[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
authorticaiolima@gmail.com <ticaiolima@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 13 Jan 2018 15:16:23 +0000 (15:16 +0000)
committerticaiolima@gmail.com <ticaiolima@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 13 Jan 2018 15:16:23 +0000 (15:16 +0000)
commitc78231e01187c7babbd01317d0f6420183621172
tree4924048f707a722574fe02e316ddc75af2cfc923
parent6e048f86ce838954ef7264dab28532337aa297e6
[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
https://bugs.webkit.org/show_bug.cgi?id=181182

Reviewed by Darin Adler.

JSTests:

* bigIntTests.yaml:
* stress/big-int-constructor.js:
* stress/big-int-prototype-to-string-cast-overflow.js: Added.
(assert):
(assertThrowRangeError):
* stress/number-prototype-to-string-cast-overflow.js: Added.
(assert):
(assertThrowRangeError):

Source/JavaScriptCore:

Casting double to integer is undefined behavior when the truncation
results into a value that doesn't fit into integer size, according C++
spec[1]. Thus, we are changing bigIntProtoFuncToString and
numberProtoFuncToString to remove these source of undefined behavior.

[1] - http://en.cppreference.com/w/cpp/language/implicit_conversion

* runtime/BigIntPrototype.cpp:
(JSC::bigIntProtoFuncToString):
* runtime/NumberPrototype.cpp:
(JSC::numberProtoFuncToString):
(JSC::extractRadixFromArgs): Deleted.
(JSC::extractToStringRadixArgument): Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@226937 268f45cc-cd09-0410-ab3c-d52691b4dbfc
13 files changed:
JSTests/ChangeLog
JSTests/bigIntTests.yaml
JSTests/stress/big-int-constructor.js
JSTests/stress/big-int-prototype-to-string-cast-overflow.js [new file with mode: 0644]
JSTests/stress/big-int-prototype-to-string-exception.js [new file with mode: 0644]
JSTests/stress/big-int-prototype-to-string-wrong-values.js [new file with mode: 0644]
JSTests/stress/number-prototype-to-string-cast-overflow.js [new file with mode: 0644]
JSTests/stress/number-prototype-to-string-exception.js [new file with mode: 0644]
JSTests/stress/number-prototype-to-string-wrong-values.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/BigIntPrototype.cpp
Source/JavaScriptCore/runtime/NumberPrototype.cpp
Source/JavaScriptCore/runtime/NumberPrototype.h