1235041 - [Static Analysis][Unintentional integer overflow] In functions GCSchedulingTunables::setParameter and GCRuntime::setParameter from jsgc.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Andi [:andi]]

The Static Analysis tool Coverity added that there could be uintentional integer overflow in:

>>        break;
>>      case JSGC_DECOMMIT_THRESHOLD:
>>        decommitThreshold = value * 1024 * 1024;
>>        break;

and 

>>      case JSGC_HIGH_FREQUENCY_LOW_LIMIT:
>>        highFrequencyLowLimitBytes_ = value * 1024 * 1024;
>>        if (highFrequencyLowLimitBytes_ >= highFrequencyHighLimitBytes_)
>>            highFrequencyHighLimitBytes_ = highFrequencyLowLimitBytes_ + 1;
>>        MOZ_ASSERT(highFrequencyHighLimitBytes_ > highFrequencyLowLimitBytes_);
>>        break;
>>      case JSGC_HIGH_FREQUENCY_HIGH_LIMIT:
>>        MOZ_ASSERT(value > 0);
>>        highFrequencyHighLimitBytes_ = value * 1024 * 1024;

This can happen when value >= 2^12 since the result, for this we should cast value to uint64_t

Comment 1

[Andi [:andi]]

Attachment: Bug 1235041.diff

Comment 2

[Jon Coppeard (:jonco)]

Comment on attachment 8701803 [details] [diff] [review]
Bug 1235041.diff

Review of attachment 8701803 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good, thanks for the patch!

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c4e6bdadd2c2

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c4e6bdadd2c2