| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2017 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 // This file contains all the logic necessary to intercept allocations on | |
| 6 // macOS. "malloc zones" are an abstraction that allows the process to intercept | |
| 7 // all malloc-related functions. There is no good mechanism [short of | |
| 8 // interposition] to determine new malloc zones are added, so there's no clean | |
| 9 // mechanism to intercept all malloc zones. This file contains logic to | |
| 10 // intercept the default and purgeable zones, which always exist. A cursory | |
| 11 // review of Chrome seems to imply that non-default zones are almost never used. | |
| 12 // | |
| 13 // This file also contains logic to intercept Core Foundation and Objective-C | |
| 14 // allocations. The implementations forward to the default malloc zone, so the | |
| 15 // only reason to intercept these calls is to re-label OOM crashes with slightly | |
| 16 // more details. | |
| 17 | |
| 18 #include "base/allocator/allocator_interception_mac.h" | |
| 19 | |
| 20 #include <CoreFoundation/CoreFoundation.h> | |
| 21 #import <Foundation/Foundation.h> | |
| 22 #include <errno.h> | |
| 23 #include <mach/mach.h> | |
| 24 #include <mach/mach_vm.h> | |
| 25 #include <malloc/malloc.h> | |
| 26 #import <objc/runtime.h> | |
| 27 #include <stddef.h> | |
| 28 | |
| 29 #include <new> | |
| 30 | |
| 31 #include "base/logging.h" | |
| 32 #include "base/mac/mac_util.h" | |
| 33 #include "base/mac/mach_logging.h" | |
| 34 #include "base/process/memory.h" | |
| 35 #include "base/scoped_clear_errno.h" | |
| 36 #include "build/build_config.h" | |
| 37 #include "third_party/apple_apsl/CFBase.h" | |
| 38 #include "third_party/apple_apsl/malloc.h" | |
| 39 | |
| 40 namespace base { | |
| 41 namespace allocator { | |
| 42 | |
| 43 namespace { | |
| 44 | |
| 45 bool g_oom_killer_enabled; | |
| 46 | |
| 47 #if !defined(ADDRESS_SANITIZER) | |
| 48 | |
| 49 // Starting with Mac OS X 10.7, the zone allocators set up by the system are | |
| 50 // read-only, to prevent them from being overwritten in an attack. However, | |
| 51 // blindly unprotecting and reprotecting the zone allocators fails with | |
| 52 // GuardMalloc because GuardMalloc sets up its zone allocator using a block of | |
| 53 // memory in its bss. Explicit saving/restoring of the protection is required. | |
| 54 // | |
| 55 // This function takes a pointer to a malloc zone, de-protects it if necessary, | |
| 56 // and returns (in the out parameters) a region of memory (if any) to be | |
| 57 // re-protected when modifications are complete. This approach assumes that | |
| 58 // there is no contention for the protection of this memory. | |
| 59 void DeprotectMallocZone(ChromeMallocZone* default_zone, | |
| 60 mach_vm_address_t* reprotection_start, | |
| 61 mach_vm_size_t* reprotection_length, | |
| 62 vm_prot_t* reprotection_value) { | |
| 63 mach_port_t unused; | |
| 64 *reprotection_start = reinterpret_cast<mach_vm_address_t>(default_zone); | |
| 65 struct vm_region_basic_info_64 info; | |
| 66 mach_msg_type_number_t count = VM_REGION_BASIC_INFO_COUNT_64; | |
| 67 kern_return_t result = mach_vm_region( | |
| 68 mach_task_self(), reprotection_start, reprotection_length, | |
| 69 VM_REGION_BASIC_INFO_64, reinterpret_cast<vm_region_info_t>(&info), | |
| 70 &count, &unused); | |
| 71 MACH_CHECK(result == KERN_SUCCESS, result) << "mach_vm_region"; | |
| 72 | |
