Reland: Prevent unsafe narrowing: base/

This relands
https://chromium-review.googlesource.com/c/chromium/src/+/3717404 .

Bug: 1292951
Change-Id: I79a1d884d297903886cf3d8819f8962ba250ccb9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3727447
Commit-Queue: Peter Kasting <pkasting@chromium.org>
Auto-Submit: Peter Kasting <pkasting@chromium.org>
Reviewed-by: danakj <danakj@chromium.org>
Owners-Override: danakj <danakj@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1018684}

android_webview/browser/state_serializer.cc

@@ -318,7 +318,7 @@ bool RestoreNavigationEntryFromPickle(
 
   if (state_version >= internal::AW_STATE_VERSION_DATA_URL) {
     const char* data;
-    int size;
+    size_t size;
     if (!iterator->ReadData(&data, &size))
       return false;
     if (size > 0) {

base/debug/activity_tracker.cc

@@ -62,7 +62,7 @@ AtomicSequenceNumber g_next_id;
 // Gets the next non-zero identifier. It is only unique within a process.
 uint32_t GetNextDataId() {
   uint32_t id;
-  while ((id = g_next_id.GetNext()) == 0) {
+  while ((id = static_cast<uint32_t>(g_next_id.GetNext())) == 0) {
   }
   return id;
 }
@@ -394,9 +394,9 @@ bool ActivityUserData::CreateSnapshot(Snapshot* output_snapshot) const {
       } break;
       case BOOL_VALUE:
       case CHAR_VALUE:
-        value.short_value_ =
+        value.short_value_ = static_cast<uint64_t>(
             reinterpret_cast<std::atomic<char>*>(entry.second.memory.get())
-                ->load(std::memory_order_relaxed);
+                ->load(std::memory_order_relaxed));
         break;
       case SIGNED_VALUE:
       case UNSIGNED_VALUE:
@@ -450,18 +450,12 @@ void* ActivityUserData::Set(StringPiece name,
                             ValueType type,
                             const void* memory,
                             size_t size) {
-  DCHECK_GE(std::numeric_limits<uint8_t>::max(), name.length());
-  size = std::min(std::numeric_limits<uint16_t>::max() - (kMemoryAlignment - 1),
-                  size);
+  DCHECK_LT(name.length(), kMaxUserDataNameLength);
 
   // It's possible that no user data is being stored.
   if (!memory_)
     return nullptr;
 
-  // The storage of a name is limited so use that limit during lookup.
-  if (name.length() > kMaxUserDataNameLength)
-    name = StringPiece(name.data(), kMaxUserDataNameLength);
-
   ValueInfo* info;
   auto existing = values_.find(name);
   if (existing != values_.end()) {
@@ -484,12 +478,18 @@ void* ActivityUserData::Set(StringPiece name,
     if (base_size > available_)
       return nullptr;
 
-    // The "full size" is the size for storing the entire value.
-    size_t full_size = std::min(base_size + value_extent, available_);
+    // The "full size" is the size for storing the entire value.  This must fit
+    // into a uint16_t.
+    size_t full_size =
+        std::min({base_size + value_extent, available_,
+                  bits::AlignDown(std::numeric_limits<uint16_t>::max(),
+                                  kMemoryAlignment)});
 
     // If the value is actually a single byte, see if it can be stuffed at the
     // end of the name extent rather than wasting kMemoryAlignment bytes.
     if (size == 1 && name_extent > name_size) {
+      // This assignment is safe because `base_size` cannot be much larger than
+      // UINT8_MAX.
       full_size = base_size;
       --name_extent;
       --base_size;
@@ -513,7 +513,7 @@ void* ActivityUserData::Set(StringPiece name,
     DCHECK_EQ(END_OF_VALUES, header->type.load(std::memory_order_relaxed));
     DCHECK_EQ(0, header->value_size.load(std::memory_order_relaxed));
     header->name_size = static_cast<uint8_t>(name_size);
-    header->record_size = full_size;
+    header->record_size = static_cast<uint16_t>(full_size);
     char* name_memory = reinterpret_cast<char*>(header) + sizeof(FieldHeader);
     void* value_memory =
         reinterpret_cast<char*>(header) + sizeof(FieldHeader) + name_extent;
@@ -541,7 +541,9 @@ void* ActivityUserData::Set(StringPiece name,
   size = std::min(size, info->extent);
   info->size_ptr->store(0, std::memory_order_seq_cst);
   memcpy(info->memory, memory, size);
-  info->size_ptr->store(size, std::memory_order_release);
+  // This cast is safe because `size` <= info->extent < `full_size`, and
+  // `full_size` fits in a uint16_t.
+  info->size_ptr->store(static_cast<uint16_t>(size), std::memory_order_release);
 
   // The address of the stored value is returned so it can be re-used by the
   // caller, so long as it's done in an atomic way.
@@ -1162,7 +1164,7 @@ GlobalActivityTracker::ModuleInfoRecord::CreateFrom(
   record->age = info.age;
   memcpy(record->identifier, info.identifier, sizeof(identifier));
   memcpy(record->pickle, pickler.data(), pickler.size());
-  record->pickle_size = pickler.size();
+  record->pickle_size = checked_cast<uint16_t>(pickler.size());
   record->changes.store(0, std::memory_order_relaxed);
 
   // Initialize the owner info.
@@ -1739,14 +1741,13 @@ void ScopedActivity::ChangeActionAndInfo(uint8_t action, int32_t info) {
                     ActivityData::ForGeneric(id_, info));
 }
 
-ScopedTaskRunActivity::ScopedTaskRunActivity(
-    const void* program_counter,
-    const base::PendingTask& task)
+ScopedTaskRunActivity::ScopedTaskRunActivity(const void* program_counter,
+                                             const base::PendingTask& task)
     : GlobalActivityTracker::ScopedThreadActivity(
           program_counter,
           task.posted_from.program_counter(),
           Activity::ACT_TASK_RUN,
-          ActivityData::ForTask(task.sequence_num),
+          ActivityData::ForTask(static_cast<uint64_t>(task.sequence_num)),
           /*lock_allowed=*/true) {}
 
 ScopedLockAcquireActivity::ScopedLockAcquireActivity(

base/debug/activity_tracker.h

@@ -1137,7 +1137,7 @@ class BASE_EXPORT GlobalActivityTracker {
 
     OwningProcess owner;            // The process that created this record.
     uint64_t address;               // The base address of the module.
-    uint64_t load_time;             // Time of last load/unload.
+    int64_t load_time;              // Time of last load/unload.
     uint64_t size;                  // The size of the module in bytes.
     uint32_t timestamp;             // Opaque timestamp of the module.
     uint32_t age;                   // Opaque "age" associated with the module.

base/guid.cc

@@ -48,7 +48,7 @@ std::string GetCanonicalGUIDInternal(StringPieceType input, bool strict) {
     } else {
       if (strict ? !IsLowerHexDigit(current) : !IsHexDigit(current))
         return std::string();
-      lowercase_[i] = ToLowerASCII(current);
+      lowercase_[i] = static_cast<char>(ToLowerASCII(current));
     }
   }
 

base/logging.cc

@@ -661,7 +661,7 @@ LogMessage::LogMessage(const char* file, int line, const char* condition)
 }
 
