396446 - fix bug in clamp and remove usless unsigned checks

Status: VERIFIED FIXED

(Tamarin Graveyard :: Virtual Machine, defect, P3)

Description

[Andrei Barbu]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4
Build Identifier: HEAD 164

There is a bug in ClampIndexInt.
   if (intValue < 0)
   {
     if (intValue + length < 0)
       result = 0;
     else
       result = (uint32)(intValue + length);
   }

where intValue is of type int, length is of type uint32. Since length is unsigned intValue + length this will become unsigned. This check will never be true. You meant for it to be a signed check I'm guessing.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[Andrei Barbu]

Attachment: patch

Comment 2

[Andrei Barbu]

This also gets rid of some useless assertions that an unsigned value may be less than 0.

Comment 3

[Dan Schaffer]

triaging old bugs,  this bug was partially implemented.  
GCStack.h: 96 still has _DEBUG GCAssert(m_iCount>=0
NativeObjectHelpers.h: 65 now has if (intValue + length < 0.0)

Comment 4

[Tommy Reilly]

changed component to vm instead of GC since the usess GC assert were removed

Comment 5

[Dan Smith]

Lars, is this bug/patch still relevant?

Comment 6

[Lars T Hansen]

These changes have all been integrated.

Comment 7

[Chris Peyer]

removing QRB request, bug verified