chakra-core · chakrabot · Aug 13, 2016 · Aug 3, 2016 · Aug 3, 2016 · Aug 1, 2016
diff --git a/Build/Common.Build.props b/Build/Common.Build.props
@@ -20,6 +20,7 @@
       <RuntimeTypeInfo>false</RuntimeTypeInfo>
       <!-- /Zi -->
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+      <DebugInformationFormat Condition="'$(MultiProcessorCompilation)' == 'true'">OldStyle</DebugInformationFormat>
       <!-- /EHsc- -->
       <ExceptionHandling>SyncCThrow</ExceptionHandling>
       <!-- /Gz -->

diff --git a/README.md b/README.md
@@ -8,30 +8,31 @@ You can stay up-to-date on progress by following the [MSEdge developer blog](htt
 
 ## [Build Status](https://github.com/Microsoft/ChakraCore/wiki/Build-Status)
 
-|         | __Debug__ | __Test__ | __Release__ |
-|:-------:|:---------:|:--------:|:-----------:|
-| __x86__ | [![x86debug][x86dbgicon]][x86dbglink] | [![x86test][x86testicon]][x86testlink] | [![x86release][x86relicon]][x86rellink] |
-| __x64__ | [![x64debug][x64dbgicon]][x64dbglink] | [![x64test][x64testicon]][x64testlink] | [![x64release][x64relicon]][x64rellink] |
-| __arm__ | [![armdebug][armdbgicon]][armdbglink] | [![armtest][armtesticon]][armtestlink] | [![armrelease][armrelicon]][armrellink] |
-| __linux__ | [![linuxdebug][linuxdbgicon]][linuxdbglink] | [![linuxtest][linuxtesticon]][linuxtestlink] | [![linuxrelease][linuxrelicon]][linuxrellink] |
-| __linux (static)__ | [![linuxsdebug][linuxsdbgicon]][linuxsdbglink] | [![linuxstest][linuxstesticon]][linuxstestlink] | [![linuxsrelease][linuxsrelicon]][linuxsrellink] |
+|                               | __Debug__ | __Test__ | __Release__ |
+|:-----------------------------:|:---------:|:--------:|:-----------:|
+| __Windows (x64)__             | [![x64debug][x64dbgicon]][x64dbglink] | [![x64test][x64testicon]][x64testlink] | [![x64release][x64relicon]][x64rellink] |
+| __Windows (x86)__             | [![x86debug][x86dbgicon]][x86dbglink] | [![x86test][x86testicon]][x86testlink] | [![x86release][x86relicon]][x86rellink] |
+| __Windows (ARM)__             | [![armdebug][armdbgicon]][armdbglink] | [![armtest][armtesticon]][armtestlink] | [![armrelease][armrelicon]][armrellink] |
+| __Ubuntu 16.04 (x64)__        | [![linuxdebug][linuxdbgicon]][linuxdbglink] | [![linuxtest][linuxtesticon]][linuxtestlink] | [![linuxrelease][linuxrelicon]][linuxrellink] |
+| __Ubuntu 16.04 (x64 static)__ | [![linuxsdebug][linuxsdbgicon]][linuxsdbglink] | [![linuxstest][linuxstesticon]][linuxstestlink] | [![linuxsrelease][linuxsrelicon]][linuxsrellink] |
+| __OS X 10.9 (x64 static)__    | [![osxsdebug][osxsdbgicon]][osxsdbglink] | [![osxstest][osxstesticon]][osxstestlink] | [![osxsrelease][osxsrelicon]][osxsrellink] |
 
 *If you see badges reading "Build: Unknown" it is likely because a build was skipped due to changes being only in files known not to affect the health of the build.*
 
-[x86dbgicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_debug/badge/icon
-[x86dbglink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_debug/
-[x86testicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_test/badge/icon
-[x86testlink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_test/
-[x86relicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_release/badge/icon
-[x86rellink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_release/
-
 [x64dbgicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x64_debug/badge/icon
 [x64dbglink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x64_debug/
 [x64testicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x64_test/badge/icon
 [x64testlink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x64_test/
 [x64relicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x64_release/badge/icon
 [x64rellink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x64_release/
 