 LogMessage::~LogMessage() {
-  size_t stack_start = stream_.tellp();
+  size_t stack_start = stream_.str().length();
 #if !defined(OFFICIAL_BUILD) && !BUILDFLAG(IS_NACL) && !defined(__UCLIBC__) && \
     !BUILDFLAG(IS_AIX)
   if (severity_ == LOGGING_FATAL && !base::debug::BeingDebugged()) {

base/memory/platform_shared_memory_mapper_win.cc

@@ -18,8 +18,8 @@ size_t GetMemorySectionSize(void* address) {
   if (!::VirtualQuery(address, &memory_info, sizeof(memory_info)))
     return 0;
   return memory_info.RegionSize -
-         (static_cast<char*>(address) -
-          static_cast<char*>(memory_info.AllocationBase));
+         static_cast<size_t>(static_cast<char*>(address) -
+                             static_cast<char*>(memory_info.AllocationBase));
 }
 }  // namespace
 

base/memory/shared_memory_mapping.cc

@@ -65,7 +65,8 @@ void SharedMemoryMapping::Unmap() {
   uint8_t* aligned_data =
       bits::AlignDown(mapped_span_.data(), SysInfo::VMAllocationGranularity());
   size_t adjusted_size =
-      mapped_span_.size() + (mapped_span_.data() - aligned_data);
+      mapped_span_.size() +
+      static_cast<size_t>(mapped_span_.data() - aligned_data);
   span<uint8_t> span_to_unmap = make_span(aligned_data, adjusted_size);
   mapper->Unmap(span_to_unmap);
 }

base/metrics/persistent_memory_allocator.cc

@@ -704,15 +704,17 @@ PersistentMemoryAllocator::Reference PersistentMemoryAllocator::AllocateImpl(
     // Don't leave a slice at the end of a page too small for anything. This
     // can result in an allocation up to two alignment-sizes greater than the
     // minimum required by requested-size + header + alignment.
-    if (page_free - size < sizeof(BlockHeader) + kAllocAlignment)
+    if (page_free - size < sizeof(BlockHeader) + kAllocAlignment) {
       size = page_free;
-
-    const uint32_t new_freeptr = freeptr + size;
-    if (new_freeptr > mem_size_) {
-      SetCorrupt();
-      return kReferenceNull;
+      if (freeptr + size > mem_size_) {
+        SetCorrupt();
+        return kReferenceNull;
+      }
     }
 
+    // This cast is safe because (freeptr + size) <= mem_size_.
+    const uint32_t new_freeptr = static_cast<uint32_t>(freeptr + size);
+
     // Save our work. Try again if another thread has completed an allocation
     // while we were processing. A "weak" exchange would be permissable here
     // because the code will just loop and try again but the above processing

base/pickle.cc

@@ -16,7 +16,7 @@
 namespace base {
 
 // static
-const int Pickle::kPayloadUnit = 64;
+const size_t Pickle::kPayloadUnit = 64;
 
 static const size_t kCapacityReadOnly = static_cast<size_t>(-1);
 
@@ -57,9 +57,8 @@ inline const char* PickleIterator::GetReadPointerAndAdvance() {
   return current_read_ptr;
 }
 
-const char* PickleIterator::GetReadPointerAndAdvance(int num_bytes) {
-  if (num_bytes < 0 ||
-      end_index_ - read_index_ < static_cast<size_t>(num_bytes)) {
+const char* PickleIterator::GetReadPointerAndAdvance(size_t num_bytes) {
+  if (num_bytes > end_index_ - read_index_) {
     read_index_ = end_index_;
     return nullptr;
   }
@@ -69,10 +68,10 @@ const char* PickleIterator::GetReadPointerAndAdvance(int num_bytes) {
 }
 
 inline const char* PickleIterator::GetReadPointerAndAdvance(
-    int num_elements,
+    size_t num_elements,
     size_t size_element) {
-  // Check for int32_t overflow.
-  int num_bytes;
+  // Check for size_t overflow.
+  size_t num_bytes;
   if (!CheckMul(num_elements, size_element).AssignIfValid(&num_bytes))
     return nullptr;
   return GetReadPointerAndAdvance(num_bytes);
@@ -139,8 +138,8 @@ bool PickleIterator::ReadDouble(double* result) {
 }
 
 bool PickleIterator::ReadString(std::string* result) {
-  int len;
-  if (!ReadInt(&len))
+  size_t len;
+  if (!ReadLength(&len))
     return false;
   const char* read_from = GetReadPointerAndAdvance(len);
   if (!read_from)
@@ -151,8 +150,8 @@ bool PickleIterator::ReadString(std::string* result) {
 }
 
 bool PickleIterator::ReadStringPiece(StringPiece* result) {
-  int len;
-  if (!ReadInt(&len))
+  size_t len;
+  if (!ReadLength(&len))
     return false;
   const char* read_from = GetReadPointerAndAdvance(len);
   if (!read_from)
@@ -163,8 +162,8 @@ bool PickleIterator::ReadStringPiece(StringPiece* result) {
 }
 
 bool PickleIterator::ReadString16(std::u16string* result) {
-  int len;
-  if (!ReadInt(&len))
+  size_t len;
+  if (!ReadLength(&len))
     return false;
   const char* read_from = GetReadPointerAndAdvance(len, sizeof(char16_t));
   if (!read_from)
@@ -175,8 +174,8 @@ bool PickleIterator::ReadString16(std::u16string* result) {
 }
 
 bool PickleIterator::ReadStringPiece16(StringPiece16* result) {
-  int len;
-  if (!ReadInt(&len))
+  size_t len;
+  if (!ReadLength(&len))
     return false;
   const char* read_from = GetReadPointerAndAdvance(len, sizeof(char16_t));
   if (!read_from)
@@ -186,11 +185,11 @@ bool PickleIterator::ReadStringPiece16(StringPiece16* result) {
   return true;
 }
 
-bool PickleIterator::ReadData(const char** data, int* length) {
+bool PickleIterator::ReadData(const char** data, size_t* length) {
   *length = 0;
   *data = nullptr;
 
-  if (!ReadInt(length))
+  if (!ReadLength(length))
     return false;
 
   return ReadBytes(data, *length);
@@ -198,7 +197,7 @@ bool PickleIterator::ReadData(const char** data, int* length) {
 
 bool PickleIterator::ReadData(base::span<const uint8_t>* data) {
   const char* ptr;
-  int length;
+  size_t length;
 
   if (!ReadData(&ptr, &length))
     return false;
@@ -207,7 +206,7 @@ bool PickleIterator::ReadData(base::span<const uint8_t>* data) {
   return true;
 }
 
-bool PickleIterator::ReadBytes(const char** data, int length) {
+bool PickleIterator::ReadBytes(const char** data, size_t length) {
   const char* read_from = GetReadPointerAndAdvance(length);
   if (!read_from)
     return false;
@@ -232,12 +231,12 @@ Pickle::Pickle()
   header_->payload_size = 0;
 }
 
-Pickle::Pickle(int header_size)
+Pickle::Pickle(size_t header_size)
     : header_(nullptr),
       header_size_(bits::AlignUp(header_size, sizeof(uint32_t))),
       capacity_after_header_(0),
       write_offset_(0) {
-  DCHECK_GE(static_cast<size_t>(header_size), sizeof(Header));
+  DCHECK_GE(header_size, sizeof(Header));
   DCHECK_LE(header_size, kPayloadUnit);
   Resize(kPayloadUnit);
   header_->payload_size = 0;
@@ -248,10 +247,10 @@ Pickle::Pickle(const char* data, size_t data_len)
       header_size_(0),
       capacity_after_header_(kCapacityReadOnly),
       write_offset_(0) {
-  if (data_len >= static_cast<int>(sizeof(Header)))
+  if (data_len >= sizeof(Header))
     header_size_ = data_len - header_->payload_size;
 
-  if (header_size_ > static_cast<unsigned int>(data_len))
+  if (header_size_ > data_len)
     header_size_ = 0;
 
   if (header_size_ != bits::AlignUp(header_size_, sizeof(uint32_t)))
@@ -301,22 +300,20 @@ Pickle& Pickle::operator=(const Pickle& other) {
 }
 
 void Pickle::WriteString(const StringPiece& value) {
-  WriteInt(static_cast<int>(value.size()));
-  WriteBytes(value.data(), static_cast<int>(value.size()));
+  WriteData(value.data(), value.size());
 }
 
 void Pickle::WriteString16(const StringPiece16& value) {
-  WriteInt(static_cast<int>(value.size()));
-  WriteBytes(value.data(), static_cast<int>(value.size()) * sizeof(char16_t));
+  WriteInt(checked_cast<int>(value.size()));
+  WriteBytes(value.data(), value.size() * sizeof(char16_t));
 }
 
