Chromium Code Reviews
DescriptionLinux gcc4.4 fix: stop crashing when loading flash.
sizeof(bool) is 1 byte in opt mode. We pass a pointer to a bool to a function expecting a void*. It writes 4 bytes of data to the pointer, rather than 1 byte. This corrupts the stack bordering the bool stack variable, thereby manifesting itself as a crash. In particular, we were overwriting a spilled register (which stored an object pointer) with 3 bytes worth of zeros. After returning from the function, we called into the object, which now had the wrong pointer.
BUG=http://crbug.com/20045
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=25003
Patch Set 1 #Patch Set 2 : comment #Messages
Total messages: 3 (0 generated)
|