| Index: third_party/WebKit/Source/platform/heap/Heap.h
|
| diff --git a/third_party/WebKit/Source/platform/heap/Heap.h b/third_party/WebKit/Source/platform/heap/Heap.h
|
| index 83e61d8e65b4c6c0c86a1c82a20a7b830d2418b2..7c8fc9daf4eecb91222d253575655732ac9e5eb1 100644
|
| --- a/third_party/WebKit/Source/platform/heap/Heap.h
|
| +++ b/third_party/WebKit/Source/platform/heap/Heap.h
|
| @@ -216,10 +216,13 @@
|
|
|
| static inline size_t allocationSizeFromSize(size_t size)
|
| {
|
| + // Check the size before computing the actual allocation size. The
|
| + // allocation size calculation can overflow for large sizes and the check
|
| + // therefore has to happen before any calculation on the size.
|
| + RELEASE_ASSERT(size < maxHeapObjectSize);
|
| +
|
| // Add space for header.
|
| size_t allocationSize = size + sizeof(HeapObjectHeader);
|
| - // The allocation size calculation can overflow for large sizes.
|
| - RELEASE_ASSERT(allocationSize > size);
|
| // Align size with allocation granularity.
|
| allocationSize = (allocationSize + allocationMask) & ~allocationMask;
|
| return allocationSize;
|
|
|