-void Pickle::WriteData(const char* data, int length) {
-  DCHECK_GE(length, 0);
-  WriteInt(length);
+void Pickle::WriteData(const char* data, size_t length) {
+  WriteInt(checked_cast<int>(length));
   WriteBytes(data, length);
 }
 
-void Pickle::WriteBytes(const void* data, int length) {
+void Pickle::WriteBytes(const void* data, size_t length) {
   WriteBytesCommon(data, length);
 }
 

base/pickle.h

@@ -54,7 +54,7 @@ class BASE_EXPORT PickleIterator {
   // placed in |*length|. The pointer placed into |*data| points into the
   // message's buffer so it will be scoped to the lifetime of the message (or
   // until the message data is mutated). Do not keep the pointer around!
-  [[nodiscard]] bool ReadData(const char** data, int* length);
+  [[nodiscard]] bool ReadData(const char** data, size_t* length);
 
   // Similar, but using base::span for convenience.
   [[nodiscard]] bool ReadData(base::span<const uint8_t>* data);
@@ -64,17 +64,21 @@ class BASE_EXPORT PickleIterator {
   // pointer placed into |*data| points into the message's buffer so it will be
   // scoped to the lifetime of the message (or until the message data is
   // mutated). Do not keep the pointer around!
-  [[nodiscard]] bool ReadBytes(const char** data, int length);
+  [[nodiscard]] bool ReadBytes(const char** data, size_t length);
 
-  // A safer version of ReadInt() that checks for the result not being negative.
-  // Use it for reading the object sizes.
-  [[nodiscard]] bool ReadLength(int* result) {
-    return ReadInt(result) && *result >= 0;
+  // A version of ReadInt() that checks for the result not being negative. Use
+  // it for reading the object sizes.
+  [[nodiscard]] bool ReadLength(size_t* result) {
+    int result_int;
+    if (!ReadInt(&result_int) || result_int < 0)
+      return false;
+    *result = static_cast<size_t>(result_int);
+    return true;
   }
 
   // Skips bytes in the read buffer and returns true if there are at least
   // num_bytes available. Otherwise, does nothing and returns false.
-  [[nodiscard]] bool SkipBytes(int num_bytes) {
+  [[nodiscard]] bool SkipBytes(size_t num_bytes) {
     return !!GetReadPointerAndAdvance(num_bytes);
   }
 
@@ -94,12 +98,12 @@ class BASE_EXPORT PickleIterator {
   const char* GetReadPointerAndAdvance();
 
   // Get read pointer for |num_bytes| and advance read pointer. This method
-  // checks num_bytes for negativity and wrapping.
-  const char* GetReadPointerAndAdvance(int num_bytes);
+  // checks num_bytes for wrapping.
+  const char* GetReadPointerAndAdvance(size_t num_bytes);
 
   // Get read pointer for (num_elements * size_element) bytes and advance read
-  // pointer. This method checks for int overflow, negativity and wrapping.
-  const char* GetReadPointerAndAdvance(int num_elements,
+  // pointer. This method checks for overflow and wrapping.
+  const char* GetReadPointerAndAdvance(size_t num_elements,
                                        size_t size_element);
 
   const char* payload_;  // Start of our pickle's payload.
@@ -149,7 +153,7 @@ class BASE_EXPORT Pickle {
   // Initialize a Pickle object with the specified header size in bytes, which
   // must be greater-than-or-equal-to sizeof(Pickle::Header).  The header size
   // will be rounded up to ensure that the header size is 32bit-aligned.
-  explicit Pickle(int header_size);
+  explicit Pickle(size_t header_size);
 
   // Initializes a Pickle from a const block of data.  The data is not copied;
   // instead the data is merely referenced by this Pickle.  Only const methods
@@ -206,11 +210,11 @@ class BASE_EXPORT Pickle {
   void WriteString16(const StringPiece16& value);
   // "Data" is a blob with a length. When you read it out you will be given the
   // length. See also WriteBytes.
-  void WriteData(const char* data, int length);
+  void WriteData(const char* data, size_t length);
   // "Bytes" is a blob with no length. The caller must specify the length both
   // when reading and writing. It is normally used to serialize PoD types of a
   // known size. See also WriteData.
-  void WriteBytes(const void* data, int length);
+  void WriteBytes(const void* data, size_t length);
 
   // WriteAttachment appends |attachment| to the pickle. It returns
   // false iff the set is full or if the Pickle implementation does not support
@@ -308,7 +312,7 @@ class BASE_EXPORT Pickle {
                        size_t* pickle_size);
 
   // The allocation granularity of the payload.
-  static const int kPayloadUnit;
+  static const size_t kPayloadUnit;
 
  private:
   friend class PickleIterator;

base/pickle_fuzzer.cc

@@ -98,7 +98,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
       }
       case 13: {
         const char* data_result = nullptr;
-        int length_result = 0;
+        size_t length_result = 0;
         std::ignore = iter.ReadData(&data_result, &length_result);
         break;
       }
@@ -106,17 +106,18 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
         const char* data_result = nullptr;
         int read_length =
             data_provider.ConsumeIntegralInRange(0, kMaxReadLength);
-        std::ignore = iter.ReadBytes(&data_result, read_length);
+        std::ignore =
+            iter.ReadBytes(&data_result, static_cast<size_t>(read_length));
         break;
       }
       case 15: {
-        int result = 0;
+        size_t result = 0;
         std::ignore = iter.ReadLength(&result);
         break;
       }
       case 16: {
-        std::ignore = iter.SkipBytes(
-            data_provider.ConsumeIntegralInRange(0, kMaxSkipBytes));
+        std::ignore = iter.SkipBytes(static_cast<size_t>(
+            data_provider.ConsumeIntegralInRange(0, kMaxSkipBytes)));
         break;
       }
     }

base/pickle_unittest.cc

@@ -37,7 +37,7 @@ const char testrawstring[] = "Hello new world"; // Test raw string writing
 // Test raw char16_t writing, assumes UTF16 encoding is ANSI for alpha chars.
 const char16_t testrawstring16[] = {'A', 'l', 'o', 'h', 'a', 0};
 const char testdata[] = "AAA\0BBB\0";
-const int testdatalen = std::size(testdata) - 1;
+const size_t testdatalen = std::size(testdata) - 1;
 
 // checks that the results can be read correctly from the Pickle
 void VerifyResult(const Pickle& pickle) {
@@ -98,7 +98,7 @@ void VerifyResult(const Pickle& pickle) {
   EXPECT_EQ(testrawstring16, outstringpiece16);
 
   const char* outdata;
-  int outdatalen;
+  size_t outdatalen;
   EXPECT_TRUE(iter.ReadData(&outdata, &outdatalen));
   EXPECT_EQ(testdatalen, outdatalen);
   EXPECT_EQ(memcmp(testdata, outdata, outdatalen), 0);
@@ -442,8 +442,7 @@ TEST(PickleTest, Resize) {
   // note that any data will have a 4-byte header indicating the size
   const size_t payload_size_after_header = unit - sizeof(uint32_t);
   Pickle pickle;
-  pickle.WriteData(
-      data_ptr, static_cast<int>(payload_size_after_header - sizeof(uint32_t)));
+  pickle.WriteData(data_ptr, payload_size_after_header - sizeof(uint32_t));
   size_t cur_payload = payload_size_after_header;
 
   // note: we assume 'unit' is a power of 2
@@ -451,7 +450,7 @@ TEST(PickleTest, Resize) {
   EXPECT_EQ(pickle.payload_size(), payload_size_after_header);
 
   // fill out a full page (noting data header)
-  pickle.WriteData(data_ptr, static_cast<int>(unit - sizeof(uint32_t)));
+  pickle.WriteData(data_ptr, unit - sizeof(uint32_t));
   cur_payload += unit;
   EXPECT_EQ(unit * 2, pickle.capacity_after_header());
   EXPECT_EQ(cur_payload, pickle.payload_size());
@@ -531,9 +530,9 @@ TEST(PickleTest, ZeroLength) {
 
