<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Undefined Behavior in JSValue cast from NaN"
href="https://bugs.webkit.org/show_bug.cgi?id=160322#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Undefined Behavior in JSValue cast from NaN"
href="https://bugs.webkit.org/show_bug.cgi?id=160322">bug 160322</a>
from <span class="vcard"><a class="email" href="mailto:mark.lam@apple.com" title="Mark Lam <mark.lam@apple.com>"> <span class="fn">Mark Lam</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=160322#c0">comment #0</a>)
<span class="quote">> JSValues can be constructed from doubles, and in some cases, are
> deliberately constructed with NaN values.
>
> In circumstances where NaN is bound through the default JSValue constructor,
> however, an undefined conversion to int32_t occurs. While the subsequent if
> statement should fail and construct the JSValue through the explicit double
> constructor, given that the deliberate use of NaN is fairly common, it seems
> that the jsNaN() function should immediately call the explicit double
> constructor both for efficiency and to prevent inadvertent suppressing of
> any other bugs which may be instantiating a JSValue with a NaN double.</span >
Jonathan,
1. Please put this info in the ChangeLog. It would be better if you can include a url to the C++ spec that shows that the NaN/Inf to int cast is undefined behavior to confirm that this is the case.
2. Is your fix adequate? What about NaNs and Infinities that naturally arise from arithmetic? For example, see slow_path_mul and slow_path_div in CommonSlowPaths.cpp.
Perhaps the mode complete fix is to fix JSValue(double) instead?</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>