Changeset 254600 in webkit

Timestamp:

Jan 15, 2020, 11:15:15 AM (7 years ago)

Author:

Alan Coon

Message:

Cherry-pick r254218. rdar://problem/58553153

JSArrayBufferView.h: Multiplication result converted to larger type
​https://bugs.webkit.org/show_bug.cgi?id=205943

Reviewed by Saam Barati.

Added cast to size_t to make the whole calculation size_t.

• runtime/JSArrayBufferView.h: (JSC::JSArrayBufferView::sizeOf):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@254218 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-609-branch/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSArrayBufferView.h (modified) (1 diff)

branches/safari-609-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-01-14  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r254218. rdar://problem/58553153
+
+    JSArrayBufferView.h: Multiplication result converted to larger type
+    https://bugs.webkit.org/show_bug.cgi?id=205943
+    
+    Reviewed by Saam Barati.
+    
+    Added cast to size_t to make the whole calculation size_t.
+    
+    * runtime/JSArrayBufferView.h:
+    (JSC::JSArrayBufferView::sizeOf):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@254218 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2020-01-08  Michael Saboff  <msaboff@apple.com>
+
+            JSArrayBufferView.h: Multiplication result converted to larger type
+            https://bugs.webkit.org/show_bug.cgi?id=205943
+
+            Reviewed by Saam Barati.
+
+            Added cast to size_t to make the whole calculation size_t.
+
+            * runtime/JSArrayBufferView.h:
+            (JSC::JSArrayBufferView::sizeOf):
+
 2020-01-14  Alan Coon  <alancoon@apple.com>
 

branches/safari-609-branch/Source/JavaScriptCore/runtime/JSArrayBufferView.h

@@ -109 +109 @@
     static size_t sizeOf(uint32_t length, uint32_t elementSize)
     {
-        return (length * elementSize + sizeof(EncodedJSValue) - 1)
+        return (static_cast<size_t>(length) * elementSize + sizeof(EncodedJSValue) - 1)
             & ~(sizeof(EncodedJSValue) - 1);
     }