commit 24c499953175b683c824bc1ebffb261a9add9fe2
author fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Sat Apr 19 21:13:46 2014 +0000
committer fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Sat Apr 19 21:13:46 2014 +0000
tree 970f5a7327af25e247061f093cbb0f857e0541a7
parent 2983cc04f9d3939f021fc1ec73f15b05e5c5e93a

Make it easier to check if an integer sum would overflow
https://bugs.webkit.org/show_bug.cgi?id=131900

Reviewed by Darin Adler.


Source/JavaScriptCore: 
* dfg/DFGOperations.cpp:
* runtime/Operations.h:
(JSC::jsString):

Source/WTF: 
* wtf/CheckedArithmetic.h:
(WTF::checkedSum):
(WTF::sumOverflows):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167548 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/dfg/DFGOperations.cpp

diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 7d14e44..ffacf73 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -968,8 +968,8 @@
 {
     VM& vm = exec->vm();
     NativeCallFrameTracer tracer(&vm, exec);
-    
-    if (static_cast<int32_t>(left->length() + right->length()) < 0) {
+
+    if (sumOverflows<int32_t>(left->length(), right->length())) {
         throwOutOfMemoryError(exec);
         return nullptr;
     }
@@ -982,10 +982,7 @@
     VM& vm = exec->vm();
     NativeCallFrameTracer tracer(&vm, exec);
 
-    Checked<int32_t, RecordOverflow> length = a->length();
-    length += b->length();
-    length += c->length();
-    if (length.hasOverflowed()) {
+    if (sumOverflows<int32_t>(a->length(), b->length(), c->length())) {
         throwOutOfMemoryError(exec);
         return nullptr;
     }