+[x86dbgicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_debug/badge/icon
+[x86dbglink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_debug/
+[x86testicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_test/badge/icon
+[x86testlink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_test/
+[x86relicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_release/badge/icon
+[x86rellink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/x86_release/
+
 [armdbgicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/arm_debug/badge/icon
 [armdbglink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/arm_debug/
 [armtesticon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/arm_test/badge/icon
@@ -53,6 +54,13 @@ You can stay up-to-date on progress by following the [MSEdge developer blog](htt
 [linuxsrelicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/ubuntu_linux_release_static/badge/icon
 [linuxsrellink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/ubuntu_linux_release_static/
 
+[osxsdbgicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/osx_osx_debug_static/badge/icon
+[osxsdbglink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/osx_osx_debug_static/
+[osxstesticon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/osx_osx_test_static/badge/icon
+[osxstestlink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/osx_osx_test_static/
+[osxsrelicon]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/osx_osx_release_static/badge/icon
+[osxsrellink]: http://dotnet-ci.cloudapp.net/job/Microsoft_ChakraCore/job/master/job/osx_osx_release_static/
+
 Above is a table of our rolling build status. We run additional builds on a daily basis. See [Build Status](https://github.com/Microsoft/ChakraCore/wiki/Build-Status) for the status of all builds.
 
 ## Security

diff --git a/lib/Backend/EmitBuffer.h b/lib/Backend/EmitBuffer.h
@@ -37,7 +37,7 @@ class EmitBufferManager
     void Decommit();
     void Clear();
 
-    EmitBufferAllocation* AllocateBuffer(__in size_t bytes, __deref_bcount(bytes) BYTE** ppBuffer, ushort pdataCount = 0, ushort xdataSize = 0, bool canAllocInPreReservedHeapPageSegment = false, bool isAnyJittedCode = false);
+    EmitBufferAllocation* AllocateBuffer(DECLSPEC_GUARD_OVERFLOW __in size_t bytes, __deref_bcount(bytes) BYTE** ppBuffer, ushort pdataCount = 0, ushort xdataSize = 0, bool canAllocInPreReservedHeapPageSegment = false, bool isAnyJittedCode = false);
     bool CommitBuffer(EmitBufferAllocation* allocation, __out_bcount(bytes) BYTE* destBuffer, __in size_t bytes, __in_bcount(bytes) const BYTE* sourceBuffer, __in DWORD alignPad = 0);
     bool ProtectBufferWithExecuteReadWriteForInterpreter(EmitBufferAllocation* allocation);
     bool CommitReadWriteBufferForInterpreter(EmitBufferAllocation* allocation, _In_reads_bytes_(bufferSize) BYTE* pBuffer, _In_ size_t bufferSize);
@@ -72,8 +72,8 @@ class EmitBufferManager
     ArenaAllocator * allocator;
     Js::ScriptContext * scriptContext;
 
-    EmitBufferAllocation * NewAllocation(size_t bytes, ushort pdataCount, ushort xdataSize, bool canAllocInPreReservedHeapPageSegment, bool isAnyJittedCode);
-    EmitBufferAllocation* GetBuffer(EmitBufferAllocation *allocation, __in size_t bytes, __deref_bcount(bytes) BYTE** ppBuffer);
+    EmitBufferAllocation * NewAllocation(DECLSPEC_GUARD_OVERFLOW size_t bytes, ushort pdataCount, ushort xdataSize, bool canAllocInPreReservedHeapPageSegment, bool isAnyJittedCode);
+    EmitBufferAllocation* GetBuffer(EmitBufferAllocation *allocation, DECLSPEC_GUARD_OVERFLOW __in size_t bytes, __deref_bcount(bytes) BYTE** ppBuffer);
 
     bool FinalizeAllocation(EmitBufferAllocation *allocation);
     CustomHeap::Heap allocationHeap;

diff --git a/lib/Backend/GlobHashTable.h b/lib/Backend/GlobHashTable.h
@@ -55,7 +55,7 @@ class ValueHashTable
     SListBase<HashBucket> * table;
 