| 73 // The kernel always returns a null object for VM_REGION_BASIC_INFO_64, but | |
| 74 // balance it with a deallocate in case this ever changes. See 10.9.2 | |
| 75 // xnu-2422.90.20/osfmk/vm/vm_map.c vm_map_region. | |
| 76 mach_port_deallocate(mach_task_self(), unused); | |
| 77 | |
| 78 // Does the region fully enclose the zone pointers? Possibly unwarranted | |
| 79 // simplification used: using the size of a full version 8 malloc zone rather | |
| 80 // than the actual smaller size if the passed-in zone is not version 8. | |
| 81 CHECK(*reprotection_start <= | |
| 82 reinterpret_cast<mach_vm_address_t>(default_zone)); | |
| 83 mach_vm_size_t zone_offset = | |
| 84 reinterpret_cast<mach_vm_size_t>(default_zone) - | |
| 85 reinterpret_cast<mach_vm_size_t>(*reprotection_start); | |
| 86 CHECK(zone_offset + sizeof(ChromeMallocZone) <= *reprotection_length); | |
| 87 | |
| 88 if (info.protection & VM_PROT_WRITE) { | |
| 89 // No change needed; the zone is already writable. | |
| 90 *reprotection_start = 0; | |
| 91 *reprotection_length = 0; | |
| 92 *reprotection_value = VM_PROT_NONE; | |
| 93 } else { | |
| 94 *reprotection_value = info.protection; | |
| 95 result = mach_vm_protect(mach_task_self(), *reprotection_start, | |
| 96 *reprotection_length, false, | |
| 97 info.protection | VM_PROT_WRITE); | |
| 98 MACH_CHECK(result == KERN_SUCCESS, result) << "mach_vm_protect"; | |
| 99 } | |
| 100 } | |
| 101 | |
| 102 // === C malloc/calloc/valloc/realloc/posix_memalign === | |
| 103 | |
| 104 typedef void* (*malloc_type)(struct _malloc_zone_t* zone, size_t size); | |
| 105 typedef void* (*calloc_type)(struct _malloc_zone_t* zone, | |
| 106 size_t num_items, | |
| 107 size_t size); | |
| 108 typedef void* (*valloc_type)(struct _malloc_zone_t* zone, size_t size); | |
| 109 typedef void (*free_type)(struct _malloc_zone_t* zone, void* ptr); | |
| 110 typedef void* (*realloc_type)(struct _malloc_zone_t* zone, | |
| 111 void* ptr, | |
| 112 size_t size); | |
| 113 typedef void* (*memalign_type)(struct _malloc_zone_t* zone, | |
| 114 size_t alignment, | |
| 115 size_t size); | |
| 116 | |
| 117 malloc_type g_old_malloc; | |
| 118 calloc_type g_old_calloc; | |
| 119 valloc_type g_old_valloc; | |
| 120 free_type g_old_free; | |
| 121 realloc_type g_old_realloc; | |
| 122 memalign_type g_old_memalign; | |
| 123 | |
| 124 malloc_type g_old_malloc_purgeable; | |
| 125 calloc_type g_old_calloc_purgeable; | |
| 126 valloc_type g_old_valloc_purgeable; | |
| 127 free_type g_old_free_purgeable; | |
| 128 realloc_type g_old_realloc_purgeable; | |
| 129 memalign_type g_old_memalign_purgeable; | |
| 130 | |
| 131 void* oom_killer_malloc(struct _malloc_zone_t* zone, size_t size) { | |
| 132 void* result = g_old_malloc(zone, size); | |
| 133 if (!result && size) | |
| 134 TerminateBecauseOutOfMemory(size); | |
| 135 return result; | |
| 136 } | |
| 137 | |
| 138 void* oom_killer_calloc(struct _malloc_zone_t* zone, | |
| 139 size_t num_items, | |
| 140 size_t size) { | |
| 141 void* result = g_old_calloc(zone, num_items, size); | |
| 142 if (!result && num_items && size) | |
| 143 TerminateBecauseOutOfMemory(num_items * size); | |
| 144 return result; | |
| 145 } | |
| 146 | |
| 147 void* oom_killer_valloc(struct _malloc_zone_t* zone, size_t size) { | |
| 148 void* result = g_old_valloc(zone, size); | |
| 149 if (!result && size) | |
| 150 TerminateBecauseOutOfMemory(size); | |
| 151 return result; | |
| 152 } | |
| 153 | |
| 154 void oom_killer_free(struct _malloc_zone_t* zone, void* ptr) { | |
