<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>49816</bug_id>
          
          <creation_ts>2010-11-19 11:25:39 -0800</creation_ts>
          <short_desc>Remove a couple unneeded overflow checks</short_desc>
          <delta_ts>2010-11-29 14:06:53 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebKit Misc.</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Darin Adler">darin</reporter>
          <assigned_to name="Darin Adler">darin</assigned_to>
          <cc>ap</cc>
    
    <cc>cevans</cc>
    
    <cc>darin</cc>
    
    <cc>kling</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>311583</commentid>
    <comment_count>0</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2010-11-19 11:25:39 -0800</bug_when>
    <thetext>Remove a couple unneeded overflow checks</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>311584</commentid>
    <comment_count>1</comment_count>
      <attachid>74408</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2010-11-19 11:27:31 -0800</bug_when>
    <thetext>Created attachment 74408
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>311706</commentid>
    <comment_count>2</comment_count>
      <attachid>74408</attachid>
    <who name="Andreas Kling">kling</who>
    <bug_when>2010-11-19 14:58:42 -0800</bug_when>
    <thetext>Comment on attachment 74408
Patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>311858</commentid>
    <comment_count>3</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2010-11-19 21:02:59 -0800</bug_when>
    <thetext>+    // We need to be sure we can double the length without overflowing.
+    // Since the passed-in length is the length of an actual existing
+    // string, and we can guarantee that doesn&apos;t occupy the entire
+    // address space, we can just assert here and there&apos;s no need for
+    // a runtime check.
+    ASSERT(length &lt;= numeric_limits&lt;size_t&gt;::max() / 2);

This comment isn&apos;t sufficient for me to understand. If the existing string takes 51% of address space, why doesn&apos;t doubling that cause an overflow?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>311881</commentid>
    <comment_count>4</comment_count>
    <who name="Andreas Kling">kling</who>
    <bug_when>2010-11-19 23:11:35 -0800</bug_when>
    <thetext>(In reply to comment #3)
&gt; This comment isn&apos;t sufficient for me to understand. If the existing string takes 51% of address space, why doesn&apos;t doubling that cause an overflow?

The _existing_ string is length*2 bytes large, so we know that length*2 fits in the address space.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>312350</commentid>
    <comment_count>5</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2010-11-22 08:28:02 -0800</bug_when>
    <thetext>(In reply to comment #3)
&gt; +    // We need to be sure we can double the length without overflowing.
&gt; +    // Since the passed-in length is the length of an actual existing
&gt; +    // string, and we can guarantee that doesn&apos;t occupy the entire
&gt; +    // address space, we can just assert here and there&apos;s no need for
&gt; +    // a runtime check.
&gt; +    ASSERT(length &lt;= numeric_limits&lt;size_t&gt;::max() / 2);
&gt; 
&gt; This comment isn&apos;t sufficient for me to understand. If the existing string takes 51% of address space, why doesn&apos;t doubling that cause an overflow?

If the string’s length was the same as 51% of the address space, the string’s size would be 102% of the address space, since characters are two bytes each. I should refine the comment to make this clearer.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>314627</commentid>
    <comment_count>6</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2010-11-29 14:06:53 -0800</bug_when>
    <thetext>Committed r72831: &lt;http://trac.webkit.org/changeset/72831&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>74408</attachid>
            <date>2010-11-19 11:27:31 -0800</date>
            <delta_ts>2010-11-19 14:58:42 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-49816-20101119112729.patch</filename>
            <type>text/plain</type>
            <size>3343</size>
            <attacher name="Darin Adler">darin</attacher>
            
