[Webkit-unassigned] [Bug 182419] New: Fix broken bounds check in FTL's compileGetMyArgumentByVal().

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=182419

            Bug ID: 182419
           Summary: Fix broken bounds check in FTL's
                    compileGetMyArgumentByVal().
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.lam at apple.com

In compileGetMyArgumentByVal(), it computes:
    limit = m_out.sub(limit, m_out.constInt32(m_node->numberOfArgumentsToSkip()));
    ...
    LValue isOutOfBounds = m_out.aboveOrEqual(originalIndex, limit);

where the original "limit" is the number of arguments passed in by the caller.  If the original limit is less than numberOfArgumentsToSkip, the resultant limit will be a large unsigned number.  As a result, this will defeat the bounds check that follows it.

<rdar://problem/37044945>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180202/9ed72425/attachment-0001.html>