| 155 g_old_free(zone, ptr); | |
| 156 } | |
| 157 | |
| 158 void* oom_killer_realloc(struct _malloc_zone_t* zone, void* ptr, size_t size) { | |
| 159 void* result = g_old_realloc(zone, ptr, size); | |
| 160 if (!result && size) | |
| 161 TerminateBecauseOutOfMemory(size); | |
| 162 return result; | |
| 163 } | |
| 164 | |
| 165 void* oom_killer_memalign(struct _malloc_zone_t* zone, | |
| 166 size_t alignment, | |
| 167 size_t size) { | |
| 168 void* result = g_old_memalign(zone, alignment, size); | |
| 169 // Only die if posix_memalign would have returned ENOMEM, since there are | |
| 170 // other reasons why NULL might be returned (see | |
| 171 // http://opensource.apple.com/source/Libc/Libc-583/gen/malloc.c ). | |
| 172 if (!result && size && alignment >= sizeof(void*) && | |
| 173 (alignment & (alignment - 1)) == 0) { | |
| 174 TerminateBecauseOutOfMemory(size); | |
| 175 } | |
| 176 return result; | |
| 177 } | |
| 178 | |
| 179 void* oom_killer_malloc_purgeable(struct _malloc_zone_t* zone, size_t size) { | |
| 180 void* result = g_old_malloc_purgeable(zone, size); | |
| 181 if (!result && size) | |
| 182 TerminateBecauseOutOfMemory(size); | |
| 183 return result; | |
| 184 } | |
| 185 | |
| 186 void* oom_killer_calloc_purgeable(struct _malloc_zone_t* zone, | |
| 187 size_t num_items, | |
| 188 size_t size) { | |
| 189 void* result = g_old_calloc_purgeable(zone, num_items, size); | |
| 190 if (!result && num_items && size) | |
| 191 TerminateBecauseOutOfMemory(num_items * size); | |
| 192 return result; | |
| 193 } | |
| 194 | |
| 195 void* oom_killer_valloc_purgeable(struct _malloc_zone_t* zone, size_t size) { | |
| 196 void* result = g_old_valloc_purgeable(zone, size); | |
| 197 if (!result && size) | |
| 198 TerminateBecauseOutOfMemory(size); | |
| 199 return result; | |
| 200 } | |
| 201 | |
| 202 void oom_killer_free_purgeable(struct _malloc_zone_t* zone, void* ptr) { | |
| 203 g_old_free_purgeable(zone, ptr); | |
| 204 } | |
| 205 | |
| 206 void* oom_killer_realloc_purgeable(struct _malloc_zone_t* zone, | |
| 207 void* ptr, | |
| 208 size_t size) { | |
| 209 void* result = g_old_realloc_purgeable(zone, ptr, size); | |
| 210 if (!result && size) | |
| 211 TerminateBecauseOutOfMemory(size); | |
| 212 return result; | |
| 213 } | |
| 214 | |
| 215 void* oom_killer_memalign_purgeable(struct _malloc_zone_t* zone, | |
| 216 size_t alignment, | |
| 217 size_t size) { | |
| 218 void* result = g_old_memalign_purgeable(zone, alignment, size); | |
| 219 // Only die if posix_memalign would have returned ENOMEM, since there are | |
| 220 // other reasons why NULL might be returned (see | |
| 221 // http://opensource.apple.com/source/Libc/Libc-583/gen/malloc.c ). | |
| 222 if (!result && size && alignment >= sizeof(void*) && | |
| 223 (alignment & (alignment - 1)) == 0) { | |
| 224 TerminateBecauseOutOfMemory(size); | |
| 225 } | |
| 226 return result; | |
| 227 } | |
| 228 | |
| 229 #endif // !defined(ADDRESS_SANITIZER) | |
| 230 | |
| 231 // === C++ operator new === | |
| 232 | |
| 233 void oom_killer_new() { | |
| 234 TerminateBecauseOutOfMemory(0); | |
| 235 } | |
| 236 | |
| 237 #if !defined(ADDRESS_SANITIZER) | |
| 238 | |
| 239 // === Core Foundation CFAllocators === | |
| 240 | |
| 241 bool CanGetContextForCFAllocator() { | |
| 242 return !base::mac::IsOSLaterThan10_12_DontCallThis(); | |
| 243 } | |
| 244 | |
| 245 CFAllocatorContext* ContextForCFAllocator(CFAllocatorRef allocator) { | |
