212167 2020-05-20 14:08:26 -0700 Array.prototype.concat is incorrect with objects whose "length" exceeds 2 ** 32 - 1 2020-05-21 01:42:16 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build All All RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=163417 InRadar P2 Minor --- 1 ashvayka ashvayka ews-watchlist joepeck keith_miller mark.lam msaboff ross.kirsling saam tzagallo webkit-bug-importer oldest_to_newest 1654639 0 ashvayka 2020-05-20 14:08:26 -0700 Array.prototype.concat is incorrect with objects whose "length" exceeds 2 ** 32 - 1 1654641 1 399892 ashvayka 2020-05-20 14:13:58 -0700 Created attachment 399892 Patch 1654668 2 399892 saam 2020-05-20 15:24:44 -0700 Comment on attachment 399892 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=399892&action=review > Source/JavaScriptCore/builtins/ArrayConstructor.js:72 > + if (k >= @MAX_SAFE_INTEGER) should be >, no? 1654837 3 ashvayka 2020-05-21 01:29:25 -0700 (In reply to Saam Barati from comment #2) Thank you for review, Saam! > > Source/JavaScriptCore/builtins/ArrayConstructor.js:72 > > + if (k >= @MAX_SAFE_INTEGER) > > should be >, no? ECMA-262 is consistent to use > for length checks and >= for indices; `k` is an index here. I've vetted all 2 ** 53 - 1 checks in JSC, we are spec-perfect with this patch. 1654840 4 ews-feeder 2020-05-21 01:41:26 -0700 Committed r261987: <https://trac.webkit.org/changeset/261987> All reviewed patches have been landed. Closing bug and clearing flags on attachment 399892. 1654842 5 webkit-bug-importer 2020-05-21 01:42:16 -0700 <rdar://problem/63484485> 399892 2020-05-20 14:13:58 -0700 2020-05-21 01:41:26 -0700 Patch bug-212167-20200521001357.patch text/plain 7027 ashvayka SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNjE5MjcpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE0IEBACisyMDIwLTA1LTIwICBBbGV4ZXkgU2h2YXlrYSAgPHNodmFpa2FsZXNo QGdtYWlsLmNvbT4KKworICAgICAgICBBcnJheS5wcm90b3R5cGUuY29uY2F0IGlzIGluY29ycmVj dCB3aXRoIG9iamVjdHMgd2hvc2UgImxlbmd0aCIgZXhjZWVkcyAyICoqIDMyIC0gMQorICAgICAg ICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjEyMTY3CisKKyAgICAg ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBzdHJlc3MvYXJyYXkt cHJvdG90eXBlLWNvbmNhdC1vZi1sb25nLXNwbGljZWQtYXJyYXlzLmpzOgorICAgICAgICAqIHN0 cmVzcy9hcnJheS1wcm90b3R5cGUtY29uY2F0LW9mLWxvbmctc3BsaWNlZC1hcnJheXMyLmpzOgor ICAgICAgICAqIHRlc3QyNjIvZXhwZWN0YXRpb25zLnlhbWw6IE1hcmsgNCB0ZXN0IGNhc2VzIGFz IHBhc3NpbmcuCisKIDIwMjAtMDUtMTkgIE1pY2hhZWwgQ2F0YW56YXJvICA8bWNhdGFuemFyb0Bn bm9tZS5vcmc+CiAKICAgICAgICAgRml4dXBzIGZvciByMjYxNjg5ICJzdHJlc3MvYXJyYXktYnVm ZmVyLXZpZXctd2F0Y2hwb2ludC1jYW4tYmUtZmlyZWQtaW4tcmVhbGx5LWFkZC1pbi1kZmcuanMg ZmFpbGluZyBvbiBwcGM2NGxlIGFuZCBzMzkweCIKSW5kZXg6IEpTVGVzdHMvc3RyZXNzL2FycmF5 LXByb3RvdHlwZS1jb25jYXQtb2YtbG9uZy1zcGxpY2VkLWFycmF5czIuanMKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gSlNUZXN0cy9zdHJlc3MvYXJyYXktcHJvdG90eXBlLWNvbmNhdC1vZi1sb25nLXNwbGljZWQt YXJyYXlzMi5qcwkocmV2aXNpb24gMjYxOTI3KQorKysgSlNUZXN0cy9zdHJlc3MvYXJyYXktcHJv dG90eXBlLWNvbmNhdC1vZi1sb25nLXNwbGljZWQtYXJyYXlzMi5qcwkod29ya2luZyBjb3B5KQpA QCAtMjAsNyArMjAsNyBAQCBmdW5jdGlvbiB0ZXN0KCkgewogICAgIH0gY2F0Y2ggKGUpIHsKICAg ICAgICAgZXhjZXB0aW9uID0gZTsKICAgICB9Ci0gICAgc2hvdWxkRXF1YWwoZXhjZXB0aW9uLCAi UmFuZ2VFcnJvcjogTGVuZ3RoIGV4Y2VlZGVkIHRoZSBtYXhpbXVtIGFycmF5IGxlbmd0aCIpOwor ICAgIHNob3VsZEVxdWFsKGV4Y2VwdGlvbiwgIlJhbmdlRXJyb3I6IEludmFsaWQgYXJyYXkgbGVu Z3RoIik7CiB9CiAKIHRlc3QoKTsKSW5kZXg6IEpTVGVzdHMvc3RyZXNzL2FycmF5LXByb3RvdHlw ZS1jb25jYXQtb2YtbG9uZy1zcGxpY2VkLWFycmF5cy5qcwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKU1Rlc3Rz L3N0cmVzcy9hcnJheS1wcm90b3R5cGUtY29uY2F0LW9mLWxvbmctc3BsaWNlZC1hcnJheXMuanMJ KHJldmlzaW9uIDI2MTkyNykKKysrIEpTVGVzdHMvc3RyZXNzL2FycmF5LXByb3RvdHlwZS1jb25j YXQtb2YtbG9uZy1zcGxpY2VkLWFycmF5cy5qcwkod29ya2luZyBjb3B5KQpAQCAtMzAsNyArMzAs NyBAQCBmdW5jdGlvbiB0ZXN0KCkgewogICAgICAgICBleGNlcHRpb24gPSBlOwogICAgIH0KIAot ICAgIHNob3VsZEVxdWFsKGV4Y2VwdGlvbiwgIlJhbmdlRXJyb3I6IExlbmd0aCBleGNlZWRlZCB0 aGUgbWF4aW11bSBhcnJheSBsZW5ndGgiKTsKKyAgICBzaG91bGRFcXVhbChleGNlcHRpb24sICJS YW5nZUVycm9yOiBJbnZhbGlkIGFycmF5IGxlbmd0aCIpOwogfQogCiB0ZXN0KCk7CkluZGV4OiBK U1Rlc3RzL3Rlc3QyNjIvZXhwZWN0YXRpb25zLnlhbWwKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gSlNUZXN0cy90 ZXN0MjYyL2V4cGVjdGF0aW9ucy55YW1sCShyZXZpc2lvbiAyNjE5MjcpCisrKyBKU1Rlc3RzL3Rl