From a113e02f162759a08ae3f7d81deafcfbb504fff0 Mon Sep 17 00:00:00 2001 From: Ben Noordhuis Date: Thu, 2 Jun 2016 18:11:28 +0200 Subject: [PATCH] deps: backport 3a9bfec from v8 upstream Original commit message: Fix overflow issue in Zone::New When requesting a large allocation near the end of the address space, the computation could overflow and erroneously *not* grow the Zone as required. BUG=chromium:606115 LOG=y Review-Url: https://codereview.chromium.org/1930873002 Cr-Commit-Position: refs/heads/master@{#35903} PR-URL: https://github.com/nodejs/node-private/pull/44 Reviewed-By: Ben Noordhuis Reviewed-By: Rod Vagg --- deps/v8/src/zone.cc | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/deps/v8/src/zone.cc b/deps/v8/src/zone.cc index 48d8c7b171d54d..0b5c163e873bde 100644 --- a/deps/v8/src/zone.cc +++ b/deps/v8/src/zone.cc @@ -83,9 +83,11 @@ void* Zone::New(int size) { #else size; #endif - - if (size_with_redzone > limit_ - position_) { - result = NewExpand(size_with_redzone); + const uintptr_t limit = reinterpret_cast(limit_); + const uintptr_t position = reinterpret_cast(position_); + // position_ > limit_ can be true after the alignment correction above. + if (limit < position || size_with_redzone > limit - position) { + result = NewExpand(size_with_redzone); } else { position_ += size_with_redzone; } @@ -202,7 +204,10 @@ Address Zone::NewExpand(int size) { // Make sure the requested size is already properly aligned and that // there isn't enough room in the Zone to satisfy the request. DCHECK(size == RoundDown(size, kAlignment)); - DCHECK(size > limit_ - position_); + DCHECK(limit_ < position_ || + reinterpret_cast(limit_) - + reinterpret_cast(position_) < + size); // Compute the new segment size. We use a 'high water mark' // strategy, where we increase the segment size every time we expand