| 246 ChromeCFAllocatorLions* our_allocator = const_cast<ChromeCFAllocatorLions*>( | |
| 247 reinterpret_cast<const ChromeCFAllocatorLions*>(allocator)); | |
| 248 return &our_allocator->_context; | |
| 249 } | |
| 250 | |
| 251 CFAllocatorAllocateCallBack g_old_cfallocator_system_default; | |
| 252 CFAllocatorAllocateCallBack g_old_cfallocator_malloc; | |
| 253 CFAllocatorAllocateCallBack g_old_cfallocator_malloc_zone; | |
| 254 | |
| 255 void* oom_killer_cfallocator_system_default(CFIndex alloc_size, | |
| 256 CFOptionFlags hint, | |
| 257 void* info) { | |
| 258 void* result = g_old_cfallocator_system_default(alloc_size, hint, info); | |
| 259 if (!result) | |
| 260 TerminateBecauseOutOfMemory(alloc_size); | |
| 261 return result; | |
| 262 } | |
| 263 | |
| 264 void* oom_killer_cfallocator_malloc(CFIndex alloc_size, | |
| 265 CFOptionFlags hint, | |
| 266 void* info) { | |
| 267 void* result = g_old_cfallocator_malloc(alloc_size, hint, info); | |
| 268 if (!result) | |
| 269 TerminateBecauseOutOfMemory(alloc_size); | |
| 270 return result; | |
| 271 } | |
| 272 | |
| 273 void* oom_killer_cfallocator_malloc_zone(CFIndex alloc_size, | |
| 274 CFOptionFlags hint, | |
| 275 void* info) { | |
| 276 void* result = g_old_cfallocator_malloc_zone(alloc_size, hint, info); | |
| 277 if (!result) | |
| 278 TerminateBecauseOutOfMemory(alloc_size); | |
| 279 return result; | |
| 280 } | |
| 281 | |
| 282 #endif // !defined(ADDRESS_SANITIZER) | |
| 283 | |
| 284 // === Cocoa NSObject allocation === | |
| 285 | |
| 286 typedef id (*allocWithZone_t)(id, SEL, NSZone*); | |
| 287 allocWithZone_t g_old_allocWithZone; | |
| 288 | |
| 289 id oom_killer_allocWithZone(id self, SEL _cmd, NSZone* zone) { | |
| 290 id result = g_old_allocWithZone(self, _cmd, zone); | |
| 291 if (!result) | |
| 292 TerminateBecauseOutOfMemory(0); | |
| 293 return result; | |
| 294 } | |
| 295 | |
| 296 } // namespace | |
| 297 | |
| 298 bool UncheckedMallocMac(size_t size, void** result) { | |
| 299 #if defined(ADDRESS_SANITIZER) | |
| 300 *result = malloc(size); | |
| 301 #else | |
| 302 if (g_old_malloc) { | |
| 303 *result = g_old_malloc(malloc_default_zone(), size); | |
| 304 } else { | |
| 305 *result = malloc(size); | |
| 306 } | |
| 307 #endif // defined(ADDRESS_SANITIZER) | |
| 308 | |
| 309 return *result != NULL; | |
| 310 } | |
| 311 | |
| 312 bool UncheckedCallocMac(size_t num_items, size_t size, void** result) { | |
| 313 #if defined(ADDRESS_SANITIZER) | |
| 314 *result = calloc(num_items, size); | |
| 315 #else | |
| 316 if (g_old_calloc) { | |
| 317 *result = g_old_calloc(malloc_default_zone(), num_items, size); | |
| 318 } else { | |
| 319 *result = calloc(num_items, size); | |
| 320 } | |
| 321 #endif // defined(ADDRESS_SANITIZER) | |
| 322 | |
| 323 return *result != NULL; | |
| 324 } | |
| 325 | |
| 326 void InterceptAllocationsMac() { | |
| 327 if (g_oom_killer_enabled) | |
| 328 return; | |
| 329 | |
| 330 g_oom_killer_enabled = true; | |
| 331 | |
| 332 // === C malloc/calloc/valloc/realloc/posix_memalign === | |
| 333 | |
| 334 // This approach is not perfect, as requests for amounts of memory larger than | |
| 335 // MALLOC_ABSOLUTE_MAX_SIZE (currently SIZE_T_MAX - (2 * PAGE_SIZE)) will | |
| 336 // still fail with a NULL rather than dying (see | |
| 337 // http://opensource.apple.com/source/Libc/Libc-583/gen/malloc.c for details). | |
| 338 // Unfortunately, it's the best we can do. Also note that this does not affect | |
| 339 // allocations from non-default zones. | |