              <data encoding="base64">SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDcyNDIxKQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl
TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTAtMTEtMTkgIERhcmluIEFk
bGVyICA8ZGFyaW5AYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q
UyEpLgorCisgICAgICAgIFJlbW92ZSBhIGNvdXBsZSB1bm5lZWRlZCBvdmVyZmxvdyBjaGVja3MK
KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQ5ODE2CisK
KyAgICAgICAgKiB3dGYvdGV4dC9DU3RyaW5nLmNwcDoKKyAgICAgICAgKFdURjo6Q1N0cmluZzo6
aW5pdCk6IFVzZSBhbiBBU1NFUlQgaW5zdGVhZCBvZgorICAgICAgICBhbiBvdmVyZmxvdyBjaGVj
ayB3aXRoIENSQVNILgorCiAyMDEwLTExLTE4ICBTdGV2ZSBGYWxrZW5idXJnICA8c2ZhbGtlbkBh
cHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgQWRhbSBSb2Jlbi4KSW5kZXg6IEphdmFT
Y3JpcHRDb3JlL3d0Zi90ZXh0L0NTdHJpbmcuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEphdmFTY3JpcHRD
b3JlL3d0Zi90ZXh0L0NTdHJpbmcuY3BwCShyZXZpc2lvbiA3MjQxMSkKKysrIEphdmFTY3JpcHRD
b3JlL3d0Zi90ZXh0L0NTdHJpbmcuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC00OSw4ICs0OSwxMiBA
QCB2b2lkIENTdHJpbmc6OmluaXQoY29uc3QgY2hhciogc3RyLCBzaXplCiAgICAgaWYgKCFzdHIp
CiAgICAgICAgIHJldHVybjsKIAotICAgIGlmIChsZW5ndGggPj0gbnVtZXJpY19saW1pdHM8c2l6
ZV90Pjo6bWF4KCkpCi0gICAgICAgIENSQVNIKCk7CisgICAgLy8gV2UgbmVlZCB0byBiZSBzdXJl
IHdlIGNhbiBhZGQgMSB0byBsZW5ndGggd2l0aG91dCBvdmVyZmxvd2luZy4KKyAgICAvLyBTaW5j
ZSB0aGUgcGFzc2VkLWluIGxlbmd0aCBpcyB0aGUgbGVuZ3RoIG9mIGFuIGFjdHVhbCBleGlzdGlu
ZworICAgIC8vIHN0cmluZywgYW5kIHdlIGNhbiBndWFyYW50ZWUgdGhhdCBkb2Vzbid0IG9jY3Vw
eSB0aGUgZW50aXJlCisgICAgLy8gYWRkcmVzcyBzcGFjZSwgd2UgY2FuIGp1c3QgYXNzZXJ0IGhl
cmUgYW5kIHRoZXJlJ3Mgbm8gbmVlZCBmb3IKKyAgICAvLyBhIHJ1bnRpbWUgY2hlY2suCisgICAg
QVNTRVJUKGxlbmd0aCA8IG51bWVyaWNfbGltaXRzPHNpemVfdD46Om1heCgpKTsKIAogICAgIG1f
YnVmZmVyID0gQ1N0cmluZ0J1ZmZlcjo6Y3JlYXRlKGxlbmd0aCArIDEpOwogICAgIG1lbWNweSht
X2J1ZmZlci0+bXV0YWJsZURhdGEoKSwgc3RyLCBsZW5ndGgpOyAKSW5kZXg6IFdlYkNvcmUvQ2hh
bmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9nCShyZXZpc2lvbiA3MjQyMSkK
KysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIw
MTAtMTEtMTkgIERhcmluIEFkbGVyICA8ZGFyaW5AYXBwbGUuY29tPgorCisgICAgICAgIFJldmll
d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFJlbW92ZSBhIGNvdXBsZSB1bm5lZWRl
ZCBvdmVyZmxvdyBjaGVja3MKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i
