Closed Bug 998167 Opened 6 years ago Closed 6 years ago

Fix signed integer overflow in EvaluateConstantOperands

Categories

(Core :: JavaScript Engine: JIT, enhancement)

enhancement
Not set

Tracking

()

RESOLVED FIXED
mozilla31

People

(Reporter: sunfish, Assigned: sunfish)

Details

Attachments

(1 file)

The code in EvaluateConstantOperands for folding an Lsh operator uses a signed left shift. This invokes undefined behavior if the computation overflows.
This patch changes Lsh to use an unsigned shift instead of a signed shift to fix the undefined behavior, and also tidies up the Ursh case to look similar.
Assignee: nobody → sunfish
Attachment #8408725 - Flags: review?(nicolas.b.pierron)
Attachment #8408725 - Flags: review?(nicolas.b.pierron) → review+
https://hg.mozilla.org/mozilla-central/rev/76e21dbec835
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla31
You need to log in before you can comment on or make changes to this bug.