| 340 | |
| 341 #if !defined(ADDRESS_SANITIZER) | |
| 342 // Don't do anything special on OOM for the malloc zones replaced by | |
| 343 // AddressSanitizer, as modifying or protecting them may not work correctly. | |
| 344 | |
| 345 CHECK(!g_old_malloc && !g_old_calloc && !g_old_valloc && !g_old_realloc && | |
| 346 !g_old_memalign) | |
| 347 << "Old allocators unexpectedly non-null"; | |
| 348 | |
| 349 CHECK(!g_old_malloc_purgeable && !g_old_calloc_purgeable && | |
| 350 !g_old_valloc_purgeable && !g_old_realloc_purgeable && | |
| 351 !g_old_memalign_purgeable) | |
| 352 << "Old allocators unexpectedly non-null"; | |
| 353 | |
| 354 ChromeMallocZone* default_zone = | |
| 355 reinterpret_cast<ChromeMallocZone*>(malloc_default_zone()); | |
| 356 ChromeMallocZone* purgeable_zone = | |
| 357 reinterpret_cast<ChromeMallocZone*>(malloc_default_purgeable_zone()); | |
| 358 | |
| 359 mach_vm_address_t default_reprotection_start = 0; | |
| 360 mach_vm_size_t default_reprotection_length = 0; | |
| 361 vm_prot_t default_reprotection_value = VM_PROT_NONE; | |
| 362 DeprotectMallocZone(default_zone, &default_reprotection_start, | |
| 363 &default_reprotection_length, | |
| 364 &default_reprotection_value); | |
| 365 | |
| 366 mach_vm_address_t purgeable_reprotection_start = 0; | |
| 367 mach_vm_size_t purgeable_reprotection_length = 0; | |
| 368 vm_prot_t purgeable_reprotection_value = VM_PROT_NONE; | |
| 369 if (purgeable_zone) { | |
| 370 DeprotectMallocZone(purgeable_zone, &purgeable_reprotection_start, | |
| 371 &purgeable_reprotection_length, | |
| 372 &purgeable_reprotection_value); | |
| 373 } | |
| 374 | |
| 375 // Default zone | |
| 376 | |
| 377 g_old_malloc = default_zone->malloc; | |
| 378 g_old_calloc = default_zone->calloc; | |
| 379 g_old_valloc = default_zone->valloc; | |
| 380 g_old_free = default_zone->free; | |
| 381 g_old_realloc = default_zone->realloc; | |
| 382 CHECK(g_old_malloc && g_old_calloc && g_old_valloc && g_old_free && | |
| 383 g_old_realloc) | |
| 384 << "Failed to get system allocation functions."; | |
| 385 | |
| 386 default_zone->malloc = oom_killer_malloc; | |
| 387 default_zone->calloc = oom_killer_calloc; | |
| 388 default_zone->valloc = oom_killer_valloc; | |
| 389 default_zone->free = oom_killer_free; | |
| 390 default_zone->realloc = oom_killer_realloc; | |
| 391 | |
| 392 if (default_zone->version >= 5) { | |
| 393 g_old_memalign = default_zone->memalign; | |
| 394 if (g_old_memalign) | |
| 395 default_zone->memalign = oom_killer_memalign; | |
| 396 } | |
| 397 | |
| 398 // Purgeable zone (if it exists) | |
| 399 | |
| 400 if (purgeable_zone) { | |
| 401 g_old_malloc_purgeable = purgeable_zone->malloc; | |
| 402 g_old_calloc_purgeable = purgeable_zone->calloc; | |
| 403 g_old_valloc_purgeable = purgeable_zone->valloc; | |
| 404 g_old_free_purgeable = purgeable_zone->free; | |
| 405 g_old_realloc_purgeable = purgeable_zone->realloc; | |
| 406 CHECK(g_old_malloc_purgeable && g_old_calloc_purgeable && | |
| 407 g_old_valloc_purgeable && g_old_free_purgeable && | |
| 408 g_old_realloc_purgeable) | |
| 409 << "Failed to get system allocation functions."; | |
| 410 | |
| 411 purgeable_zone->malloc = oom_killer_malloc_purgeable; | |
| 412 purgeable_zone->calloc = oom_killer_calloc_purgeable; | |
| 413 purgeable_zone->valloc = oom_killer_valloc_purgeable; | |
| 414 purgeable_zone->free = oom_killer_free_purgeable; | |
| 415 purgeable_zone->realloc = oom_killer_realloc_purgeable; | |