   PickleIterator iter(pickle);
   const char* outdata;
-  int outdatalen;
+  size_t outdatalen;
   EXPECT_TRUE(iter.ReadData(&outdata, &outdatalen));
-  EXPECT_EQ(0, outdatalen);
+  EXPECT_EQ(0u, outdatalen);
   // We can't assert that outdata is NULL.
 }
 

base/power_monitor/moving_average.cc

@@ -8,6 +8,7 @@
 #include <limits>
 
 #include "base/check_op.h"
+#include "base/numerics/clamped_math.h"
 
 namespace {
 constexpr int kIntMax = std::numeric_limits<int>::max();
@@ -34,15 +35,17 @@ void MovingAverage::AddSample(int sample) {
 }
 
 int MovingAverage::GetAverageRoundedDown() const {
-  if (Size() == 0)
+  if (Size() == 0 || uint64_t{Size()} > static_cast<uint64_t>(kInt64Max)) {
     return 0;
-  return sum_ / Size();
+  }
+  return static_cast<int>(sum_ / static_cast<int64_t>(Size()));
 }
 
 int MovingAverage::GetAverageRoundedToClosest() const {
-  if (Size() == 0)
+  if (Size() == 0 || uint64_t{Size()} > static_cast<uint64_t>(kInt64Max))
     return 0;
-  return (sum_ + Size() / 2) / Size();
+  return static_cast<int>((base::ClampedNumeric<int64_t>(sum_) + Size() / 2) /
+                          static_cast<int64_t>(Size()));
 }
 
 double MovingAverage::GetUnroundedAverage() const {

base/power_monitor/speed_limit_observer_win.cc

@@ -72,7 +72,7 @@ namespace base {
 SpeedLimitObserverWin::SpeedLimitObserverWin(
     SpeedLimitUpdateCallback speed_limit_update_callback)
     : callback_(std::move(speed_limit_update_callback)),
-      num_cpus_(SysInfo::NumberOfProcessors()),
+      num_cpus_(static_cast<size_t>(SysInfo::NumberOfProcessors())),
       moving_average_(kMovingAverageWindowSize) {
   DVLOG(1) << __func__ << "(num_CPUs=" << num_cpus() << ")";
   timer_.Start(FROM_HERE, kSampleInterval, this,
@@ -147,7 +147,8 @@ float SpeedLimitObserverWin::EstimateThrottlingLevel() {
   std::vector<PROCESSOR_POWER_INFORMATION> info(num_cpus());
   if (!NT_SUCCESS(CallNtPowerInformation(
           ProcessorInformation, nullptr, 0, &info[0],
-          sizeof(PROCESSOR_POWER_INFORMATION) * num_cpus()))) {
+          static_cast<ULONG>(sizeof(PROCESSOR_POWER_INFORMATION) *
+                             num_cpus())))) {
     return throttling_level;
   }
 
@@ -162,9 +163,9 @@ float SpeedLimitObserverWin::EstimateThrottlingLevel() {
   // any type of throttling (thermal, power-limit, PMAX etc) starts.
   int num_non_idle_cpus = 0;
   float load_fraction_total = 0.0;
-  for (int i = 0; i < num_cpus(); ++i) {
+  for (size_t i = 0; i < num_cpus(); ++i) {
     // Amount of "non-idleness" is the distance from the max idle state.
-    const int idle_diff = info[i].MaxIdleState - info[i].CurrentIdleState;
+    const auto idle_diff = info[i].MaxIdleState - info[i].CurrentIdleState;
     // Derive a value between 0.0 and 1.0 where 1.0 corresponds to max load on
     // CPU#i.
     // Example: MaxIdleState=2, CurrentIdleState=1 => (2 - 1) / 2 = 0.5.

base/power_monitor/speed_limit_observer_win.h

@@ -38,7 +38,7 @@ class BASE_EXPORT SpeedLimitObserverWin final {
   void OnTimerTick();
   float EstimateThrottlingLevel();
 
-  int num_cpus() const { return num_cpus_; }
+  size_t num_cpus() const { return num_cpus_; }
 
   const SpeedLimitUpdateCallback callback_;
 
@@ -48,7 +48,7 @@ class BASE_EXPORT SpeedLimitObserverWin final {
   // Number of logical cores in the existing physical processor.
   // Example: a processor with 6 cores which supports hyperthreading has 12
   // logical cores, hence `num_cpus_` equals 12 in this case.
-  const int num_cpus_;
+  const size_t num_cpus_;
   // A simple MA filter of size 10 is used to smooth out the speed-limit
   // value and to remove noise from short spikes in CPU load. The existing
   // sample rate is one sample per seconds but the existing choice is rather

base/rand_util.cc

@@ -25,7 +25,7 @@ uint64_t RandUint64() {
 int RandInt(int min, int max) {
   DCHECK_LE(min, max);
 
-  uint64_t range = static_cast<uint64_t>(max) - min + 1;
+  uint64_t range = static_cast<uint64_t>(max) - static_cast<uint64_t>(min) + 1;
   // |range| is at most UINT_MAX + 1, so the result of RandGenerator(range)
   // is at most UINT_MAX.  Hence it's safe to cast it from uint64_t to int64_t.
   int result =

base/sampling_heap_profiler/poisson_allocation_sampler.cc

@@ -578,7 +578,9 @@ void PoissonAllocationSampler::DoRecordAlloc(intptr_t accumulated_bytes,
     }
   }
 
-  size_t samples = accumulated_bytes / mean_interval;
+  // This cast is safe because this function is only called with a positive
+  // value of `accumulated_bytes`.
+  size_t samples = static_cast<size_t>(accumulated_bytes) / mean_interval;
   accumulated_bytes %= mean_interval;
 
   do {

base/sampling_heap_profiler/sampling_heap_profiler.cc

@@ -168,7 +168,7 @@ uint32_t SamplingHeapProfiler::Start() {
   // center around 10M bytes, which would overflow the buckets.
   base::UmaHistogramCounts10M(
       "HeapProfiling.SamplingIntervalKB",
-      poisson_allocation_sampler->SamplingInterval() / 1024);
+      static_cast<int>(poisson_allocation_sampler->SamplingInterval() / 1024));
 
   AutoLock lock(start_stop_mutex_);
   if (!running_sessions_++)

base/substring_set_matcher/substring_set_matcher.cc

@@ -239,7 +239,8 @@ void SubstringSetMatcher::InsertPatternIntoAhoCorasickTree(
   // Create new nodes if necessary.
   while (i != text_end) {
     tree_.emplace_back();
-    current_node->SetEdge(static_cast<unsigned char>(*i), tree_.size() - 1);
+    current_node->SetEdge(static_cast<unsigned char>(*i),
+                          static_cast<NodeID>(tree_.size() - 1));
     current_node = &tree_.back();
     ++i;
   }
@@ -380,13 +381,13 @@ SubstringSetMatcher::NodeID
 SubstringSetMatcher::AhoCorasickNode::GetEdgeNoInline(uint32_t label) const {
   DCHECK(edges_capacity_ != 0);
 #ifdef __SSE2__
-  const __m128i lbl = _mm_set1_epi32(label);
+  const __m128i lbl = _mm_set1_epi32(static_cast<int>(label));
   const __m128i mask = _mm_set1_epi32(0x1ff);
   for (unsigned edge_idx = 0; edge_idx < num_edges(); edge_idx += 4) {
     const __m128i four = _mm_loadu_si128(
         reinterpret_cast<const __m128i*>(&edges_.edges[edge_idx]));
     const __m128i match = _mm_cmpeq_epi32(_mm_and_si128(four, mask), lbl);
-    const uint32_t match_mask = _mm_movemask_epi8(match);
+    const uint32_t match_mask = static_cast<uint32_t>(_mm_movemask_epi8(match));
     if (match_mask != 0) {
       if (match_mask & 0x1u) {
         return edges_.edges[edge_idx].node_id;
@@ -446,6 +447,9 @@ void SubstringSetMatcher::AhoCorasickNode::SetEdge(uint32_t label,
         edges_capacity_ == 0 ? kNumInlineEdges : edges_capacity_;
     unsigned new_capacity = old_capacity * 2;
     DCHECK_EQ(0u, new_capacity % 4);
+    // TODO(pkasting): The header claims this condition holds, but I don't
+    // understand why.  If you do, please comment.
+    DCHECK_LE(new_capacity, kEmptyLabel + 1);
     AhoCorasickEdge* new_edges = new AhoCorasickEdge[new_capacity];
     memcpy(new_edges, edges(), sizeof(AhoCorasickEdge) * old_capacity);
     for (unsigned edge_idx = old_capacity; edge_idx < new_capacity;
@@ -456,8 +460,9 @@ void SubstringSetMatcher::AhoCorasickNode::SetEdge(uint32_t label,
       delete[] edges_.edges;
     }
     edges_.edges = new_edges;
-    edges_capacity_ = new_capacity;
-    num_free_edges_ = new_capacity - old_capacity;
+    // These casts are safe due to the DCHECK above.
+    edges_capacity_ = static_cast<uint16_t>(new_capacity);
+    num_free_edges_ = static_cast<uint8_t>(new_capacity - old_capacity);
   }
 
