[Webkit-unassigned] [Bug 160322] New: Undefined Behavior in JSValue cast from NaN
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu Jul 28 15:50:19 PDT 2016
https://bugs.webkit.org/show_bug.cgi?id=160322
Bug ID: 160322
Summary: Undefined Behavior in JSValue cast from NaN
Classification: Unclassified
Product: WebKit
Version: WebKit Nightly Build
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Minor
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: jbedard at apple.com
JSValues can be constructed from doubles, and in some cases, are deliberately constructed with NaN values.
In circumstances where NaN is bound through the default JSValue constructor, however, an undefined conversion to int32_t occurs. While the subsequent if statement should fail and construct the JSValue through the explicit double constructor, given that the deliberate use of NaN is fairly common, it seems that the jsNaN() function should immediately call the explicit double constructor both for efficiency and to prevent inadvertent suppressing of any other bugs which may be instantiating a JSValue with a NaN double.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160728/1343b856/attachment.html>
More information about the webkit-unassigned
mailing list