Closed
Bug 1530296
Opened 6 years ago
Closed 6 years ago
Fix undefined behavior in WebIDL cast
Categories
(Core :: JavaScript Engine, enhancement)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla67
| Tracking | Status | |
|---|---|---|
| firefox67 | --- | fixed |
People
(Reporter: wingo, Assigned: Waldo)
Details
Attachments
(1 file)
|
2.79 KB,
patch
|
froydnj
:
review+
|
Details | Diff | Splinter Review |
This cast would seem to have undefined behavior, which we should fix:
https://searchfox.org/mozilla-central/source/js/src/builtin/DataViewObject.cpp#414-418
| Assignee | ||
Comment 1•6 years ago
|
||
On second look, I don't think this comment is really right. Casting out-of-range value to signed isn't UB, it's *implementation-defined*, which isn't necessarily unsafe.
But it's easy enough to make this all be wholly-defined operations -- cast to unsigned type is defined as modulus, WrapToSigned was written carefully to avoid any UB itself -- so we should just do that.
Attachment #9046451 -
Flags: review?(nfroyd)
| Assignee | ||
Updated•6 years ago
|
Assignee: nobody → jwalden
Status: NEW → ASSIGNED
Updated•6 years ago
|
Attachment #9046451 -
Flags: review?(nfroyd) → review+
Pushed by jwalden@mit.edu:
https://hg.mozilla.org/integration/mozilla-inbound/rev/5ea654f841a4
Be more careful about converting int32_t to DataView element type. r=froydnj
Comment 3•6 years ago
|
||
| bugherder | ||
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
You need to log in
before you can comment on or make changes to this bug.
Description
•