   // Insert the new edge at the end of our heap storage.

base/sync_socket_win.cc

@@ -152,7 +152,7 @@ size_t CancelableFileOperation(Function operation,
     if (!operation_ok) {
       if (::GetLastError() == ERROR_IO_PENDING) {
         HANDLE events[] = { io_event->handle(), cancel_event->handle() };
-        const int wait_result = WaitForMultipleObjects(
+        const DWORD wait_result = WaitForMultipleObjects(
             std::size(events), events, FALSE,
             timeout_in_ms == INFINITE
                 ? timeout_in_ms

base/system/sys_info_win.cc

@@ -162,8 +162,8 @@ void SysInfo::OperatingSystemVersionNumbers(int32_t* major_version,
                                             int32_t* minor_version,
                                             int32_t* bugfix_version) {
   win::OSInfo* os_info = win::OSInfo::GetInstance();
-  *major_version = os_info->version_number().major;
-  *minor_version = os_info->version_number().minor;
+  *major_version = static_cast<int32_t>(os_info->version_number().major);
+  *minor_version = static_cast<int32_t>(os_info->version_number().minor);
   *bugfix_version = 0;
 }
 

base/token.cc

@@ -33,16 +33,16 @@ absl::optional<Token> Token::FromString(StringPiece string_representation) {
     return absl::nullopt;
   }
   uint64_t words[2];
-  for (int i = 0; i < 2; i++) {
+  for (size_t i = 0; i < 2; i++) {
     uint64_t word = 0;
     // This j loop is similar to HexStringToUInt64 but we are intentionally
     // strict about case, accepting 'A' but rejecting 'a'.
-    for (int j = 0; j < 16; j++) {
+    for (size_t j = 0; j < 16; j++) {
       const char c = string_representation[(16 * i) + j];
       if (('0' <= c) && (c <= '9')) {
-        word = (word << 4) | (c - '0');
+        word = (word << 4) | static_cast<uint64_t>(c - '0');
       } else if (('A' <= c) && (c <= 'F')) {
-        word = (word << 4) | (c - 'A' + 10);
+        word = (word << 4) | static_cast<uint64_t>(c - 'A' + 10);
       } else {
         return absl::nullopt;
       }

base/trace_event/interned_args_helper.h

@@ -25,12 +25,12 @@ namespace trace_event {
 struct BASE_EXPORT TraceSourceLocation {
   const char* function_name = nullptr;
   const char* file_name = nullptr;
-  size_t line_number = 0;
+  int line_number = 0;
 
   TraceSourceLocation() = default;
   TraceSourceLocation(const char* function_name,
                       const char* file_name,
-                      size_t line_number)
+                      int line_number)
       : function_name(function_name),
         file_name(file_name),
         line_number(line_number) {}
@@ -40,7 +40,7 @@ struct BASE_EXPORT TraceSourceLocation {
   explicit TraceSourceLocation(const base::Location& location)
       : function_name(location.function_name()),
         file_name(location.file_name()),
-        line_number(static_cast<size_t>(location.line_number())) {}
+        line_number(location.line_number()) {}
 
   bool operator==(const TraceSourceLocation& other) const {
     return file_name == other.file_name &&
@@ -73,10 +73,10 @@ template <>
 struct hash<base::trace_event::TraceSourceLocation> {
   std::size_t operator()(
       const base::trace_event::TraceSourceLocation& loc) const {
-    static_assert(sizeof(base::trace_event::TraceSourceLocation) ==
-                      2 * sizeof(const char*) + sizeof(size_t),
-                  "Padding will cause uninitialized memory to be hashed.");
-    return base::FastHash(base::as_bytes(base::make_span(&loc, 1)));
+    return base::HashInts(
+        base::HashInts(reinterpret_cast<uintptr_t>(loc.file_name),
+                       reinterpret_cast<uintptr_t>(loc.function_name)),
+        static_cast<size_t>(loc.line_number));
   }
 };
 
@@ -84,10 +84,7 @@ template <>
 struct hash<base::trace_event::UnsymbolizedSourceLocation> {
   std::size_t operator()(
       const base::trace_event::UnsymbolizedSourceLocation& module) const {
-    static_assert(sizeof(base::trace_event::UnsymbolizedSourceLocation) ==
-                      2 * sizeof(uint64_t),
-                  "Padding will cause uninitialized memory to be hashed.");
-    return base::FastHash(base::as_bytes(base::make_span(&module, 1)));
+    return base::HashInts(module.mapping_id, module.rel_pc);
   }
 };
 

base/trace_event/traced_value.cc

@@ -153,7 +153,7 @@ class PickleWriter final : public TracedValue::Writer {
 
     BeginDictionary(name);
     pickle_.WriteBytes(pickle_writer->pickle_.payload(),
-                       static_cast<int>(pickle_writer->pickle_.payload_size()));
+                       pickle_writer->pickle_.payload_size());
     EndDictionary();
   }
 
@@ -163,7 +163,7 @@ class PickleWriter final : public TracedValue::Writer {
 
     BeginDictionaryWithCopiedName(name);
     pickle_.WriteBytes(pickle_writer->pickle_.payload(),
-                       static_cast<int>(pickle_writer->pickle_.payload_size()));
+                       pickle_writer->pickle_.payload_size());
     EndDictionary();
   }
 

base/trace_event/typed_macros_internal.cc

@@ -128,7 +128,7 @@ base::trace_event::TrackEventHandle CreateTrackEvent(
   if (!g_typed_event_callback)
     return base::trace_event::TrackEventHandle();
 
-  const int thread_id = static_cast<int>(base::PlatformThread::CurrentId());
+  const auto thread_id = base::PlatformThread::CurrentId();
   auto* trace_log = base::trace_event::TraceLog::GetInstance();
   DCHECK(trace_log);
 

chrome/browser/tab/web_contents_state.cc

@@ -267,10 +267,9 @@ bool ExtractNavigationEntries(
     for (int i = 0; i < entry_count; ++i) {
       // Read each SerializedNavigationEntry as a separate pickle to avoid
       // optional reads of one tab bleeding into the next tab's data.
-      int tab_navigation_data_length = 0;
+      size_t tab_navigation_data_length = 0;
       const char* tab_navigation_data = nullptr;
-      if (!iter.ReadInt(&tab_navigation_data_length) ||
-          !iter.ReadBytes(&tab_navigation_data, tab_navigation_data_length)) {
+      if (!iter.ReadData(&tab_navigation_data, &tab_navigation_data_length)) {
         LOG(ERROR) << "Failed to restore tab entry from byte array. "
                    << "(SerializedNavigationEntry size="
                    << tab_navigation_data_length << ").";

components/nacl/loader/nacl_ipc_adapter.cc

@@ -742,8 +742,8 @@ bool NaClIPCAdapter::SendCompleteMessage(const char* buffer,
   // Length of the message not including the body. The data passed to us by the
   // plugin should match that in the message header. This should have already
   // been validated by GetBufferStatus.
-  int body_len = static_cast<int>(buffer_len - sizeof(NaClMessageHeader));
-  DCHECK(body_len == static_cast<int>(header->payload_size));
+  size_t body_len = buffer_len - sizeof(NaClMessageHeader);
+  CHECK(body_len == header->payload_size);
 
