Skip to content

[JSC] Adopt truncate-double-to-int infrastructure more in ArrayPrototype.cpp - #63514

Merged
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
tetsuharuohzeki:avoid-ub-in-runtime-array-prototype-cpp
Apr 25, 2026
Merged

[JSC] Adopt truncate-double-to-int infrastructure more in ArrayPrototype.cpp#63514
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
tetsuharuohzeki:avoid-ub-in-runtime-array-prototype-cpp

Conversation

@tetsuharuohzeki

@tetsuharuohzeki tetsuharuohzeki commented Apr 24, 2026 •
edited by webkit-early-warning-system
Loading

Copy link
Copy Markdown
Member

bf720cf

[JSC] Adopt truncate-double-to-int infrastructure more in ArrayPrototype.cpp
https://bugs.webkit.org/show_bug.cgi?id=313219

Reviewed by Sosuke Suzuki.

We can adopt the infrastructure added in https://commits.webkit.org/309786@main more in that place

* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:
(JSC::argumentClampedIndexFromStartOrEnd):
(JSC::argumentUnclampedIndexFromStartOrEnd):
(JSC::arrayProtoFuncLastIndexOf):

Canonical link: https://commits.webkit.org/312006@main

492ce9b

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ✅ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk1 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64 ✅ 🛠 ios-safer-cpp ✅ 🧪 mac-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress   🛠 playstation
✅ 🧪 vision-wk2 ✅ 🧪 mac-intel-wk2 ✅ 🛠 jsc-armv7
✅ 🛠 tv ✅ 🛠 mac-safer-cpp ✅ 🧪 jsc-armv7-tests
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@tetsuharuohzeki tetsuharuohzeki self-assigned this Apr 24, 2026
@tetsuharuohzeki tetsuharuohzeki added the JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. label Apr 24, 2026
@webkit-early-warning-system

webkit-early-warning-system commented Apr 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on current version of this PR (hash 492ce9b)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ✅ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk1 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64 ✅ 🛠 ios-safer-cpp ✅ 🧪 mac-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress   🛠 playstation
✅ 🧪 vision-wk2 ✅ 🧪 mac-intel-wk2 ✅ 🛠 jsc-armv7
✅ 🛠 tv ✅ 🛠 mac-safer-cpp ✅ 🧪 jsc-armv7-tests
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@tetsuharuohzeki
tetsuharuohzeki marked this pull request as ready for review April 24, 2026 11:46
@tetsuharuohzeki
tetsuharuohzeki requested a review from a team as a code owner April 24, 2026 11:46
sosukesuzuki
sosukesuzuki approved these changes Apr 25, 2026
View reviewed changes

@sosukesuzuki sosukesuzuki left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r=me

@sosukesuzuki sosukesuzuki added the merge-queue Applied to send a pull request to merge-queue label Apr 25, 2026
@tetsuharuohzeki @sosukesuzuki
[JSC] Adopt truncate-double-to-int infrastructure more in ArrayProtot…
bf720cf 
…ype.cpp

https://bugs.webkit.org/show_bug.cgi?id=313219

Reviewed by Sosuke Suzuki.

We can adopt the infrastructure added in https://commits.webkit.org/309786@main more in that place

* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:
(JSC::argumentClampedIndexFromStartOrEnd):
(JSC::argumentUnclampedIndexFromStartOrEnd):
(JSC::arrayProtoFuncLastIndexOf):

Canonical link: https://commits.webkit.org/312006@main
@webkit-commit-queue
webkit-commit-queue force-pushed the avoid-ub-in-runtime-array-prototype-cpp branch from 492ce9b to bf720cf Compare April 25, 2026 04:42
@webkit-commit-queue

webkit-commit-queue commented Apr 25, 2026

Copy link
Copy Markdown
Collaborator

Committed 312006@main (bf720cf): https://commits.webkit.org/312006@main

Reviewed commits have been landed. Closing PR #63514 and removing active labels.

@webkit-commit-queue
webkit-commit-queue merged commit bf720cf into WebKit:main Apr 25, 2026
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Apr 25, 2026
@tetsuharuohzeki
tetsuharuohzeki deleted the avoid-ub-in-runtime-array-prototype-cpp branch April 25, 2026 05:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sosukesuzuki sosukesuzuki sosukesuzuki approved these changes

Assignees

@tetsuharuohzeki tetsuharuohzeki

Labels

JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@tetsuharuohzeki @webkit-early-warning-system @webkit-commit-queue @sosukesuzuki