interpreter crashes due to invalid array indexes
<​https://bugs.webkit.org/show_bug.cgi?id=27016>

Reviewed by Darin Adler.

Unsigned vs signed conversions results in incorrect behaviour in
64bit interpreter builds.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• interpreter/Interpreter.cpp (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-07-09  Oliver Hunt  <[email protected]>
+
+        Reviewed by Darin Adler.
+
+        Bug 27016 - Interpreter crashes due to invalid array indexes
+        <https://bugs.webkit.org/show_bug.cgi?id=27016>
+
+        Unsigned vs signed conversions results in incorrect behaviour in
+        64bit interpreter builds.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
 2009-07-09  Dimitri Glazkov  <[email protected]>
 

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -3151 +3151 @@
                 }
                 Register* argsBuffer = callFrame->registers() + argsOffset;
-                for (unsigned i = 0; i < argCount; ++i) {
+                for (int32_t i = 0; i < argCount; ++i) {
                     argsBuffer[i] = asObject(arguments)->get(callFrame, i);
                     CHECK_FOR_EXCEPTION();