dWcuY2dpP2lkPTQ5ODE2CisKKyAgICAgICAgKiBwbGF0Zm9ybS90ZXh0L1RleHRDb2RlY1VURjE2
LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlRleHRDb2RlY1VURjE2OjplbmNvZGUpOiBVc2UgYW4g
QVNTRVJUIGluc3RlYWQgb2YKKyAgICAgICAgYW4gb3ZlcmZsb3cgY2hlY2sgd2l0aCBDUkFTSC4K
KwogMjAxMC0xMS0xOSAgU3RldmUgRmFsa2VuYnVyZyAgPHNmYWxrZW5AYXBwbGUuY29tPgogCiAg
ICAgICAgIFdpbmRvd3MgYnVpbGQgZml4LiBSZW1vdmUgbGVmdG92ZXIgRGVidWdfSW50ZXJuYWwg
dXNlLgpJbmRleDogV2ViQ29yZS9wbGF0Zm9ybS90ZXh0L1RleHRDb2RlY1VURjE2LmNwcAo9PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09Ci0tLSBXZWJDb3JlL3BsYXRmb3JtL3RleHQvVGV4dENvZGVjVVRGMTYuY3BwCShyZXZp
c2lvbiA3MjQxMSkKKysrIFdlYkNvcmUvcGxhdGZvcm0vdGV4dC9UZXh0Q29kZWNVVEYxNi5jcHAJ
KHdvcmtpbmcgY29weSkKQEAgLTEsNSArMSw1IEBACiAvKgotICogQ29weXJpZ2h0IChDKSAyMDA0
LCAyMDA2LCAyMDA4IEFwcGxlIEluYy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KKyAqIENvcHlyaWdo
dCAoQykgMjAwNCwgMjAwNiwgMjAwOCwgMjAxMCBBcHBsZSBJbmMuIEFsbCByaWdodHMgcmVzZXJ2
ZWQuCiAgKgogICogUmVkaXN0cmlidXRpb24gYW5kIHVzZSBpbiBzb3VyY2UgYW5kIGJpbmFyeSBm
b3Jtcywgd2l0aCBvciB3aXRob3V0CiAgKiBtb2RpZmljYXRpb24sIGFyZSBwZXJtaXR0ZWQgcHJv
dmlkZWQgdGhhdCB0aGUgZm9sbG93aW5nIGNvbmRpdGlvbnMKQEAgLTExNyw4ICsxMTcsMTIgQEAg
U3RyaW5nIFRleHRDb2RlY1VURjE2OjpkZWNvZGUoY29uc3QgY2hhcgogCiBDU3RyaW5nIFRleHRD
b2RlY1VURjE2OjplbmNvZGUoY29uc3QgVUNoYXIqIGNoYXJhY3RlcnMsIHNpemVfdCBsZW5ndGgs
IFVuZW5jb2RhYmxlSGFuZGxpbmcpCiB7Ci0gICAgaWYgKGxlbmd0aCA+IG51bWVyaWNfbGltaXRz
PHNpemVfdD46Om1heCgpIC8gMikKLSAgICAgICAgQ1JBU0goKTsKKyAgICAvLyBXZSBuZWVkIHRv
IGJlIHN1cmUgd2UgY2FuIGRvdWJsZSB0aGUgbGVuZ3RoIHdpdGhvdXQgb3ZlcmZsb3dpbmcuCisg
ICAgLy8gU2luY2UgdGhlIHBhc3NlZC1pbiBsZW5ndGggaXMgdGhlIGxlbmd0aCBvZiBhbiBhY3R1
YWwgZXhpc3RpbmcKKyAgICAvLyBzdHJpbmcsIGFuZCB3ZSBjYW4gZ3VhcmFudGVlIHRoYXQgZG9l
c24ndCBvY2N1cHkgdGhlIGVudGlyZQorICAgIC8vIGFkZHJlc3Mgc3BhY2UsIHdlIGNhbiBqdXN0
IGFzc2VydCBoZXJlIGFuZCB0aGVyZSdzIG5vIG5lZWQgZm9yCisgICAgLy8gYSBydW50aW1lIGNo
ZWNrLgorICAgIEFTU0VSVChsZW5ndGggPD0gbnVtZXJpY19saW1pdHM8c2l6ZV90Pjo6bWF4KCkg
LyAyKTsKIAogICAgIGNoYXIqIGJ5dGVzOwogICAgIENTdHJpbmcgc3RyaW5nID0gQ1N0cmluZzo6
bmV3VW5pbml0aWFsaXplZChsZW5ndGggKiAyLCBieXRlcyk7Cg==
</data>
<flag name="review"
          id="65003"
          type_id="1"
          status="+"
          setter="kling"
    />
          </attachment>
      

    </bug>

</bugzilla>