Overflow-proof the computation of stack region end.

third_party/WebKit/Source/platform/heap/StackFrameDepth.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "platform/heap/StackFrameDepth.h"
 
 #include "public/platform/Platform.h"
 
 #if OS(WIN)
@@ skipping 24 matching lines @@
 void StackFrameDepth::enableStackLimit()
 {
 #if ENABLE(ASSERT)
     s_isEnabled = true;
 #endif
 
     static const int kStackRoomSize = 1024;
 
     size_t stackSize = getUnderestimatedStackSize();
     if (stackSize) {
-        size_t stackBase = reinterpret_cast<size_t>(getStackStart());
-        s_stackFrameLimit = stackBase - stackSize + kStackRoomSize;
+        Address stackBase = reinterpret_cast<Address>(getStackStart());
+        RELEASE_ASSERT(stackSize > static_cast<const size_t>(kStackRoomSize));
+        size_t stackRoom = stackSize - kStackRoomSize;
+        RELEASE_ASSERT(stackBase > reinterpret_cast<Address>(stackRoom));
+        s_stackFrameLimit = reinterpret_cast<uintptr_t>(stackBase - stackRoom);
         return;
     }
 
     // Fallback version
     // Allocate a 32KB object on stack and query stack frame base after it.
     char dummy[kSafeStackFrameSize];
     s_stackFrameLimit = currentStackFrameBaseOnCallee(dummy);
 
     // Assert that the stack frame can be used.
     dummy[sizeof(dummy) - 1] = 0;
@@ skipping 90 matching lines @@
     return reinterpret_cast<void*>(__readgsqword(offsetof(NT_TIB64, StackBase)));
 #else
     return reinterpret_cast<void*>(__readfsdword(offsetof(NT_TIB, StackBase)));
 #endif
 #else
 #error Unsupported getStackStart on this platform.
 #endif
 }
 
 } // namespace blink