Bug 205945 – Instruction.h: Multiplication result converted to larger type

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Michael Saboff]

Summary:
Instruction.h: Multiplication result converted to larger type: Multiplication result may overflow 'unsigned int' before it is converted to 'unsigned long'.

    template<typename Traits = JSOpcodeTraits>
    size_t size() const
    {
        auto sizeShiftAmount = this->sizeShiftAmount<Traits>();
        auto prefixSize = sizeShiftAmount ? 1 : 0;
        auto operandSize = 1 << sizeShiftAmount;
        size_t sizeOfBytecode = 1;
        return sizeOfBytecode + (Traits::opcodeLengths[opcodeID<Traits>()] - 1) * operandSize + prefixSize;
Multiplication result may overflow 'unsigned int' before it is converted to 'unsigned long'.
    }

fix: Change operandSize to size_t.

[Michael Saboff]

<rdar://problem/58383287>

[Michael Saboff]

Created attachment 387125 [details]
Patch

[Michael Saboff]

Comment on attachment 387125 [details]
Patch

cq- to work through Microsoft warning as error.

[Michael Saboff]

Created attachment 387135 [details]
Patch to try and fix Microsoft warning.

[Michael Saboff]

Created attachment 387139 [details]
Patch

Another try to silence the Microsoft compiler.

[Yusuke Suzuki]

Comment on attachment 387139 [details]
Patch

Note that this is suppressing some of alerts, but this old code never gets overflow since

1. operandSize is either of 1, 2, or 4 (Bytecode's operand size)
2. Bytecode opcode size is statically defined and never gets overflow in the last line of this code.

[Michael Saboff]

(In reply to Yusuke Suzuki from comment #6)
> Comment on attachment 387139 [details]
> Patch
> 
> Note that this is suppressing some of alerts, but this old code never gets
> overflow since
> 
> 1. operandSize is either of 1, 2, or 4 (Bytecode's operand size)
> 2. Bytecode opcode size is statically defined and never gets overflow in the
> last line of this code.

Agreed.

[WebKit Commit Bot]

Comment on attachment 387139 [details]
Patch

Clearing flags on attachment: 387139

Committed r254244: <https://trac.webkit.org/changeset/254244>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.