Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(25)

Unified Diff: src/zone.cc

Issue 1945313002: Version 5.0.71.47 (cherry-pick) (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@5.0
Patch Set: Created 4 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « include/v8-version.h ('k') | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/zone.cc
diff --git a/src/zone.cc b/src/zone.cc
index 9dcebba2dc1fc8fee3fd4c5fd363e6f55b3b47c0..1f722f2f608952dff173d9a377178835a70f7d08 100644
--- a/src/zone.cc
+++ b/src/zone.cc
@@ -105,7 +105,10 @@ void* Zone::New(size_t size) {
Address result = position_;
const size_t size_with_redzone = size + kASanRedzoneBytes;
- if (limit_ < position_ + size_with_redzone) {
+ const uintptr_t limit = reinterpret_cast<uintptr_t>(limit_);
+ const uintptr_t position = reinterpret_cast<uintptr_t>(position_);
+ // position_ > limit_ can be true after the alignment correction above.
+ if (limit < position || size_with_redzone > limit - position) {
result = NewExpand(size_with_redzone);
} else {
position_ += size_with_redzone;
@@ -222,7 +225,10 @@ Address Zone::NewExpand(size_t size) {
// Make sure the requested size is already properly aligned and that
// there isn't enough room in the Zone to satisfy the request.
DCHECK_EQ(size, RoundDown(size, kAlignment));
- DCHECK_LT(limit_, position_ + size);
+ DCHECK(limit_ < position_ ||
+ reinterpret_cast<uintptr_t>(limit_) -
+ reinterpret_cast<uintptr_t>(position_) <
+ size);
// Compute the new segment size. We use a 'high water mark'
// strategy, where we increase the segment size every time we expand
« no previous file with comments | « include/v8-version.h ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698