Add a static_cast to fix a bug in ScriptValueSerializer::doReadUint64.

third_party/WebKit/Source/bindings/core/v8/ScriptValueSerializer.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef ScriptValueSerializer_h
 #define ScriptValueSerializer_h
 
+#include "base/gtest_prod_util.h"
 #include "bindings/core/v8/SerializationTag.h"
 #include "bindings/core/v8/SerializedScriptValue.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "core/CoreExport.h"
 #include "wtf/HashMap.h"
 #include "wtf/Noncopyable.h"
 #include "wtf/Vector.h"
 #include "wtf/text/WTFString.h"
 #include "wtf/typed_arrays/ArrayBufferContents.h"
 #include <v8.h>
@@ skipping 515 matching lines @@
     template<class T>
     bool doReadUintHelper(T* value)
     {
         *value = 0;
         uint8_t currentByte;
         int shift = 0;
         do {
             if (m_position >= m_length)
                 return false;
             currentByte = m_buffer[m_position++];
-            *value |= ((currentByte & SerializedScriptValue::varIntMask) << shift);
+            *value |= (static_cast<T>(currentByte & SerializedScriptValue::varIntMask) << shift);
             shift += SerializedScriptValue::varIntShift;
         } while (currentByte & (1 << SerializedScriptValue::varIntShift));
         return true;
     }
 
     bool doReadUint64(uint64_t* value);
     bool doReadNumber(double* number);
     PassRefPtr<BlobDataHandle> getOrCreateBlobDataHandle(const String& uuid, const String& type, long long size = -1);
 
     RefPtr<ScriptState> m_scriptState;
     const uint8_t* m_buffer;
     const unsigned m_length;
     unsigned m_position;
     uint32_t m_version;
     const WebBlobInfoArray* m_blobInfo;
     const BlobDataHandleMap& m_blobDataHandles;
+
+    FRIEND_TEST_ALL_PREFIXES(ScriptValueSerializerTest, Uint64Decode);
 };
 
 class CORE_EXPORT ScriptValueDeserializer {
     STACK_ALLOCATED();
     WTF_MAKE_NONCOPYABLE(ScriptValueDeserializer);
 public:
     ScriptValueDeserializer(SerializedScriptValueReader& reader, MessagePortArray* messagePorts, ArrayBufferContentsArray* arrayBufferContents, ImageBitmapContentsArray* imageBitmapContents)
         : m_reader(reader)
         , m_transferredMessagePorts(messagePorts)
         , m_arrayBufferContents(arrayBufferContents)
@@ skipping 52 matching lines @@
     ArrayBufferContentsArray* m_arrayBufferContents;
     ImageBitmapContentsArray* m_imageBitmapContents;
     Vector<v8::Local<v8::Value>> m_arrayBuffers;
     Vector<v8::Local<v8::Value>> m_imageBitmaps;
     uint32_t m_version;
 };
 
 } // namespace blink
 
 #endif // ScriptValueSerializer_h