Fix crash bug in free list when allocating write protected memory.

runtime/vm/freelist.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/freelist.h"
 
 #include <map>
 #include <utility>
 
 #include "vm/bit_set.h"
@@ skipping 25 matching lines @@
   // writable.
 }
 
 
 void FreeListElement::InitOnce() {
   ASSERT(sizeof(FreeListElement) == kObjectAlignment);
   ASSERT(OFFSET_OF(FreeListElement, tags_) == Object::tags_offset());
 }
 
 
+intptr_t FreeListElement::HeaderSizeFor(intptr_t size) {
+  if (size == 0) return 0;
+  return ((size > RawObject::SizeTag::kMaxSizeTag) ? 3 : 2) * kWordSize;
+}
+
+
 FreeList::FreeList() {
   Reset();
 }
 
 
 FreeList::~FreeList() {
   // Nothing to release.
 }
 
 
 uword FreeList::TryAllocate(intptr_t size, bool is_protected) {
   // Precondition: is_protected is false or else all free list elements are
   // in non-writable pages.
 
   // Postcondition: if allocation succeeds, the allocated block is writable.
   int index = IndexForSize(size);
   if ((index != kNumLists) && free_map_.Test(index)) {
     FreeListElement* element = DequeueElement(index);
     if (is_protected) {
       bool status =
           VirtualMemory::Protect(reinterpret_cast<void*>(element),
                                  size,
-                                 VirtualMemory::kReadWrite /*Execute*/);
+                                 VirtualMemory::kReadWrite);
       ASSERT(status);
     }
     return reinterpret_cast<uword>(element);
   }
 
   if ((index + 1) < kNumLists) {
     intptr_t next_index = free_map_.Next(index + 1);
     if (next_index != -1) {
       // Dequeue an element from the list, split and enqueue the remainder in
       // the appropriate list.
       FreeListElement* element = DequeueElement(next_index);
       if (is_protected) {
         // Make the allocated block and the header of the remainder element
         // writable.  The remainder will be non-writable if necessary after
         // the call to SplitElementAfterAndEnqueue.
         // If the remainder size is zero, only the element itself needs to
         // be made writable.
         intptr_t remainder_size = element->Size() - size;
-        intptr_t region_size = size +
-            ((remainder_size > 0) ? FreeListElement::kHeaderSize : 0);
+        intptr_t region_size =
+            size + FreeListElement::HeaderSizeFor(remainder_size);
         bool status =
             VirtualMemory::Protect(reinterpret_cast<void*>(element),
                                    region_size,
-                                   VirtualMemory::kReadWrite /*Execute*/);
+                                   VirtualMemory::kReadWrite);
         ASSERT(status);
       }
       SplitElementAfterAndEnqueue(element, size, is_protected);
       return reinterpret_cast<uword>(element);
     }
   }
 
   FreeListElement* previous = NULL;
   FreeListElement* current = free_lists_[kNumLists];
   while (current != NULL) {
     if (current->Size() >= size) {
       // Found an element large enough to hold the requested size. Dequeue,
       // split and enqueue the remainder.
+      intptr_t remainder_size = current->Size() - size;
+      intptr_t region_size =
+          size + FreeListElement::HeaderSizeFor(remainder_size);
       if (is_protected) {
         // Make the allocated block and the header of the remainder element
         // writable.  The remainder will be non-writable if necessary after
         // the call to SplitElementAfterAndEnqueue.
-        intptr_t remainder_size = current->Size() - size;
-        intptr_t region_size = size +
-            ((remainder_size > 0) ? FreeListElement::kHeaderSize : 0);
         bool status =
             VirtualMemory::Protect(reinterpret_cast<void*>(current),
                                    region_size,
-                                   VirtualMemory::kReadWrite /*Execute*/);
+                                   VirtualMemory::kReadWrite);
         ASSERT(status);
       }
+
       if (previous == NULL) {
         free_lists_[kNumLists] = current->next();
       } else {
         // If the previous free list element's next field is protected, it
         // needs to be unprotected before storing to it and reprotected
         // after.
         bool target_is_protected = false;
         uword target_address = NULL;
         if (is_protected) {
           uword writable_start = reinterpret_cast<uword>(current);
-          uword writable_end =
-              writable_start + size + FreeListElement::kHeaderSize - 1;
+          uword writable_end = writable_start + region_size - 1;
           target_address = previous->next_address();
           target_is_protected =
               !VirtualMemory::InSamePage(target_address, writable_start) &&
               !VirtualMemory::InSamePage(target_address, writable_end);
         }
         if (target_is_protected) {
           bool status =
               VirtualMemory::Protect(reinterpret_cast<void*>(target_address),
                                      kWordSize,
-                                     VirtualMemory::kReadWrite /*Execute*/);
+                                     VirtualMemory::kReadWrite);
           ASSERT(status);
         }
         previous->set_next(current->next());
         if (target_is_protected) {
           bool status =
               VirtualMemory::Protect(reinterpret_cast<void*>(target_address),
                                      kWordSize,
                                      VirtualMemory::kReadExecute);
           ASSERT(status);
         }
@@ skipping 160 matching lines @@
       !VirtualMemory::InSamePage(remainder_address - 1, remainder_address)) {
     bool status =
         VirtualMemory::Protect(reinterpret_cast<void*>(remainder_address),
                                remainder_size,
                                VirtualMemory::kReadExecute);
     ASSERT(status);
   }
 }
 
 }  // namespace dart