Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(682)

Unified Diff: runtime/vm/intrinsifier_arm.cc

Issue 1096063002: Fix array allocation overflow check on arm/arm64/mips. (Closed) Base URL: http://dart.googlecode.com/svn/branches/bleeding_edge/dart/
Patch Set: Created 5 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: runtime/vm/intrinsifier_arm.cc
===================================================================
--- runtime/vm/intrinsifier_arm.cc (revision 45266)
+++ runtime/vm/intrinsifier_arm.cc (working copy)
@@ -211,7 +211,7 @@
\
/* R2: allocation size. */ \
__ add(R1, R0, Operand(R2)); \
zra 2015/04/21 14:55:27 adds
koda 2015/04/21 16:08:46 Done.
- __ b(&fall_through, VS); \
+ __ b(&fall_through, CS); /* Fail on unsigned overflow. */ \
\
/* Check if the allocation fits into the remaining space. */ \
/* R0: potential new object start. */ \
@@ -1653,6 +1653,7 @@
Label fail;
__ mov(R6, Operand(length_reg)); // Save the length register.
+ // TODO(koda): Protect against negative length and overflow here.
__ SmiUntag(length_reg);
const intptr_t fixed_size = sizeof(RawString) + kObjectAlignment - 1;
__ AddImmediate(length_reg, fixed_size);
@@ -1667,7 +1668,7 @@
// length_reg: allocation size.
__ adds(R1, R0, Operand(length_reg));
- __ b(&fail, VS); // Fail on overflow.
+ __ b(&fail, CS); // Fail on unsigned overflow.
// Check if the allocation fits into the remaining space.
// R0: potential new object start.

Powered by Google App Engine
This is Rietveld 408576698