Rephrase Chunk::sortIntoBins() for more clarity

Assigning -1 to a quintptr so that it later overflows in another place
when adding 1 warrants a comment. Also, assert against i overflowing the
bitmaps.

This way coverity might also understand what we are doing.

Coverity-Id: 175402
Pick-to: 5.15
Pick-to: 5.12
Change-Id: I212110cbb784f89b1865bd0c0cc775c08cd40c04
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>

1 files changed, 7 insertions, 4 deletions

diff --git a/src/qml/memory/qv4mm.cpp b/src/qml/memory/qv4mm.cpp
index 3ed1bc48fd..06caf04e5a 100644
--- a/src/qml/memory/qv4mm.cpp
+++ b/src/qml/memory/qv4mm.cpp
@@ -479,12 +479,15 @@ void Chunk::sortIntoBins(HeapItem **bins, uint nBins)
             uint freeStart = i*Bits + index;
             usedSlots &= ~((static_cast<quintptr>(1) << index) - 1);
             while (!usedSlots) {
-                ++i;
-                if (i == EntriesInBitmap) {
-                    usedSlots = (quintptr)-1;
+                if (++i < EntriesInBitmap) {
+                    usedSlots = (objectBitmap[i]|extendsBitmap[i]);
+                } else {
+                    Q_ASSERT(i == EntriesInBitmap);
+                    // Overflows to 0 when counting trailing zeroes above in next iteration.
+                    // Then, all the bits are zeroes and we break.
+                    usedSlots = std::numeric_limits<quintptr>::max();
                     break;
                 }
-                usedSlots = (objectBitmap[i]|extendsBitmap[i]);
 #ifndef QT_NO_DEBUG
                 allocatedSlots += qPopulationCount(usedSlots);
 //                qDebug() << hex << "   i=" << i << "used=" << usedSlots;