c3QyNjIvZXhwZWN0YXRpb25zLnlhbWwJKHdvcmtpbmcgY29weSkKQEAgLTY1NCwxMiArNjU0LDYg QEAgdGVzdC9hbm5leEIvbGFuZ3VhZ2Uvc3RhdGVtZW50cy9mb3Itb2YvaQogdGVzdC9hbm5leEIv bGFuZ3VhZ2Uvc3RhdGVtZW50cy9mdW5jdGlvbi9kZWZhdWx0LXBhcmFtZXRlcnMtZW11bGF0ZXMt dW5kZWZpbmVkLmpzOgogICBkZWZhdWx0OiAnVGVzdDI2MkVycm9yOiBFeHBlY3RlZCBTYW1lVmFs dWUowqt1bmRlZmluZWTCuywgwqtbb2JqZWN0IEZ1bmN0aW9uXcK7KSB0byBiZSB0cnVlJwogICBz dHJpY3QgbW9kZTogJ1Rlc3QyNjJFcnJvcjogRXhwZWN0ZWQgU2FtZVZhbHVlKMKrdW5kZWZpbmVk wrssIMKrW29iamVjdCBGdW5jdGlvbl3CuykgdG8gYmUgdHJ1ZScKLXRlc3QvYnVpbHQtaW5zL0Fy cmF5L3Byb3RvdHlwZS9jb25jYXQvYXJnLWxlbmd0aC1leGNlZWRpbmctaW50ZWdlci1saW1pdC5q czoKLSAgZGVmYXVsdDogJ1Rlc3QyNjJFcnJvcjogRXhwZWN0ZWQgYSBUeXBlRXJyb3IgYnV0IGdv dCBhIFJhbmdlRXJyb3InCi0gIHN0cmljdCBtb2RlOiAnVGVzdDI2MkVycm9yOiBFeHBlY3RlZCBh IFR5cGVFcnJvciBidXQgZ290IGEgUmFuZ2VFcnJvcicKLXRlc3QvYnVpbHQtaW5zL0FycmF5L3By b3RvdHlwZS9jb25jYXQvYXJnLWxlbmd0aC1uZWFyLWludGVnZXItbGltaXQuanM6Ci0gIGRlZmF1 bHQ6ICdUZXN0MjYyRXJyb3I6IEV4cGVjdGVkIGEgVGVzdDI2MkVycm9yIGJ1dCBnb3QgYSBSYW5n ZUVycm9yJwotICBzdHJpY3QgbW9kZTogJ1Rlc3QyNjJFcnJvcjogRXhwZWN0ZWQgYSBUZXN0MjYy RXJyb3IgYnV0IGdvdCBhIFJhbmdlRXJyb3InCiB0ZXN0L2J1aWx0LWlucy9BcnJheS9wcm90b3R5 cGUvc3BsaWNlL3Byb3BlcnR5LXRyYXBzLW9yZGVyLXdpdGgtc3BlY2llcy5qczoKICAgZGVmYXVs dDogJ1Rlc3QyNjJFcnJvcjogRXhwZWN0ZWQgW2RlZmluZVByb3BlcnR5LCBkZWZpbmVQcm9wZXJ0 eSwgc2V0LCBnZXRPd25Qcm9wZXJ0eURlc2NyaXB0b3IsIGRlZmluZVByb3BlcnR5XSBhbmQgW2Rl ZmluZVByb3BlcnR5LCBkZWZpbmVQcm9wZXJ0eV0gdG8gaGF2ZSB0aGUgc2FtZSBjb250ZW50cy4g JwogICBzdHJpY3QgbW9kZTogJ1Rlc3QyNjJFcnJvcjogRXhwZWN0ZWQgW2RlZmluZVByb3BlcnR5 LCBkZWZpbmVQcm9wZXJ0eSwgc2V0LCBnZXRPd25Qcm9wZXJ0eURlc2NyaXB0b3IsIGRlZmluZVBy b3BlcnR5XSBhbmQgW2RlZmluZVByb3BlcnR5LCBkZWZpbmVQcm9wZXJ0eV0gdG8gaGF2ZSB0aGUg c2FtZSBjb250ZW50cy4gJwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCShyZXZpc2lvbiAy NjE5MjcpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkp CkBAIC0xLDMgKzEsMjQgQEAKKzIwMjAtMDUtMjAgIEFsZXhleSBTaHZheWthICA8c2h2YWlrYWxl c2hAZ21haWwuY29tPgorCisgICAgICAgIEFycmF5LnByb3RvdHlwZS5jb25jYXQgaXMgaW5jb3Jy ZWN0IHdpdGggb2JqZWN0cyB3aG9zZSAibGVuZ3RoIiBleGNlZWRzIDIgKiogMzIgLSAxCisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMTIxNjcKKworICAg ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUaGlzIHBhdGNoIGlu Y3JlYXNlcyAibGVuZ3RoIiBsaW1pdCBvZiBBcnJheS5wcm90b3R5cGUuY29uY2F0IHJlc3VsdCB0 byBATUFYX1NBRkVfSU5URUdFUgorICAgICAgICBhbmQgY2hhbmdlcyB0aHJvd24gZXJyb3IgdG8g VHlwZUVycm9yLCBhbGlnbmluZyBKU0Mgd2l0aCB0aGUgc3BlYyBbMV0sIFY4LCBhbmQgU3BpZGVy TW9ua2V5LgorCisgICAgICAgIEFsc28sIGFkZHMgbWlzc2luZyBATUFYX1NBRkVfSU5URUdFUiBv dmVyZmxvdyBjaGVjayBpbiBBcnJheS5mcm9tIFsyXSAod2UgaW1wbGVtZW50IHNpbWlsYXIKKyAg ICAgICAgY2hlY2tzIGluIG90aGVyIG1ldGhvZHMpLiBTdW5TcGlkZXIgYW5kIG1pY3JvYmVuY2ht YXJrcy9jb25jYXQtYXBwZW5kLW9uZS5qcyBhcmUgYm90aCBuZXV0cmFsLgorCisgICAgICAgIFsx XTogaHR0cHM6Ly90YzM5LmVzL2VjbWEyNjIvI3NlYy1hcnJheS5wcm90b3R5cGUuY29uY2F0IChz dGVwcyA1LmMuaWlpLCA1LmQuaWkpCisgICAgICAgIFsyXTogaHR0cHM6Ly90YzM5LmVzL2VjbWEy NjIvI3NlYy1hcnJheS5mcm9tIChzdGVwIDUuZS5pKQorCisgICAgICAgICogYnVpbHRpbnMvQXJy YXlDb25zdHJ1Y3Rvci5qczoKKyAgICAgICAgKGZyb20pOgorICAgICAgICAqIGJ1aWx0aW5zL0Fy cmF5UHJvdG90eXBlLmpzOgorICAgICAgICAoZ2xvYmFsUHJpdmF0ZS5jb25jYXRTbG93UGF0aCk6 CisKIDIwMjAtMDUtMTkgIFJvc3MgS2lyc2xpbmcgIDxyb3NzLmtpcnNsaW5nQHNvbnkuY29tPgog CiAgICAgICAgIFJFR1JFU1NJT04ocjI2MTc1NSk6IFdpbi9MaW51eCBub24tdW5pZmllZCBidWls ZHMgaGF2ZSBodW5kcmVkcyBvZiBsaW5rIGZhaWx1cmVzCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlw dENvcmUvYnVpbHRpbnMvQXJyYXlDb25zdHJ1Y3Rvci5qcwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvYnVpbHRpbnMvQXJyYXlDb25zdHJ1Y3Rvci5qcwkocmV2aXNpb24gMjYx OTI3KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2J1aWx0aW5zL0FycmF5Q29uc3RydWN0b3Iu anMJKHdvcmtpbmcgY29weSkKQEAgLTY5LDYgKzY5LDggQEAgZnVuY3Rpb24gZnJvbShpdGVtcyAv KiwgbWFwRm4sIHRoaXNBcmcgKgogICAgICAgICB3cmFwcGVyLkBAaXRlcmF0b3IgPSBmdW5jdGlv bigpIHsgcmV0dXJuIGl0ZXJhdG9yOyB9OwogCiAgICAgICAgIGZvciAodmFyIHZhbHVlIG9mIHdy YXBwZXIpIHsKKyAgICAgICAgICAgIGlmIChrID49IEBNQVhfU0FGRV9JTlRFR0VSKQorICAgICAg ICAgICAgICAgIEB0aHJvd1R5cGVFcnJvcigiTGVuZ3RoIGV4Y2VlZGVkIHRoZSBtYXhpbXVtIGFy cmF5IGxlbmd0aCIpOwogICAgICAgICAgICAgaWYgKG1hcEZuKQogICAgICAgICAgICAgICAgIEBw dXRCeVZhbERpcmVjdChyZXN1bHQsIGssIHRoaXNBcmcgPT09IEB1bmRlZmluZWQgPyBtYXBGbih2 YWx1ZSwgaykgOiBtYXBGbi5AY2FsbCh0aGlzQXJnLCB2YWx1ZSwgaykpOwogICAgICAgICAgICAg ZWxzZQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2J1aWx0aW5zL0FycmF5UHJvdG90eXBl LmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9idWlsdGlucy9BcnJheVBy b3RvdHlwZS5qcwkocmV2aXNpb24gMjYxOTI3KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2J1 aWx0aW5zL0FycmF5UHJvdG90eXBlLmpzCSh3b3JraW5nIGNvcHkpCkBAIC01NTgsOSArNTU4LDkg QEAgZnVuY3Rpb24gY29uY2F0U2xvd1BhdGgoKQogICAgICAgICB2YXIgc3ByZWFkYWJsZSA9IEBp c09iamVjdChjdXJyZW50RWxlbWVudCkgJiYgY3VycmVudEVsZW1lbnQuQEBpc0NvbmNhdFNwcmVh ZGFibGU7CiAgICAgICAgIGlmICgoc3ByZWFkYWJsZSA9PT0gQHVuZGVmaW5lZCAmJiBAaXNBcnJh eShjdXJyZW50RWxlbWVudCkpIHx8IHNwcmVhZGFibGUpIHsKICAgICAgICAgICAgIHZhciBsZW5n dGggPSBAdG9MZW5ndGgoY3VycmVudEVsZW1lbnQubGVuZ3RoKTsKLSAgICAgICAgICAgIGlmIChs ZW5ndGggKyByZXN1bHRJbmRleCA+IEBNQVhfQVJSQVlfSU5ERVgpCi0gICAgICAgICAgICAgICAg QHRocm93UmFuZ2VFcnJvcigiTGVuZ3RoIGV4Y2VlZGVkIHRoZSBtYXhpbXVtIGFycmF5IGxlbmd0 aCIpOwotICAgICAgICAgICAgaWYgKHJlc3VsdElzQXJyYXkgJiYgQGlzSlNBcnJheShjdXJyZW50 RWxlbWVudCkpIHsKKyAgICAgICAgICAgIGlmIChsZW5ndGggKyByZXN1bHRJbmRleCA+IEBNQVhf U0FGRV9JTlRFR0VSKQorICAgICAgICAgICAgICAgIEB0aHJvd1R5cGVFcnJvcigiTGVuZ3RoIGV4 Y2VlZGVkIHRoZSBtYXhpbXVtIGFycmF5IGxlbmd0aCIpOworICAgICAgICAgICAgaWYgKHJlc3Vs dElzQXJyYXkgJiYgQGlzSlNBcnJheShjdXJyZW50RWxlbWVudCkgJiYgbGVuZ3RoICsgcmVzdWx0 SW5kZXggPD0gQE1BWF9BUlJBWV9JTkRFWCkgewogICAgICAgICAgICAgICAgIEBhcHBlbmRNZW1j cHkocmVzdWx0LCBjdXJyZW50RWxlbWVudCwgcmVzdWx0SW5kZXgpOwogICAgICAgICAgICAgICAg IHJlc3VsdEluZGV4ICs9IGxlbmd0aDsKICAgICAgICAgICAgIH0gZWxzZSB7CkBAIC01NzEsOCAr NTcxLDggQEAgZnVuY3Rpb24gY29uY2F0U2xvd1BhdGgoKQogICAgICAgICAgICAgICAgIH0KICAg ICAgICAgICAgIH0KICAgICAgICAgfSBlbHNlIHsKLSAgICAgICAgICAgIGlmIChyZXN1bHRJbmRl eCA+PSBATUFYX0FSUkFZX0lOREVYKQotICAgICAgICAgICAgICAgIEB0aHJvd1JhbmdlRXJyb3Io Ikxlbmd0aCBleGNlZWRlZCB0aGUgbWF4aW11bSBhcnJheSBsZW5ndGgiKTsKKyAgICAgICAgICAg IGlmIChyZXN1bHRJbmRleCA+PSBATUFYX1NBRkVfSU5URUdFUikKKyAgICAgICAgICAgICAgICBA dGhyb3dUeXBlRXJyb3IoIkxlbmd0aCBleGNlZWRlZCB0aGUgbWF4aW11bSBhcnJheSBsZW5ndGgi KTsKICAgICAgICAgICAgIEBwdXRCeVZhbERpcmVjdChyZXN1bHQsIHJlc3VsdEluZGV4KyssIGN1 cnJlbnRFbGVtZW50KTsKICAgICAgICAgfQogICAgICAgICBjdXJyZW50RWxlbWVudCA9IGFyZ3Vt ZW50c1thcmdJbmRleF07Cg==