The Static Analysis tool Coverity added that there could be uintentional integer overflow in: >> break; >> case JSGC_DECOMMIT_THRESHOLD: >> decommitThreshold = value * 1024 * 1024; >> break; and >> case JSGC_HIGH_FREQUENCY_LOW_LIMIT: >> highFrequencyLowLimitBytes_ = value * 1024 * 1024; >> if (highFrequencyLowLimitBytes_ >= highFrequencyHighLimitBytes_) >> highFrequencyHighLimitBytes_ = highFrequencyLowLimitBytes_ + 1; >> MOZ_ASSERT(highFrequencyHighLimitBytes_ > highFrequencyLowLimitBytes_); >> break; >> case JSGC_HIGH_FREQUENCY_HIGH_LIMIT: >> MOZ_ASSERT(value > 0); >> highFrequencyHighLimitBytes_ = value * 1024 * 1024; This can happen when value >= 2^12 since the result, for this we should cast value to uint64_t

Comment on attachment 8701803 [details] [diff] [review] Bug 1235041.diff Review of attachment 8701803 [details] [diff] [review]: ----------------------------------------------------------------- Looks good, thanks for the patch!