 public:
-    static ValueHashTable * New(JitArenaAllocator *allocator, uint tableSize)
+    static ValueHashTable * New(JitArenaAllocator *allocator, DECLSPEC_GUARD_OVERFLOW uint tableSize)
     {
         return AllocatorNewPlus(JitArenaAllocator, allocator, (tableSize*sizeof(SListBase<HashBucket>)), ValueHashTable, allocator, tableSize);
     }

diff --git a/lib/Backend/GlobOpt.cpp b/lib/Backend/GlobOpt.cpp
@@ -21446,7 +21446,7 @@ GlobOpt::EmitMemop(Loop * loop, LoopCount *loopCount, const MemOpEmitData* emitD
                 case TyInt16:
                 case TyInt32:
                 case TyInt64:
-                    _snwprintf_s(constBuf, constBufSize, sizeof(IntConstType) == 8 ? _u("lld%") : _u("%d"), candidate->constant.u.intConst.value);
+                    _snwprintf_s(constBuf, constBufSize, sizeof(IntConstType) == 8 ? _u("%lld") : _u("%d"), candidate->constant.u.intConst.value);
                     break;
                 case TyFloat32:
                 case TyFloat64:

diff --git a/lib/Backend/GlobOptBailOut.cpp b/lib/Backend/GlobOptBailOut.cpp
@@ -240,12 +240,10 @@ GlobOpt::CaptureValues(BasicBlock *block, BailOutInfo * bailOutInfo)
     bailOutInfo->capturedValues.constantValues.Clear(this->func->m_alloc);
     bailOutConstValuesIter.SetNext(&bailOutInfo->capturedValues.constantValues);
     bailOutInfo->capturedValues.constantValues = capturedValues.constantValues;
-    capturedValues.constantValues.Reset();
 
     bailOutInfo->capturedValues.copyPropSyms.Clear(this->func->m_alloc);
     bailOutCopySymsIter.SetNext(&bailOutInfo->capturedValues.copyPropSyms);
     bailOutInfo->capturedValues.copyPropSyms = capturedValues.copyPropSyms;
-    capturedValues.copyPropSyms.Reset();
 
     if (!PHASE_OFF(Js::IncrementalBailoutPhase, func))
     {

diff --git a/lib/Backend/IR.h b/lib/Backend/IR.h
@@ -26,6 +26,14 @@ struct CapturedValues
     SListBase<ConstantStackSymValue> constantValues;           // Captured constant values during glob opt
     SListBase<CopyPropSyms> copyPropSyms;                      // Captured copy prop values during glob opt
     BVSparse<JitArenaAllocator> * argObjSyms;                  // Captured arg object symbols during glob opt
+
+    ~CapturedValues()
+    {
+        // Reset SListBase to be exception safe. Captured values are from GlobOpt->func->alloc
+        // in normal case the 2 SListBase are empty so no Clear needed, also no need to Clear in exception case
+        constantValues.Reset();
+        copyPropSyms.Reset();
+    }
 };
 
 class LoweredBasicBlock;

diff --git a/lib/Backend/Lower.cpp b/lib/Backend/Lower.cpp
@@ -13,8 +13,6 @@
 
 #include "ExternalLowerer.h"
 
-#include "ExternalLowerer.h"
-
 ///----------------------------------------------------------------------------
 ///
 /// Lowerer::Lower
@@ -8404,6 +8402,7 @@ Lowerer::LowerLdArrViewElem(IR::Instr * instr)
     IR::Opnd * src2 = instr->GetSrc2();
 
     IR::Instr * done;
+
     if (indexOpnd || m_func->GetJnFunction()->GetAsmJsFunctionInfoWithLock()->AccessNeedsBoundCheck((uint32)src1->AsIndirOpnd()->GetOffset()))
     {
         // CMP indexOpnd, src2(arrSize)
@@ -20242,7 +20241,7 @@ Lowerer::GenerateLdSuper(IR::Instr* instrInsert)
     Assert(dstOpnd->IsRegOpnd());
     LowererMD::CreateAssign(dstOpnd, opndUndefAddress, instrInsert);
 
-    IR::Opnd * functionObjOpnd;
+    IR::Opnd * functionObjOpnd = nullptr;
     m_lowererMD.LoadFunctionObjectOpnd(instrInsert, functionObjOpnd);
     LowererMD::CreateAssign(instanceRegOpnd, functionObjOpnd, instrInsert);
 

diff --git a/lib/Backend/NativeCodeData.h b/lib/Backend/NativeCodeData.h
@@ -36,8 +36,8 @@ class NativeCodeData
         Allocator();
         ~Allocator();
 