   // We actually discard the flags and only copy the ones we care about. This
   // is just because message doesn't have a constructor that takes raw flags.

content/browser/renderer_host/render_widget_host_unittest.cc

@@ -795,7 +795,7 @@ class RenderWidgetHostTest : public testing::Test {
   const WebInputEvent* GetInputEventFromMessage(const IPC::Message& message) {
     base::PickleIterator iter(message);
     const char* data;
-    int data_length;
+    size_t data_length;
     if (!iter.ReadData(&data, &data_length))
       return nullptr;
     return reinterpret_cast<const WebInputEvent*>(data);

content/common/common_param_traits_unittest.cc

@@ -71,7 +71,7 @@ TEST(IPCMessageTest, Bitmap) {
   IPC::Message bad_msg(1, 2, IPC::Message::PRIORITY_NORMAL);
   // Copy the first message block over to |bad_msg|.
   const char* fixed_data;
-  int fixed_data_size;
+  size_t fixed_data_size;
   iter = base::PickleIterator(msg);
   EXPECT_TRUE(iter.ReadData(&fixed_data, &fixed_data_size));
   bad_msg.WriteData(fixed_data, fixed_data_size);

content/public/common/common_param_traits.h

@@ -65,7 +65,7 @@ struct ParamTraits<gfx::NativeWindow> {
     return iter->ReadUInt32(reinterpret_cast<uint32_t*>(r));
 #else
     const char *data;
-    int data_size = 0;
+    size_t data_size = 0;
     bool result = iter->ReadData(&data, &data_size);
     if (result && data_size == sizeof(gfx::NativeWindow)) {
       memcpy(r, data, sizeof(gfx::NativeWindow));

content/renderer/pepper/pepper_url_loader_host.cc

@@ -7,6 +7,7 @@
 #include <stddef.h>
 
 #include "base/feature_list.h"
+#include "base/numerics/safe_conversions.h"
 #include "base/strings/string_util.h"
 #include "content/public/common/content_features.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
@@ -183,7 +184,7 @@ void PepperURLLoaderHost::DidReceiveData(const char* data, int data_length) {
   UpdateProgress();
 
   auto message = std::make_unique<PpapiPluginMsg_URLLoader_SendData>();
-  message->WriteData(data, data_length);
+  message->WriteData(data, base::checked_cast<size_t>(data_length));
   SendUpdateToPlugin(std::move(message));
 }
 

extensions/renderer/user_script_set.cc

@@ -134,19 +134,17 @@ bool UserScriptSet::UpdateUserScripts(
     // Note that this is a pointer into shared memory. We don't own it. It
     // gets cleared up when the last renderer or browser process drops their
     // reference to the shared memory.
-    for (size_t j = 0; j < script->js_scripts().size(); ++j) {
-      const char* body = NULL;
-      int body_length = 0;
+    for (const auto& js_script : script->js_scripts()) {
+      const char* body = nullptr;
+      size_t body_length = 0;
       CHECK(iter.ReadData(&body, &body_length));
-      script->js_scripts()[j]->set_external_content(
-          base::StringPiece(body, body_length));
+      js_script->set_external_content(base::StringPiece(body, body_length));
     }
-    for (size_t j = 0; j < script->css_scripts().size(); ++j) {
-      const char* body = NULL;
-      int body_length = 0;
+    for (const auto& css_script : script->css_scripts()) {
+      const char* body = nullptr;
+      size_t body_length = 0;
       CHECK(iter.ReadData(&body, &body_length));
-      script->css_scripts()[j]->set_external_content(
-          base::StringPiece(body, body_length));
+      css_script->set_external_content(base::StringPiece(body, body_length));
     }
 
     if (only_inject_incognito && !script->is_incognito_enabled())

ipc/ipc_message_protobuf_utils.h

@@ -25,15 +25,14 @@ struct RepeatedFieldParamTraits {
   static bool Read(const base::Pickle* m,
                    base::PickleIterator* iter,
                    param_type* r) {
-    int size;
-    // ReadLength() checks for < 0 itself.
+    size_t size;
     if (!iter->ReadLength(&size))
       return false;
     // Avoid integer overflow / assertion failure in Reserve() function.
-    if (INT_MAX / sizeof(StorageType) <= static_cast<size_t>(size))
+    if (size > INT_MAX / sizeof(StorageType))
       return false;
     r->Reserve(size);
-    for (int i = 0; i < size; i++) {
+    for (size_t i = 0; i < size; i++) {
       if (!ReadParam(m, iter, r->Add()))
         return false;
     }

ipc/ipc_message_utils.cc

@@ -135,7 +135,7 @@ void WriteValue(const base::Value& value, int recursion, base::Pickle* pickle) {
     }
     case base::Value::Type::BINARY: {
       pickle->WriteData(reinterpret_cast<const char*>(value.GetBlob().data()),
-                        base::checked_cast<int>(value.GetBlob().size()));
+                        value.GetBlob().size());
       break;
     }
     case base::Value::Type::DICT: {
@@ -433,7 +433,7 @@ void ParamTraits<std::vector<char>>::Write(base::Pickle* m,
   if (p.empty()) {
     m->WriteData(NULL, 0);
   } else {
-    m->WriteData(&p.front(), base::checked_cast<int>(p.size()));
+    m->WriteData(&p.front(), p.size());
   }
 }
 
@@ -441,8 +441,8 @@ bool ParamTraits<std::vector<char>>::Read(const base::Pickle* m,
                                           base::PickleIterator* iter,
                                           param_type* r) {
   const char *data;
-  int data_size = 0;
-  if (!iter->ReadData(&data, &data_size) || data_size < 0)
+  size_t data_size = 0;
+  if (!iter->ReadData(&data, &data_size))
     return false;
   r->resize(data_size);
   if (data_size)
@@ -459,8 +459,7 @@ void ParamTraits<std::vector<unsigned char>>::Write(base::Pickle* m,
   if (p.empty()) {
     m->WriteData(NULL, 0);
   } else {
-    m->WriteData(reinterpret_cast<const char*>(&p.front()),
-                 base::checked_cast<int>(p.size()));
+    m->WriteData(reinterpret_cast<const char*>(&p.front()), p.size());
   }
 }
 
@@ -468,8 +467,8 @@ bool ParamTraits<std::vector<unsigned char>>::Read(const base::Pickle* m,
                                                    base::PickleIterator* iter,
                                                    param_type* r) {
   const char *data;
-  int data_size = 0;
-  if (!iter->ReadData(&data, &data_size) || data_size < 0)
+  size_t data_size = 0;
+  if (!iter->ReadData(&data, &data_size))
     return false;
   r->resize(data_size);
   if (data_size)
@@ -495,12 +494,11 @@ void ParamTraits<std::vector<bool>>::Write(base::Pickle* m,
 bool ParamTraits<std::vector<bool>>::Read(const base::Pickle* m,
                                           base::PickleIterator* iter,
                                           param_type* r) {
-  int size;
-  // ReadLength() checks for < 0 itself.
+  size_t size;
   if (!iter->ReadLength(&size))
     return false;
   r->resize(size);
-  for (int i = 0; i < size; i++) {
+  for (size_t i = 0; i < size; i++) {
     bool value;
     if (!ReadParam(m, iter, &value))
       return false;
@@ -1437,7 +1435,7 @@ void ParamTraits<Message>::Write(base::Pickle* m, const Message& p) {
   m->WriteUInt32(static_cast<uint32_t>(p.routing_id()));
   m->WriteUInt32(p.type());
   m->WriteUInt32(p.flags());
-  m->WriteData(p.payload(), static_cast<uint32_t>(p.payload_size()));
+  m->WriteData(p.payload(), p.payload_size());
 }
 
 bool ParamTraits<Message>::Read(const base::Pickle* m,
@@ -1449,7 +1447,7 @@ bool ParamTraits<Message>::Read(const base::Pickle* m,
       !iter->ReadUInt32(&flags))
     return false;
 
