Fix undefined behavior in WebIDL cast

RESOLVED FIXED in Firefox 67

Status

()

enhancement
RESOLVED FIXED
4 months ago
4 months ago

People

(Reporter: wingo, Assigned: Waldo)

Tracking

Trunk
mozilla67
Points:
---

Firefox Tracking Flags

(firefox67 fixed)

Details

Attachments

(1 attachment)

Reporter

Description

4 months ago

This cast would seem to have undefined behavior, which we should fix:

https://searchfox.org/mozilla-central/source/js/src/builtin/DataViewObject.cpp#414-418

Assignee

Comment 1

4 months ago
On second look, I don't think this comment is really right.  Casting out-of-range value to signed isn't UB, it's *implementation-defined*, which isn't necessarily unsafe.

But it's easy enough to make this all be wholly-defined operations -- cast to unsigned type is defined as modulus, WrapToSigned was written carefully to avoid any UB itself -- so we should just do that.
Attachment #9046451 - Flags: review?(nfroyd)
Assignee

Updated

4 months ago
Assignee: nobody → jwalden
Status: NEW → ASSIGNED
Attachment #9046451 - Flags: review?(nfroyd) → review+

Comment 2

4 months ago
Pushed by jwalden@mit.edu:
https://hg.mozilla.org/integration/mozilla-inbound/rev/5ea654f841a4
Be more careful about converting int32_t to DataView element type.  r=froydnj

Comment 3

4 months ago
bugherder
Status: ASSIGNED → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
You need to log in before you can comment on or make changes to this bug.