Skip to content

Commit fcb9145

Browse files
Myles Borinsrvagg
Myles Borins
authored andcommitted
deps: backport 3a9bfec from v8 upstream
Some of the logic from `zone.cc` is found in `zone-inl.h` in this release stream. Original commit message: Fix overflow issue in Zone::New When requesting a large allocation near the end of the address space, the computation could overflow and erroneously *not* grow the Zone as required. BUG=chromium:606115 LOG=y Review-Url: https://codereview.chromium.org/1930873002 Cr-Commit-Position: refs/heads/master@{#35903} PR-URL: nodejs-private/node-private#43 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Rod Vagg <rod@vagg.org>
1 parent ffc55f7 commit fcb9145

File tree

2 files changed

+8
-2
lines changed

2 files changed

+8
-2
lines changed

deps/v8/src/zone-inl.h

+4-1
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,10 @@ inline void* Zone::New(int size) {
5555
// Check if the requested size is available without expanding.
5656
Address result = position_;
5757

58-
if (size > limit_ - position_) {
58+
const uintptr_t limit = reinterpret_cast<uintptr_t>(limit_);
59+
const uintptr_t position = reinterpret_cast<uintptr_t>(position_);
60+
// position_ > limit_ can be true after the alignment correction above.
61+
if (limit < position || size > limit - position) {
5962
result = NewExpand(size);
6063
} else {
6164
position_ += size;

deps/v8/src/zone.cc

+4-1
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,10 @@ Address Zone::NewExpand(int size) {
168168
// Make sure the requested size is already properly aligned and that
169169
// there isn't enough room in the Zone to satisfy the request.
170170
ASSERT(size == RoundDown(size, kAlignment));
171-
ASSERT(size > limit_ - position_);
171+
ASSERT(limit_ < position_ ||
172+
reinterpret_cast<uintptr_t>(limit_) -
173+
reinterpret_cast<uintptr_t>(position_) <
174+
size);
172175

173176
// Compute the new segment size. We use a 'high water mark'
174177
// strategy, where we increase the segment size every time we expand

0 commit comments

Comments
 (0)