[Webkit-unassigned] [Bug 104967] New: javascript integer overflow

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=104967

           Summary: javascript integer overflow
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Macintosh Intel
        OS/Version: Mac OS X 10.7
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: joecackler at gmail.com


I stumbled upon a case where it appears that JavaScriptCore's JIT is incorrectly assuming an int32 suffices for a variable that represents a numerical sum.  When the sum grows beyond 2^32-1, the value overflows as if 2^32 were subtracted.  When I enable Web Inspector, the bug goes away, which I why I suspect the JIT compiler's at fault.

I'm on Mac OS 10.7, and I can reproduce the bug consistently on the release version of Safari -- 6.0.2 (7536.26.17) -- as well as on the latest WebKit nightly build.  The bug does NOT affect Safari 5.

Here's a demonstration: http://jsfiddle.net/T86va/

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.