gnu/packages/patches/icecat-CVE-2015-0817.patch

   1 From cedbdf8290018fbef65458e9e438c72adf2c2775 Mon Sep 17 00:00:00 2001
   2 From: Steve Fink <sfink@mozilla.com>
   3 Date: Thu, 19 Mar 2015 15:46:24 -0700
   4 Subject: [PATCH] Bug 1145255. r=luke, a=lmandel
   5
   6 ---
   7  js/src/jit/AsmJS.cpp | 13 +++++++++++--
   8  1 file changed, 11 insertions(+), 2 deletions(-)
   9
  10 diff --git a/js/src/jit/AsmJS.cpp b/js/src/jit/AsmJS.cpp
  11 index 302b5ab..1b8eed6 100644
  12 --- a/js/src/jit/AsmJS.cpp
  13 +++ b/js/src/jit/AsmJS.cpp
  14 @@ -14,6 +14,7 @@
  15
  16  #include "jsmath.h"
  17  #include "jsprf.h"
  18 +#include "jsutil.h"
  19  #include "jsworkers.h"
  20  #include "prmjtime.h"
  21
  22 @@ -3432,9 +3433,17 @@ FoldMaskedArrayIndex(FunctionCompiler &f, ParseNode **indexExpr, int32_t *mask,
  23      if (IsLiteralOrConstInt(f, maskNode, &mask2)) {
  24          // Flag the access to skip the bounds check if the mask ensures that an 'out of
  25          // bounds' access can not occur based on the current heap length constraint.
  26 -        if (mask2 == 0 ||
  27 -            CountLeadingZeroes32(f.m().minHeapLength() - 1) <= CountLeadingZeroes32(mask2)) {
  28 +        if (mask2 == 0) {
  29              *needsBoundsCheck = NO_BOUNDS_CHECK;
  30 +        } else {
  31 +            uint32_t minHeap = f.m().minHeapLength();
  32 +            uint32_t minHeapZeroes = CountLeadingZeroes32(minHeap - 1);
  33 +            uint32_t maskZeroes = CountLeadingZeroes32(mask2);
  34 +            if ((minHeapZeroes < maskZeroes) ||
  35 +                (IsPowerOfTwo(minHeap) && minHeapZeroes == maskZeroes))
  36 +            {
  37 +                *needsBoundsCheck = NO_BOUNDS_CHECK;
  38 +            }
  39          }
  40          *mask &= mask2;
  41          *indexExpr = indexNode;
  42 --
  43 2.2.1
  44