-        char * Alloc(size_t requestedBytes);
-        char * AllocZero(size_t requestedBytes);
+        char * Alloc(DECLSPEC_GUARD_OVERFLOW size_t requestedBytes);
+        char * AllocZero(DECLSPEC_GUARD_OVERFLOW size_t requestedBytes);
         NativeCodeData * Finalize();
         void Free(void * buffer, size_t byteSize);
 

diff --git a/lib/Backend/amd64/LowererMDArch.cpp b/lib/Backend/amd64/LowererMDArch.cpp
@@ -1221,7 +1221,20 @@ LowererMDArch::LoadDynamicArgumentUsingLength(IR::Instr *instr)
 IR::Instr *
 LowererMDArch::LoadDoubleHelperArgument(IR::Instr * instrInsert, IR::Opnd * opndArg)
 {
-    Assert(opndArg->IsFloat64());
+    IR::Opnd * float64Opnd;
+    if (opndArg->GetType() == TyFloat32)
+    {
+        float64Opnd = IR::RegOpnd::New(TyFloat64, m_func);
+        IR::Instr * instr = IR::Instr::New(Js::OpCode::CVTSS2SD, float64Opnd, opndArg, this->m_func);
+        instrInsert->InsertBefore(instr);
+    }
+    else
+    {
+        float64Opnd = opndArg;
+    }
+
+    Assert(opndArg->IsFloat());
+
     return LoadHelperArgument(instrInsert, opndArg);
 }
 

diff --git a/lib/Backend/arm/LowerMD.cpp b/lib/Backend/arm/LowerMD.cpp
@@ -3446,7 +3446,7 @@ bool LowererMD::GenerateFastCmXxTaggedInt(IR::Instr *instr)
         LowererMD::CreateAssign(newSrc1, src1, instr);
         src1 = newSrc1;
     }
-    else if (dst->IsEqual(src2))
+    if (dst->IsEqual(src2))
     {
         IR::RegOpnd *newSrc2 = IR::RegOpnd::New(TyMachReg, m_func);
         LowererMD::CreateAssign(newSrc2, src2, instr);

diff --git a/lib/Backend/arm/Thunks.asm b/lib/Backend/arm/Thunks.asm
@@ -14,6 +14,10 @@
     ;Js::JavascriptMethod NativeCodeGenerator::CheckCodeGen(Js::JavascriptFunction * function)
     IMPORT  |?CheckCodeGen@NativeCodeGenerator@@SAP6APAXPAVRecyclableObject@Js@@UCallInfo@3@ZZPAVScriptFunction@3@@Z|
 
+#if defined(_CONTROL_FLOW_GUARD)
+    IMPORT __guard_check_icall_fptr
+#endif
+
     TEXTAREA
 
 ;;============================================================================================================

diff --git a/lib/Common/Codex/Utf8Codex.cpp b/lib/Common/Codex/Utf8Codex.cpp
@@ -9,6 +9,16 @@
 #define _Analysis_assume_(expr)
 #endif
 
+#ifdef _MSC_VER
+//=============================
+// Disabled Warnings
+//=============================
+
+#pragma warning(push)
+
+#pragma warning(disable: 4127)  // constant expression for template parameter
+#endif
+
 extern void CodexAssert(bool condition);
 
 namespace utf8
@@ -611,3 +621,7 @@ namespace utf8
     }
 
 } // namespace utf8
+
+#ifdef _MSC_VER
+#pragma warning(pop)
+#endif
diff --git a/lib/Common/CommonPal.h b/lib/Common/CommonPal.h
@@ -27,6 +27,13 @@
     #define __forceinline inline
 #endif
 