-  int payload_size;
+  size_t payload_size;
   const char* payload;
   if (!iter->ReadData(&payload, &payload_size))
     return false;
@@ -1492,7 +1490,7 @@ bool ParamTraits<MSG>::Read(const base::Pickle* m,
                             base::PickleIterator* iter,
                             param_type* r) {
   const char *data;
-  int data_size = 0;
+  size_t data_size = 0;
   bool result = iter->ReadData(&data, &data_size);
   if (result && data_size == sizeof(MSG)) {
     memcpy(r, data, sizeof(MSG));

ipc/ipc_message_utils.h

@@ -404,15 +404,15 @@ struct ParamTraits<std::vector<P>> {
   static bool Read(const base::Pickle* m,
                    base::PickleIterator* iter,
                    param_type* r) {
-    int size;
+    size_t size;
     // ReadLength() checks for < 0 itself.
     if (!iter->ReadLength(&size))
       return false;
     // Resizing beforehand is not safe, see BUG 1006367 for details.
-    if (INT_MAX / sizeof(P) <= static_cast<size_t>(size))
+    if (size > INT_MAX / sizeof(P))
       return false;
     r->resize(size);
-    for (int i = 0; i < size; i++) {
+    for (size_t i = 0; i < size; i++) {
       if (!ReadParam(m, iter, &(*r)[i]))
         return false;
     }
@@ -439,10 +439,10 @@ struct ParamTraits<std::set<P> > {
   static bool Read(const base::Pickle* m,
                    base::PickleIterator* iter,
                    param_type* r) {
-    int size;
+    size_t size;
     if (!iter->ReadLength(&size))
       return false;
-    for (int i = 0; i < size; ++i) {
+    for (size_t i = 0; i < size; ++i) {
       P item;
       if (!ReadParam(m, iter, &item))
         return false;
@@ -884,15 +884,14 @@ struct ParamTraits<base::StackVector<P, stack_capacity> > {
   static bool Read(const base::Pickle* m,
                    base::PickleIterator* iter,
                    param_type* r) {
-    int size;
-    // ReadLength() checks for < 0 itself.
+    size_t size;
     if (!iter->ReadLength(&size))
       return false;
     // Sanity check for the vector size.
-    if (INT_MAX / sizeof(P) <= static_cast<size_t>(size))
+    if (size > INT_MAX / sizeof(P))
       return false;
     P value;
-    for (int i = 0; i < size; i++) {
+    for (size_t i = 0; i < size; i++) {
       if (!ReadParam(m, iter, &value))
         return false;
       (*r)->push_back(value);
@@ -922,7 +921,7 @@ struct ParamTraits<base::flat_map<Key, Mapped, Compare>> {
   static bool Read(const base::Pickle* m,
                    base::PickleIterator* iter,
                    param_type* r) {
-    int size;
+    size_t size;
     if (!iter->ReadLength(&size))
       return false;
 
@@ -931,7 +930,7 @@ struct ParamTraits<base::flat_map<Key, Mapped, Compare>> {
     // serialized ones will still be handled properly.
     std::vector<typename param_type::value_type> vect;
     vect.resize(size);
-    for (int i = 0; i < size; ++i) {
+    for (size_t i = 0; i < size; ++i) {
       if (!ReadParam(m, iter, &vect[i].first))
         return false;
       if (!ReadParam(m, iter, &vect[i].second))

net/cert/x509_certificate.cc

@@ -205,14 +205,14 @@ scoped_refptr<X509Certificate> X509Certificate::CreateFromPickle(
 scoped_refptr<X509Certificate> X509Certificate::CreateFromPickleUnsafeOptions(
     base::PickleIterator* pickle_iter,
     UnsafeCreateOptions options) {
-  int chain_length = 0;
+  size_t chain_length = 0;
   if (!pickle_iter->ReadLength(&chain_length))
     return nullptr;
 
   std::vector<base::StringPiece> cert_chain;
   const char* data = nullptr;
-  int data_length = 0;
-  for (int i = 0; i < chain_length; ++i) {
+  size_t data_length = 0;
+  for (size_t i = 0; i < chain_length; ++i) {
     if (!pickle_iter->ReadData(&data, &data_length))
       return nullptr;
     cert_chain.push_back(base::StringPiece(data, data_length));

ppapi/proxy/ppapi_param_traits.cc

@@ -43,16 +43,15 @@ bool ReadVectorWithoutCopy(const base::Pickle* m,
                            base::PickleIterator* iter,
                            std::vector<T>* output) {
   // This part is just a copy of the the default ParamTraits vector Read().
-  int size;
-  // ReadLength() checks for < 0 itself.
+  size_t size;
   if (!iter->ReadLength(&size))
     return false;
   // Resizing beforehand is not safe, see BUG 1006367 for details.
-  if (INT_MAX / sizeof(T) <= static_cast<size_t>(size))
+  if (size > INT_MAX / sizeof(T))
     return false;
 
   output->reserve(size);
-  for (int i = 0; i < size; i++) {
+  for (size_t i = 0; i < size; i++) {
     T cur;
     if (!ReadParam(m, iter, &cur))
       return false;
@@ -105,7 +104,7 @@ void ParamTraits<PP_Bool>::Log(const param_type& p, std::string* l) {
 void ParamTraits<PP_NetAddress_Private>::Write(base::Pickle* m,
                                                const param_type& p) {
   WriteParam(m, p.size);
-  m->WriteBytes(p.data, static_cast<int>(p.size));
+  m->WriteBytes(p.data, p.size);
 }
 
 // static

ppapi/proxy/url_loader_resource.cc

@@ -238,7 +238,7 @@ void URLLoaderResource::OnPluginMsgSendData(
     const IPC::Message& message) {
   base::PickleIterator iter(message);
   const char* data;
-  int data_length;
+  size_t data_length;
   if (!iter.ReadData(&data, &data_length)) {
     NOTREACHED() << "Expecting data";
     return;

services/network/public/cpp/net_ipc_param_traits.cc

@@ -163,10 +163,10 @@ bool ParamTraits<net::HttpRequestHeaders>::Read(const base::Pickle* m,
                                                 base::PickleIterator* iter,
                                                 param_type* r) {
   // Sanity check.
-  int size;
+  size_t size;
   if (!iter->ReadLength(&size))
     return false;
-  for (int i = 0; i < size; ++i) {
+  for (size_t i = 0; i < size; ++i) {
     net::HttpRequestHeaders::HeaderKeyValuePair pair;
     if (!ReadParam(m, iter, &pair) ||
         !net::HttpUtil::IsValidHeaderName(pair.key) ||

skia/ext/skia_utils_base.cc

@@ -18,7 +18,7 @@
 namespace skia {
 
 bool ReadSkString(base::PickleIterator* iter, SkString* str) {
-  int reply_length;
+  size_t reply_length;
   const char* reply_text;
 
   if (!iter->ReadData(&reply_text, &reply_length))
@@ -33,7 +33,7 @@ bool ReadSkFontIdentity(base::PickleIterator* iter,
                         SkFontConfigInterface::FontIdentity* identity) {
   uint32_t reply_id;
   uint32_t reply_ttcIndex;
-  int reply_length;
+  size_t reply_length;
   const char* reply_text;
 
   if (!iter->ReadUInt32(&reply_id) ||

storage/browser/file_system/file_system_usage_cache.cc

@@ -36,7 +36,7 @@ FileSystemUsageCache::~FileSystemUsageCache() {
 const base::FilePath::CharType FileSystemUsageCache::kUsageFileName[] =
     FILE_PATH_LITERAL(".usage");
 const char FileSystemUsageCache::kUsageFileHeader[] = "FSU5";
-const int FileSystemUsageCache::kUsageFileHeaderSize = 4;
+const size_t FileSystemUsageCache::kUsageFileHeaderSize = 4;
 
