Large heap collection type hits assertion in Heap::allocationSizeFromSize

third_party/WebKit/Source/platform/heap/Heap.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 201 matching lines @@
     static void registerWeakTable(void* containerObject, EphemeronCallback, EphemeronCallback);
 #if ENABLE(ASSERT)
     static bool weakTableRegistered(const void*);
 #endif
 
     static inline size_t allocationSizeFromSize(size_t size)
     {
         // Check the size before computing the actual allocation size.  The
         // allocation size calculation can overflow for large sizes and the check
         // therefore has to happen before any calculation on the size.
-        RELEASE_ASSERT(size < maxHeapObjectSize);

[haraken, 2016/03/31 08:00:41]

Can we remove the maxHeapObjectSize definition?

[keishi, 2016/03/31 08:07:39]

HeapAllocator::quantizedSize is using it.

+        RELEASE_ASSERT(size < std::numeric_limits<size_t>::max() - sizeof(HeapObjectHeader));

[haraken, 2016/03/31 08:00:41]

A better assert would be:

size_t allocationSize = size + sizeof(HeapObjectHeader);
RELEASE_ASSERT(allocationSize > size);

[keishi, 2016/03/31 08:07:39]

Done.

 
         // Add space for header.
         size_t allocationSize = size + sizeof(HeapObjectHeader);
         // Align size with allocation granularity.
         allocationSize = (allocationSize + allocationMask) & ~allocationMask;
         return allocationSize;
     }
     static Address allocateOnArenaIndex(ThreadState*, size_t, int arenaIndex, size_t gcInfoIndex, const char* typeName);
     template<typename T> static Address allocate(size_t, bool eagerlySweep = false);
     template<typename T> static Address reallocate(void* previous, size_t);
@@ skipping 297 matching lines @@
 void VisitorHelper<Derived>::handleWeakCell(Visitor* self, void* object)
 {
     T** cell = reinterpret_cast<T**>(object);
     if (*cell && !ObjectAliveTrait<T>::isHeapObjectAlive(*cell))
         *cell = nullptr;
 }
 
 } // namespace blink
 
 #endif // Heap_h