+// Only VC compiler support overflow guard
+#if defined(__GNUC__) || defined(__clang__)
+#define DECLSPEC_GUARD_OVERFLOW
+#else // Windows
+#define DECLSPEC_GUARD_OVERFLOW __declspec(guard(overflow))
+#endif
+
 #ifdef __clang__
 #define CLANG_WNO_BEGIN_(x) \
     _Pragma("clang diagnostic push")\

diff --git a/lib/Common/ConfigFlagsList.h b/lib/Common/ConfigFlagsList.h
@@ -22,6 +22,7 @@ PHASE(All)
         PHASE(CachedScope)
         PHASE(StackFunc)
         PHASE(StackClosure)
+        PHASE(DisableStackFuncOnDeferredEscape)
         PHASE(DelayCapture)
         PHASE(DebuggerScope)
         PHASE(ByteCodeSerialization)
@@ -533,7 +534,7 @@ PHASE(All)
 #endif
 #define DEFAULT_CONFIG_ES6ToPrimitive          (false)
 #define DEFAULT_CONFIG_ES6ToLength             (false)
-#define DEFAULT_CONFIG_ES6ToStringTag          (false)
+#define DEFAULT_CONFIG_ES6ToStringTag          (true)
 #define DEFAULT_CONFIG_ES6Unicode              (true)
 #define DEFAULT_CONFIG_ES6UnicodeVerbose       (true)
 #define DEFAULT_CONFIG_ES6Unscopables          (true)

diff --git a/lib/Common/Core/AllocSizeMath.h b/lib/Common/Core/AllocSizeMath.h
@@ -10,7 +10,7 @@ class AllocSizeMath
     // Works for both 32bit and 64bit size_t arithmetic. It's also pretty
     // optimal in the cases where either left or right or both are small, compile-
     // time constants.
-    static size_t Add(size_t left, size_t right)
+    static size_t Add(DECLSPEC_GUARD_OVERFLOW size_t left, DECLSPEC_GUARD_OVERFLOW size_t right)
     {
         size_t allocSize = left + right;
         if (allocSize < left)
@@ -28,7 +28,7 @@ class AllocSizeMath
     }
 
     // Optimized for right being a constant power of 2...
-    static size_t Mul(size_t left, size_t right)
+    static size_t Mul(DECLSPEC_GUARD_OVERFLOW size_t left, DECLSPEC_GUARD_OVERFLOW size_t right)
     {
         size_t allocSize = left * right;
         if (left != (allocSize / right))

diff --git a/lib/Common/DataStructures/BaseDictionary.h b/lib/Common/DataStructures/BaseDictionary.h
@@ -1043,7 +1043,7 @@ namespace JsUtil
             entries = newEntries;
         }
 
-        __ecount(bucketCount) int *AllocateBuckets(const uint bucketCount)
+        __ecount(bucketCount) int *AllocateBuckets(DECLSPEC_GUARD_OVERFLOW const uint bucketCount)
         {
             return
                 AllocateArray<AllocatorType, int, false>(
@@ -1052,7 +1052,7 @@ namespace JsUtil
                     bucketCount);
         }
 
-        __ecount(size) EntryType * AllocateEntries(int size, const bool zeroAllocate = true)
+        __ecount(size) EntryType * AllocateEntries(DECLSPEC_GUARD_OVERFLOW int size, const bool zeroAllocate = true)
         {
             // Note that the choice of leaf/non-leaf node is decided for the EntryType on the basis of TValue. By default, if
             // TValue is a pointer, a non-leaf allocation is done. This behavior can be overridden by specializing
@@ -1080,7 +1080,7 @@ namespace JsUtil
             AllocatorFree(alloc, EntryAllocatorFuncType::GetFreeFunc(), entries, size * sizeof(EntryType));
         }
 
-        void Allocate(__deref_out_ecount(bucketCount) int** ppBuckets, __deref_out_ecount(size) EntryType** ppEntries, uint bucketCount, int size)
+        void Allocate(__deref_out_ecount(bucketCount) int** ppBuckets, __deref_out_ecount(size) EntryType** ppEntries, DECLSPEC_GUARD_OVERFLOW uint bucketCount, DECLSPEC_GUARD_OVERFLOW int size)
         {
             int *const buckets = AllocateBuckets(bucketCount);
             Assert(buckets); // no-throw allocators are currently not supported

diff --git a/lib/Common/DataStructures/FixedBitVector.h b/lib/Common/DataStructures/FixedBitVector.h
@@ -35,10 +35,10 @@ class BVFixed
     static  BVFixed *       New(TAllocator* alloc, BVFixed * initBv);
 
