fix: overflow panic when shifting left value greater then 31 (#7792)

web-infra-dev · Sep 5, 2024 · e05fff8 · e05fff8 · rspack-bot · Sep 5, 2024
1 parent a6770d2
commit e05fff8
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 3 deletions.
diff --git a/crates/rspack_plugin_javascript/src/utils/eval/eval_binary_expr.rs b/crates/rspack_plugin_javascript/src/utils/eval/eval_binary_expr.rs
@@ -429,16 +429,34 @@ pub fn handle_const_operation(
         None
       }
     }
-    BinaryOp::BitAnd | BinaryOp::BitXor | BinaryOp::BitOr | BinaryOp::LShift | BinaryOp::RShift => {
+    BinaryOp::LShift | BinaryOp::RShift => {
+      if let Some(left_number) = left.as_int()
+        && let Some(right_number) = right.as_int()
+      {
+        // only the lower 5 bits are used when shifting, so don't do anything
+        // if the shift amount is outside [0,32)
+        if (0..32).contains(&right_number) {
+          res.set_number(match expr.op {
+            BinaryOp::LShift => left_number << right_number,
+            BinaryOp::RShift => left_number >> right_number,
+            _ => unreachable!(),
+          } as f64);
+        } else {
+          res.set_number(left_number as f64);
+        }
+        Some(res)
+      } else {
+        None
+      }
+    }
+    BinaryOp::BitAnd | BinaryOp::BitXor | BinaryOp::BitOr => {
       if let Some(left_number) = left.as_int()
         && let Some(right_number) = right.as_int()
       {
         res.set_number(match expr.op {
           BinaryOp::BitAnd => left_number & right_number,
           BinaryOp::BitXor => left_number ^ right_number,
           BinaryOp::BitOr => left_number | right_number,
-          BinaryOp::LShift => left_number << right_number,
-          BinaryOp::RShift => left_number >> right_number,
           _ => unreachable!(),
         } as f64);
         Some(res)

diff --git a/packages/rspack-test-tools/tests/normalCases/parsing/evaluate-if-binary/index.js b/packages/rspack-test-tools/tests/normalCases/parsing/evaluate-if-binary/index.js
@@ -18,6 +18,8 @@ it("should handle bit operation", () => {
   if ((1 ^ 2) !== 3) require("fail");
   if ((1 << 1) !== 2) require("fail");
   if ((2 >> 1) !== 1) require("fail");
+  if ((2 >> 32) !== 2) require("fail");
+  if ((2 << 32) !== 2) require("fail");
 });
 
 it("should handle number operation", () => {
Name	Base (2024-09-05 976f5df)	Current	Change
10000_development-mode + exec	2.22 s ± 31 ms	2.23 s ± 26 ms	+0.05 %
10000_development-mode_hmr + exec	684 ms ± 12 ms	681 ms ± 7.2 ms	-0.35 %
10000_production-mode + exec	2.84 s ± 44 ms	2.87 s ± 56 ms	+0.98 %
arco-pro_development-mode + exec	1.83 s ± 54 ms	1.84 s ± 75 ms	+0.23 %
arco-pro_development-mode_hmr + exec	435 ms ± 3 ms	435 ms ± 3.4 ms	+0.03 %
arco-pro_production-mode + exec	3.24 s ± 88 ms	3.25 s ± 67 ms	+0.24 %
arco-pro_production-mode_generate-package-json-webpack-plugin + exec	3.36 s ± 68 ms	3.32 s ± 69 ms	-1.15 %
threejs_development-mode_10x + exec	1.65 s ± 14 ms	1.67 s ± 10 ms	+1.10 %
threejs_development-mode_10x_hmr + exec	798 ms ± 4.1 ms	813 ms ± 12 ms	+1.87 %
threejs_production-mode_10x + exec	5.15 s ± 46 ms	5.19 s ± 39 ms	+0.79 %
suite	result
modernjs	❌ failure
_selftest	✅ success
nx	❌ failure
rspress	✅ success
rslib	✅ success
rsbuild	✅ success
examples	✅ success