[Webkit-unassigned] [Bug 187042] RegExp.exec returns wrong value with a long integer quantifier

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Sun Jul 1 23:18:30 PDT 2018


https://bugs.webkit.org/show_bug.cgi?id=187042

Saam Barati <sbarati at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #344061|review?                     |review+
              Flags|                            |

--- Comment #15 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 344061
  --> https://bugs.webkit.org/attachment.cgi?id=344061
Remove the extra overflow loop, use consumeDigit, and update ChangeLog

View in context: https://bugs.webkit.org/attachment.cgi?id=344061&action=review

r=me

> Source/JavaScriptCore/ChangeLog:11
> +        because once there has been overflow, undefined behavior has occurred.

This isn’t true. Unsigned overflow is defined behavior. Signed overflow is not. Your point below holds regardless

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180702/9c9d43e3/attachment-0001.html>


More information about the webkit-unassigned mailing list