     template <typename TAllocator>
-    static  BVFixed *       New(BVIndex length, TAllocator* alloc, bool initialSet = false);
+    static  BVFixed *       New(DECLSPEC_GUARD_OVERFLOW BVIndex length, TAllocator* alloc, bool initialSet = false);
 
     template <typename TAllocator>
-    static  BVFixed *       NewNoThrow(BVIndex length, TAllocator* alloc, bool initialSet = false);
+    static  BVFixed *       NewNoThrow(DECLSPEC_GUARD_OVERFLOW BVIndex length, TAllocator* alloc, bool initialSet = false);
 
     template <typename TAllocator>
     void                    Delete(TAllocator * alloc);
@@ -152,14 +152,14 @@ BVFixed * BVFixed::New(TAllocator * alloc, BVFixed * initBv)
 }
 
 template <typename TAllocator>
-BVFixed * BVFixed::New(BVIndex length, TAllocator * alloc, bool initialSet)
+BVFixed * BVFixed::New(DECLSPEC_GUARD_OVERFLOW BVIndex length, TAllocator * alloc, bool initialSet)
 {
     BVFixed *result = AllocatorNewPlus(TAllocator, alloc, sizeof(BVUnit) * BVFixed::WordCount(length), BVFixed, length, initialSet);
     return result;
 }
 
 template <typename TAllocator>
-BVFixed * BVFixed::NewNoThrow(BVIndex length, TAllocator * alloc, bool initialSet)
+BVFixed * BVFixed::NewNoThrow(DECLSPEC_GUARD_OVERFLOW BVIndex length, TAllocator * alloc, bool initialSet)
 {
     BVFixed *result = AllocatorNewNoThrowPlus(TAllocator, alloc, sizeof(BVUnit) * BVFixed::WordCount(length), BVFixed, length, initialSet);
     return result;

diff --git a/lib/Common/DataStructures/HashTable.h b/lib/Common/DataStructures/HashTable.h
@@ -33,7 +33,7 @@ class HashTable
     SListBase<Bucket<T>> *  table;
 
 public:
-    static HashTable<T, TAllocator> * New(TAllocator *allocator, uint tableSize)
+    static HashTable<T, TAllocator> * New(TAllocator *allocator, DECLSPEC_GUARD_OVERFLOW uint tableSize)
     {
         return AllocatorNewPlus(TAllocator, allocator, (tableSize*sizeof(SListBase<Bucket<T>>)), HashTable, allocator, tableSize);
     }
@@ -382,7 +382,7 @@ class HashTable
 #endif
 
 protected:
-    HashTable(TAllocator * allocator, uint tableSize) : alloc(allocator), tableSize(tableSize)
+    HashTable(TAllocator * allocator, DECLSPEC_GUARD_OVERFLOW uint tableSize) : alloc(allocator), tableSize(tableSize)
     {
         Init();
 #if PROFILE_DICTIONARY

diff --git a/lib/Common/DataStructures/InternalString.h b/lib/Common/DataStructures/InternalString.h
@@ -14,10 +14,10 @@ namespace Js
 
     public:
         InternalString() : m_charLength(0), m_content(NULL), m_offset(0) { };
-        InternalString(const char16* content, charcount_t charLength, unsigned char offset = 0);
-        static InternalString* New(ArenaAllocator* alloc, const char16* content, charcount_t length);
-        static InternalString* New(Recycler* recycler, const char16* content, charcount_t length);
-        static InternalString* NewNoCopy(ArenaAllocator* alloc, const char16* content, charcount_t length);
+        InternalString(const char16* content, DECLSPEC_GUARD_OVERFLOW charcount_t charLength, unsigned char offset = 0);
+        static InternalString* New(ArenaAllocator* alloc, const char16* content, DECLSPEC_GUARD_OVERFLOW charcount_t length);
+        static InternalString* New(Recycler* recycler, const char16* content, DECLSPEC_GUARD_OVERFLOW charcount_t length);
+        static InternalString* NewNoCopy(ArenaAllocator* alloc, const char16* content, DECLSPEC_GUARD_OVERFLOW charcount_t length);
 
         inline charcount_t GetLength() const
         {