AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[regexp] Fix UB (signed left shift) in peephole optimizer

Browse Source 
Left-shifting a variable of signed type containing a negative value is
undefined behavior.

Bug: chromium:1010465,v8:9330
Change-Id: Ide524f87a7d76f906f6034de4c6605df150c66a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1847151
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64154}
This commit is contained in:
Jakob Gruber 2019-10-08 09:54:04 +02:00 committed by Commit Bot
parent cea0ebcce1
commit cca5ada9fe
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/regexp/regexp-bytecode-peephole.cc
View File

@ -975,8 +975,9 @@ void RegExpBytecodePeephole::EmitArgument(int start_pc, const byte* bytecode,
USE(prev_val);
#else
DCHECK_EQ(prev_val & 0xFFFFFF00, 0);
OverwriteValue<uint32_t>(pc() - sizeof(uint32_t),
(val << 8) | (prev_val & 0xFF));
OverwriteValue<uint32_t>(
pc() - sizeof(uint32_t),
(static_cast<uint32_t>(val) << 8) | (prev_val & 0xFF));
#endif // V8_TARGET_BIG_ENDIAN
break;
}