205945 2020-01-08 11:46:37 -0800 Instruction.h: Multiplication result converted to larger type 2020-01-08 18:04:29 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff commit-queue ews-watchlist keith_miller mark.lam saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1604193 0 msaboff 2020-01-08 11:46:37 -0800 Summary: Instruction.h: Multiplication result converted to larger type: Multiplication result may overflow 'unsigned int' before it is converted to 'unsigned long'. template<typename Traits = JSOpcodeTraits> size_t size() const { auto sizeShiftAmount = this->sizeShiftAmount<Traits>(); auto prefixSize = sizeShiftAmount ? 1 : 0; auto operandSize = 1 << sizeShiftAmount; size_t sizeOfBytecode = 1; return sizeOfBytecode + (Traits::opcodeLengths[opcodeID<Traits>()] - 1) * operandSize + prefixSize; Multiplication result may overflow 'unsigned int' before it is converted to 'unsigned long'. } fix: Change operandSize to size_t. 1604194 1 msaboff 2020-01-08 11:46:53 -0800 <rdar://problem/58383287> 1604215 2 387125 msaboff 2020-01-08 12:03:33 -0800 Created attachment 387125 Patch 1604258 3 387125 msaboff 2020-01-08 13:36:51 -0800 Comment on attachment 387125 Patch cq- to work through Microsoft warning as error. 1604259 4 387135 msaboff 2020-01-08 13:38:27 -0800 Created attachment 387135 Patch to try and fix Microsoft warning. 1604279 5 387139 msaboff 2020-01-08 14:12:48 -0800 Created attachment 387139 Patch Another try to silence the Microsoft compiler. 1604305 6 387139 ysuzuki 2020-01-08 15:02:01 -0800 Comment on attachment 387139 Patch Note that this is suppressing some of alerts, but this old code never gets overflow since 1. operandSize is either of 1, 2, or 4 (Bytecode's operand size) 2. Bytecode opcode size is statically defined and never gets overflow in the last line of this code. 1604369 7 msaboff 2020-01-08 16:52:32 -0800 (In reply to Yusuke Suzuki from comment #6) > Comment on attachment 387139 [details] > Patch > > Note that this is suppressing some of alerts, but this old code never gets > overflow since > > 1. operandSize is either of 1, 2, or 4 (Bytecode's operand size) > 2. Bytecode opcode size is statically defined and never gets overflow in the > last line of this code. Agreed. 1604432 8 387139 commit-queue 2020-01-08 18:04:27 -0800 Comment on attachment 387139 Patch Clearing flags on attachment: 387139 Committed r254244: <https://trac.webkit.org/changeset/254244> 1604433 9 commit-queue 2020-01-08 18:04:29 -0800 All reviewed patches have been landed. Closing bug. 387125 2020-01-08 12:03:33 -0800 2020-01-08 13:38:27 -0800 Patch 205945.patch text/plain 1501 