Bug 205947

Summary: TypeProfiler.h: Multiplication result converted to larger type
Product: WebKit Reporter: Michael Saboff <msaboff>
Component: JavaScriptCoreAssignee: Michael Saboff <msaboff>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, ews-watchlist, keith_miller, mark.lam, saam, tzagallo, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Description Michael Saboff 2020-01-08 11:52:39 PST
Summary:
TypeProfiler.h: Multiplication result converted to larger type: Multiplication result may overflow 'unsigned int' before it is converted to 'unsigned long'.

    unsigned hash() const 
    { 
        unsigned hash = m_sourceID + m_divot * m_searchDescriptor;
Multiplication result may overflow 'unsigned int' before it is converted to 'long'.
        return hash;
    }

fix: fix cast m_sourceID to unsigned or cast the whole result to unsigned.
Comment 1 Michael Saboff 2020-01-08 11:52:47 PST
<rdar://problem/58383288>
Comment 2 Michael Saboff 2020-01-08 13:25:23 PST
Created attachment 387131 [details]
Patch
Comment 3 WebKit Commit Bot 2020-01-08 14:04:16 PST
Comment on attachment 387131 [details]
Patch

Clearing flags on attachment: 387131

Committed r254224: <https://trac.webkit.org/changeset/254224>
Comment 4 WebKit Commit Bot 2020-01-08 14:04:17 PST
All reviewed patches have been landed.  Closing bug.