Summary: Instruction.h: Multiplication result converted to larger type: Multiplication result may overflow 'unsigned int' before it is converted to 'unsigned long'. template<typename Traits = JSOpcodeTraits> size_t size() const { auto sizeShiftAmount = this->sizeShiftAmount<Traits>(); auto prefixSize = sizeShiftAmount ? 1 : 0; auto operandSize = 1 << sizeShiftAmount; size_t sizeOfBytecode = 1; return sizeOfBytecode + (Traits::opcodeLengths[opcodeID<Traits>()] - 1) * operandSize + prefixSize; Multiplication result may overflow 'unsigned int' before it is converted to 'unsigned long'. } fix: Change operandSize to size_t.
<rdar://problem/58383287>
Created attachment 387125 [details] Patch
Comment on attachment 387125 [details] Patch cq- to work through Microsoft warning as error.
Created attachment 387135 [details] Patch to try and fix Microsoft warning.
Created attachment 387139 [details] Patch Another try to silence the Microsoft compiler.
Comment on attachment 387139 [details] Patch Note that this is suppressing some of alerts, but this old code never gets overflow since 1. operandSize is either of 1, 2, or 4 (Bytecode's operand size) 2. Bytecode opcode size is statically defined and never gets overflow in the last line of this code.
(In reply to Yusuke Suzuki from comment #6) > Comment on attachment 387139 [details] > Patch > > Note that this is suppressing some of alerts, but this old code never gets > overflow since > > 1. operandSize is either of 1, 2, or 4 (Bytecode's operand size) > 2. Bytecode opcode size is statically defined and never gets overflow in the > last line of this code. Agreed.
Comment on attachment 387139 [details] Patch Clearing flags on attachment: 387139 Committed r254244: <https://trac.webkit.org/changeset/254244>
All reviewed patches have been landed. Closing bug.