 // Pickle::{Read,Write}Bool treat bool as int
 const int FileSystemUsageCache::kUsageFileSize =

storage/browser/file_system/file_system_usage_cache.h

@@ -61,7 +61,7 @@ class COMPONENT_EXPORT(STORAGE_BROWSER) FileSystemUsageCache {
   static const base::FilePath::CharType kUsageFileName[];
   static const char kUsageFileHeader[];
   static const int kUsageFileSize;
-  static const int kUsageFileHeaderSize;
+  static const size_t kUsageFileHeaderSize;
 
  private:
   // Read the size, validity and the "dirty" entry described in the .usage file.

third_party/blink/common/font_unique_name_lookup/font_table_persistence.cc

@@ -45,10 +45,10 @@ bool LoadFromFile(base::FilePath file_path,
   }
 
   const char* proto_data = nullptr;
-  int proto_length = 0;
+  size_t proto_length = 0;
 
   if (!pickle_iterator.ReadData(&proto_data, &proto_length) || !proto_data ||
-      proto_length <= 0) {
+      proto_length == 0) {
     return false;
   }
 

third_party/blink/common/page_state/page_state_serialization.cc

@@ -38,7 +38,7 @@ float g_device_scale_factor_for_testing = 0.0;
 void AppendDataToRequestBody(
     const scoped_refptr<network::ResourceRequestBody>& request_body,
     const char* data,
-    int data_length) {
+    size_t data_length) {
   request_body->AppendBytes(data, data_length);
 }
 
@@ -208,11 +208,11 @@ const int kCurrentVersion = 31;
 // PageState serialization format you almost certainly want to add/remove fields
 // in page_state.mojom rather than using these methods.
 
-void WriteData(const void* data, int length, SerializeObject* obj) {
+void WriteData(const void* data, size_t length, SerializeObject* obj) {
   obj->pickle.WriteData(static_cast<const char*>(data), length);
 }
 
-void ReadData(SerializeObject* obj, const void** data, int* length) {
+void ReadData(SerializeObject* obj, const void** data, size_t* length) {
   const char* tmp;
   if (obj->iter.ReadData(&tmp, length)) {
     *data = tmp;
@@ -253,12 +253,12 @@ void WriteReal(double data, SerializeObject* obj) {
 
 double ReadReal(SerializeObject* obj) {
   const void* tmp = nullptr;
-  int length = 0;
+  size_t length = 0;
   double value = 0.0;
   ReadData(obj, &tmp, &length);
-  if (length == static_cast<int>(sizeof(double))) {
+  if (length == sizeof(double)) {
     // Use memcpy, as tmp may not be correctly aligned.
-    memcpy(&value, tmp, sizeof(double));
+    memcpy(&value, tmp, length);
   } else {
     obj->parse_error = true;
   }
@@ -295,13 +295,8 @@ std::string ReadStdString(SerializeObject* obj) {
 
 // Pickles a std::u16string as <int length>:<char*16 data> tuple>.
 void WriteString(const std::u16string& str, SerializeObject* obj) {
-  const char16_t* data = str.data();
-  size_t length_in_bytes = str.length() * sizeof(char16_t);
-
-  CHECK_LT(length_in_bytes,
-           static_cast<size_t>(std::numeric_limits<int>::max()));
-  obj->pickle.WriteInt(length_in_bytes);
-  obj->pickle.WriteBytes(data, length_in_bytes);
+  obj->pickle.WriteData(reinterpret_cast<const char*>(str.data()),
+                        str.length() * sizeof(char16_t));
 }
 
 // If str is a null optional, this simply pickles a length of -1. Otherwise,
@@ -324,11 +319,11 @@ const char16_t* ReadStringNoCopy(SerializeObject* obj, int* num_chars) {
     return nullptr;
   }
 
-  if (length_in_bytes < 0)
+  if (length_in_bytes < 0)  // Not an error!  See WriteString(nullopt).
     return nullptr;
 
   const char* data;
-  if (!obj->iter.ReadBytes(&data, length_in_bytes)) {
+  if (!obj->iter.ReadBytes(&data, static_cast<size_t>(length_in_bytes))) {
     obj->parse_error = true;
     return nullptr;
   }
@@ -399,7 +394,7 @@ void WriteResourceRequestBody(const network::ResourceRequestBody& request_body,
       case network::DataElement::Tag::kBytes: {
         const auto& bytes = element.As<network::DataElementBytes>().bytes();
         WriteInteger(static_cast<int>(HTTPBodyElementType::kTypeData), obj);
-        WriteData(bytes.data(), static_cast<int>(bytes.size()), obj);
+        WriteData(bytes.data(), bytes.size(), obj);
         break;
       }
       case network::DataElement::Tag::kFile: {
@@ -428,9 +423,9 @@ void ReadResourceRequestBody(
         static_cast<HTTPBodyElementType>(ReadInteger(obj));
     if (type == HTTPBodyElementType::kTypeData) {
       const void* data;
-      int length = -1;
+      size_t length;
       ReadData(obj, &data, &length);
-      if (length >= 0) {
+      if (!obj->parse_error) {
         AppendDataToRequestBody(request_body, static_cast<const char*>(data),
                                 length);
       }
@@ -861,9 +856,9 @@ void ReadFrameState(mojom::FrameState* frame, ExplodedFrameState* state) {
 
 void ReadMojoPageState(SerializeObject* obj, ExplodedPageState* state) {
   const void* tmp = nullptr;
-  int length = 0;
+  size_t length = 0;
   ReadData(obj, &tmp, &length);
-  DCHECK_GT(length, 0);
+  DCHECK_GT(length, 0u);
   if (obj->parse_error)
     return;
 

ui/base/clipboard/custom_data_helper.cc

@@ -20,7 +20,7 @@ namespace {
 bool SkipString16(base::PickleIterator* iter) {
   DCHECK(iter);
 
-  int len;
+  size_t len;
   if (!iter->ReadLength(&len))
     return false;
   return iter->SkipBytes(len * sizeof(char16_t));

ui/gfx/ipc/skia/gfx_skia_param_traits.cc

@@ -65,8 +65,7 @@ void ParamTraits<SkImageInfo>::Log(const SkImageInfo& p, std::string* l) {
 void ParamTraits<SkBitmap>::Write(base::Pickle* m, const SkBitmap& p) {
   WriteParam(m, p.info());
   size_t pixel_size = p.computeByteSize();
-  m->WriteData(reinterpret_cast<const char*>(p.getPixels()),
-               static_cast<int>(pixel_size));
+  m->WriteData(reinterpret_cast<const char*>(p.getPixels()), pixel_size);
 }
 
 bool ParamTraits<SkBitmap>::Read(const base::Pickle* m,
@@ -77,15 +76,14 @@ bool ParamTraits<SkBitmap>::Read(const base::Pickle* m,
     return false;
 
   const char* bitmap_data;
-  int bitmap_data_size = 0;
+  size_t bitmap_data_size = 0;
   if (!iter->ReadData(&bitmap_data, &bitmap_data_size))
     return false;
-  // ReadData() only returns true if bitmap_data_size >= 0.
 
   if (!r->tryAllocPixels(image_info))
     return false;
 
-  if (static_cast<size_t>(bitmap_data_size) != r->computeByteSize())
+  if (bitmap_data_size != r->computeByteSize())
     return false;
   memcpy(r->getPixels(), bitmap_data, bitmap_data_size);
   return true;