Fix crash bug in free list when allocating write protected memory.

runtime/vm/freelist.cc

Index: runtime/vm/freelist.cc
diff --git a/runtime/vm/freelist.cc b/runtime/vm/freelist.cc
index b5bc30dc7bf43aa46909beac9115f32737abe68c..fdeee8c8761f56785a35c3d2d5e4bc5c33ebcf79 100644
--- a/runtime/vm/freelist.cc
+++ b/runtime/vm/freelist.cc
@@ -43,6 +43,11 @@ void FreeListElement::InitOnce() {
 }
 
 
+intptr_t FreeListElement::HeaderSizeFor(intptr_t size) {
+  return ((size > RawObject::SizeTag::kMaxSizeTag) ? 3 : 2) * kWordSize;

[srdjan, 2014/02/11 21:45:40]

Could you include:
if (size == 0) return 0, and remove conditional expressions at call sites?

[siva, 2014/02/11 23:36:43]

Agree.

[Florian Schneider, 2014/02/12 11:32:35]

Done.

+}
+
+
 FreeList::FreeList() {
   Reset();
 }
@@ -65,7 +70,7 @@ uword FreeList::TryAllocate(intptr_t size, bool is_protected) {
       bool status =
           VirtualMemory::Protect(reinterpret_cast<void*>(element),
                                  size,
-                                 VirtualMemory::kReadWrite /*Execute*/);
+                                 VirtualMemory::kReadWrite);
       ASSERT(status);
     }
     return reinterpret_cast<uword>(element);
@@ -85,11 +90,12 @@ uword FreeList::TryAllocate(intptr_t size, bool is_protected) {
         // be made writable.
         intptr_t remainder_size = element->Size() - size;
         intptr_t region_size = size +
-            ((remainder_size > 0) ? FreeListElement::kHeaderSize : 0);
+            ((remainder_size > 0)
+             ? FreeListElement::HeaderSizeFor(remainder_size) : 0);
         bool status =
             VirtualMemory::Protect(reinterpret_cast<void*>(element),
                                    region_size,
-                                   VirtualMemory::kReadWrite /*Execute*/);
+                                   VirtualMemory::kReadWrite);
         ASSERT(status);
       }
       SplitElementAfterAndEnqueue(element, size, is_protected);
@@ -103,19 +109,21 @@ uword FreeList::TryAllocate(intptr_t size, bool is_protected) {
     if (current->Size() >= size) {
       // Found an element large enough to hold the requested size. Dequeue,
       // split and enqueue the remainder.
+      intptr_t remainder_size = current->Size() - size;
+      intptr_t region_size = size +
+          ((remainder_size > 0)
+           ? FreeListElement::HeaderSizeFor(remainder_size) : 0);
       if (is_protected) {
         // Make the allocated block and the header of the remainder element
         // writable.  The remainder will be non-writable if necessary after
         // the call to SplitElementAfterAndEnqueue.
-        intptr_t remainder_size = current->Size() - size;
-        intptr_t region_size = size +
-            ((remainder_size > 0) ? FreeListElement::kHeaderSize : 0);
         bool status =
             VirtualMemory::Protect(reinterpret_cast<void*>(current),
                                    region_size,
-                                   VirtualMemory::kReadWrite /*Execute*/);
+                                   VirtualMemory::kReadWrite);
         ASSERT(status);
       }
+
       if (previous == NULL) {
         free_lists_[kNumLists] = current->next();
       } else {
@@ -126,8 +134,7 @@ uword FreeList::TryAllocate(intptr_t size, bool is_protected) {
         uword target_address = NULL;
         if (is_protected) {
           uword writable_start = reinterpret_cast<uword>(current);
-          uword writable_end =
-              writable_start + size + FreeListElement::kHeaderSize - 1;
+          uword writable_end = writable_start + region_size - 1;
           target_address = previous->next_address();
           target_is_protected =
               !VirtualMemory::InSamePage(target_address, writable_start) &&
@@ -137,7 +144,7 @@ uword FreeList::TryAllocate(intptr_t size, bool is_protected) {
           bool status =
               VirtualMemory::Protect(reinterpret_cast<void*>(target_address),
                                      kWordSize,
-                                     VirtualMemory::kReadWrite /*Execute*/);
+                                     VirtualMemory::kReadWrite);
           ASSERT(status);
         }
         previous->set_next(current->next());