[Webkit-unassigned] [Bug 160322] Undefined Behavior in JSValue cast from NaN

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=160322

--- Comment #4 from Mark Lam <mark.lam at apple.com> ---
(In reply to comment #0)
> JSValues can be constructed from doubles, and in some cases, are
> deliberately constructed with NaN values.
> 
> In circumstances where NaN is bound through the default JSValue constructor,
> however, an undefined conversion to int32_t occurs.  While the subsequent if
> statement should fail and construct the JSValue through the explicit double
> constructor, given that the deliberate use of NaN is fairly common, it seems
> that the jsNaN() function should immediately call the explicit double
> constructor both for efficiency and to prevent inadvertent suppressing of
> any other bugs which may be instantiating a JSValue with a NaN double.

Jonathan,

1. Please put this info in the ChangeLog.  It would be better if you can include a url to the C++ spec that shows that the NaN/Inf to int cast is undefined behavior to confirm that this is the case.

2. Is your fix adequate?  What about NaNs and Infinities that naturally arise from arithmetic?  For example, see slow_path_mul and slow_path_div in CommonSlowPaths.cpp.

Perhaps the mode complete fix is to fix JSValue(double) instead?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160729/7505b00f/attachment.html>