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjU0MjEzKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDIwLTAxLTA4ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIEluc3RydWN0aW9uLmg6IE11bHRpcGxpY2F0aW9uIHJlc3VsdCBjb252ZXJ0ZWQgdG8gbGFy Z2VyIHR5cGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTIwNTk0NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg ICogYnl0ZWNvZGUvSW5zdHJ1Y3Rpb24uaDoKKyAgICAgICAgKEpTQzo6QmFzZUluc3RydWN0aW9u OjpzaXplIGNvbnN0KToKKyAgICAgICAgQ2hhbmdlZCB0aGUgdHlwZXMgdG8gc2l6ZV90IHNvIHRo YXQgdGhlIGNvbXB1dGF0aW9uIGlzIGNvbXB1dGVkIGFjY29yZGluZ2x5LgorCisKIDIwMjAtMDEt MDggIEFsZXhleSBTaHZheWthICA8c2h2YWlrYWxlc2hAZ21haWwuY29tPgogCiAgICAgICAgIFBy b3h5J3MgW1tPd25Qcm9wZXJ0eUtleXNdXSBpcyBjb3JyZWN0IG9ubHkgaW4gUHJvcGVydHlOYW1l TW9kZTo6U3RyaW5nc0FuZFN5bWJvbHMKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRl Y29kZS9JbnN0cnVjdGlvbi5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9i eXRlY29kZS9JbnN0cnVjdGlvbi5oCShyZXZpc2lvbiAyNTQyMTApCisrKyBTb3VyY2UvSmF2YVNj cmlwdENvcmUvYnl0ZWNvZGUvSW5zdHJ1Y3Rpb24uaAkod29ya2luZyBjb3B5KQpAQCAtMTE4LDgg KzExOCw4IEBAIHB1YmxpYzoKICAgICBzaXplX3Qgc2l6ZSgpIGNvbnN0CiAgICAgewogICAgICAg ICBhdXRvIHNpemVTaGlmdEFtb3VudCA9IHRoaXMtPnNpemVTaGlmdEFtb3VudDxUcmFpdHM+KCk7 Ci0gICAgICAgIGF1dG8gcHJlZml4U2l6ZSA9IHNpemVTaGlmdEFtb3VudCA/IDEgOiAwOwotICAg ICAgICBhdXRvIG9wZXJhbmRTaXplID0gMSA8PCBzaXplU2hpZnRBbW91bnQ7CisgICAgICAgIHNp emVfdCBwcmVmaXhTaXplID0gc2l6ZVNoaWZ0QW1vdW50ID8gMSA6IDA7CisgICAgICAgIHNpemVf dCBvcGVyYW5kU2l6ZSA9IDEgPDwgc2l6ZVNoaWZ0QW1vdW50OwogICAgICAgICBzaXplX3Qgc2l6 ZU9mQnl0ZWNvZGUgPSAxOwogICAgICAgICByZXR1cm4gc2l6ZU9mQnl0ZWNvZGUgKyAoVHJhaXRz OjpvcGNvZGVMZW5ndGhzW29wY29kZUlEPFRyYWl0cz4oKV0gLSAxKSAqIG9wZXJhbmRTaXplICsg cHJlZml4U2l6ZTsKICAgICB9Cg== 387135 2020-01-08 13:38:27 -0800 2020-01-08 14:12:48 -0800 Patch to try and fix Microsoft warning. 205945-2.patch text/plain 1483 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjU0MjE5KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDIwLTAxLTA4ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIEluc3RydWN0aW9uLmg6IE11bHRpcGxpY2F0aW9uIHJlc3VsdCBjb252ZXJ0ZWQgdG8gbGFy Z2VyIHR5cGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTIwNTk0NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg ICogYnl0ZWNvZGUvSW5zdHJ1Y3Rpb24uaDoKKyAgICAgICAgKEpTQzo6QmFzZUluc3RydWN0aW9u OjpzaXplIGNvbnN0KToKKyAgICAgICAgQ2hhbmdlZCB0aGUgdHlwZXMgdG8gc2l6ZV90IHNvIHRo YXQgdGhlIGNvbXB1dGF0aW9uIGlzIGNvbXB1dGVkIGFjY29yZGluZ2x5LgorCisKIDIwMjAtMDEt MDggIE1pY2hhZWwgU2Fib2ZmICA8bXNhYm9mZkBhcHBsZS5jb20+CiAKICAgICAgICAgSlNBcnJh eUJ1ZmZlclZpZXcuaDogTXVsdGlwbGljYXRpb24gcmVzdWx0IGNvbnZlcnRlZCB0byBsYXJnZXIg dHlwZQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVjb2RlL0luc3RydWN0aW9uLmgK PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVjb2RlL0luc3RydWN0aW9u LmgJKHJldmlzaW9uIDI1NDIxMCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29kZS9J bnN0cnVjdGlvbi5oCSh3b3JraW5nIGNvcHkpCkBAIC0xMTgsOCArMTE4LDggQEAgcHVibGljOgog ICAgIHNpemVfdCBzaXplKCkgY29uc3QKICAgICB7CiAgICAgICAgIGF1dG8gc2l6ZVNoaWZ0QW1v dW50ID0gdGhpcy0+c2l6ZVNoaWZ0QW1vdW50PFRyYWl0cz4oKTsKLSAgICAgICAgYXV0byBwcmVm aXhTaXplID0gc2l6ZVNoaWZ0QW1vdW50ID8gMSA6IDA7Ci0gICAgICAgIGF1dG8gb3BlcmFuZFNp emUgPSAxIDw8IHNpemVTaGlmdEFtb3VudDsKKyAgICAgICAgc2l6ZV90IHByZWZpeFNpemUgPSBz aXplU2hpZnRBbW91bnQgPyAxIDogMDsKKyAgICAgICAgc2l6ZV90IG9wZXJhbmRTaXplID0gMVUg PDwgc2l6ZVNoaWZ0QW1vdW50OwogICAgICAgICBzaXplX3Qgc2l6ZU9mQnl0ZWNvZGUgPSAxOwog ICAgICAgICByZXR1cm4gc2l6ZU9mQnl0ZWNvZGUgKyAoVHJhaXRzOjpvcGNvZGVMZW5ndGhzW29w Y29kZUlEPFRyYWl0cz4oKV0gLSAxKSAqIG9wZXJhbmRTaXplICsgcHJlZml4U2l6ZTsKICAgICB9 Cg== 387139 2020-01-08 14:12:48 -0800 2020-01-08 18:04:27 -0800 Patch 205945-3.patch text/plain 1498 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjU0MjI0KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDIwLTAxLTA4ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIEluc3RydWN0aW9uLmg6IE11bHRpcGxpY2F0aW9uIHJlc3VsdCBjb252ZXJ0ZWQgdG8gbGFy Z2VyIHR5cGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTIwNTk0NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg ICogYnl0ZWNvZGUvSW5zdHJ1Y3Rpb24uaDoKKyAgICAgICAgKEpTQzo6QmFzZUluc3RydWN0aW9u OjpzaXplIGNvbnN0KToKKyAgICAgICAgQ2hhbmdlZCB0aGUgdHlwZXMgdG8gc2l6ZV90IHNvIHRo YXQgdGhlIGNvbXB1dGF0aW9uIGlzIGNvbXB1dGVkIGFjY29yZGluZ2x5LgorCisKIDIwMjAtMDEt MDggIE1pY2hhZWwgU2Fib2ZmICA8bXNhYm9mZkBhcHBsZS5jb20+CiAKICAgICAgICAgVHlwZVBy b2ZpbGVyLmg6IE11bHRpcGxpY2F0aW9uIHJlc3VsdCBjb252ZXJ0ZWQgdG8gbGFyZ2VyIHR5cGUK SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29kZS9JbnN0cnVjdGlvbi5oCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29kZS9JbnN0cnVjdGlvbi5oCShy ZXZpc2lvbiAyNTQyMjQpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvZGUvSW5zdHJ1 Y3Rpb24uaAkod29ya2luZyBjb3B5KQpAQCAtMTE4LDggKzExOCw4IEBAIHB1YmxpYzoKICAgICBz aXplX3Qgc2l6ZSgpIGNvbnN0CiAgICAgewogICAgICAgICBhdXRvIHNpemVTaGlmdEFtb3VudCA9 IHRoaXMtPnNpemVTaGlmdEFtb3VudDxUcmFpdHM+KCk7Ci0gICAgICAgIGF1dG8gcHJlZml4U2l6 ZSA9IHNpemVTaGlmdEFtb3VudCA/IDEgOiAwOwotICAgICAgICBhdXRvIG9wZXJhbmRTaXplID0g MSA8PCBzaXplU2hpZnRBbW91bnQ7CisgICAgICAgIHNpemVfdCBwcmVmaXhTaXplID0gc2l6ZVNo aWZ0QW1vdW50ID8gMSA6IDA7CisgICAgICAgIHNpemVfdCBvcGVyYW5kU2l6ZSA9IHN0YXRpY19j YXN0PHNpemVfdD4oMSkgPDwgc2l6ZVNoaWZ0QW1vdW50OwogICAgICAgICBzaXplX3Qgc2l6ZU9m Qnl0ZWNvZGUgPSAxOwogICAgICAgICByZXR1cm4gc2l6ZU9mQnl0ZWNvZGUgKyAoVHJhaXRzOjpv cGNvZGVMZW5ndGhzW29wY29kZUlEPFRyYWl0cz4oKV0gLSAxKSAqIG9wZXJhbmRTaXplICsgcHJl Zml4U2l6ZTsKICAgICB9Cg==