| 416 | |
| 417 if (purgeable_zone->version >= 5) { | |
| 418 g_old_memalign_purgeable = purgeable_zone->memalign; | |
| 419 if (g_old_memalign_purgeable) | |
| 420 purgeable_zone->memalign = oom_killer_memalign_purgeable; | |
| 421 } | |
| 422 } | |
| 423 | |
| 424 // Restore protection if it was active. | |
| 425 | |
| 426 if (default_reprotection_start) { | |
| 427 kern_return_t result = mach_vm_protect( | |
| 428 mach_task_self(), default_reprotection_start, | |
| 429 default_reprotection_length, false, default_reprotection_value); | |
| 430 MACH_CHECK(result == KERN_SUCCESS, result) << "mach_vm_protect"; | |
| 431 } | |
| 432 | |
| 433 if (purgeable_reprotection_start) { | |
| 434 kern_return_t result = mach_vm_protect( | |
| 435 mach_task_self(), purgeable_reprotection_start, | |
| 436 purgeable_reprotection_length, false, purgeable_reprotection_value); | |
| 437 MACH_CHECK(result == KERN_SUCCESS, result) << "mach_vm_protect"; | |
| 438 } | |
| 439 #endif | |
| 440 | |
| 441 // === C malloc_zone_batch_malloc === | |
| 442 | |
| 443 // batch_malloc is omitted because the default malloc zone's implementation | |
| 444 // only supports batch_malloc for "tiny" allocations from the free list. It | |
| 445 // will fail for allocations larger than "tiny", and will only allocate as | |
| 446 // many blocks as it's able to from the free list. These factors mean that it | |
| 447 // can return less than the requested memory even in a non-out-of-memory | |
| 448 // situation. There's no good way to detect whether a batch_malloc failure is | |
| 449 // due to these other factors, or due to genuine memory or address space | |
| 450 // exhaustion. The fact that it only allocates space from the "tiny" free list | |
| 451 // means that it's likely that a failure will not be due to memory exhaustion. | |
| 452 // Similarly, these constraints on batch_malloc mean that callers must always | |
| 453 // be expecting to receive less memory than was requested, even in situations | |
| 454 // where memory pressure is not a concern. Finally, the only public interface | |
| 455 // to batch_malloc is malloc_zone_batch_malloc, which is specific to the | |
| 456 // system's malloc implementation. It's unlikely that anyone's even heard of | |
| 457 // it. | |
| 458 | |
| 459 // === C++ operator new === | |
| 460 | |
| 461 // Yes, operator new does call through to malloc, but this will catch failures | |
| 462 // that our imperfect handling of malloc cannot. | |
| 463 | |
| 464 std::set_new_handler(oom_killer_new); | |
| 465 | |
| 466 #ifndef ADDRESS_SANITIZER | |
| 467 // === Core Foundation CFAllocators === | |
| 468 | |
| 469 // This will not catch allocation done by custom allocators, but will catch | |
| 470 // all allocation done by system-provided ones. | |
| 471 | |
| 472 CHECK(!g_old_cfallocator_system_default && !g_old_cfallocator_malloc && | |
| 473 !g_old_cfallocator_malloc_zone) | |
| 474 << "Old allocators unexpectedly non-null"; | |
| 475 | |
| 476 bool cf_allocator_internals_known = CanGetContextForCFAllocator(); | |
| 477 | |
| 478 if (cf_allocator_internals_known) { | |
| 479 CFAllocatorContext* context = | |
| 480 ContextForCFAllocator(kCFAllocatorSystemDefault); | |
| 481 CHECK(context) << "Failed to get context for kCFAllocatorSystemDefault."; | |
| 482 g_old_cfallocator_system_default = context->allocate; | |
| 483 CHECK(g_old_cfallocator_system_default) | |
| 484 << "Failed to get kCFAllocatorSystemDefault allocation function."; | |
| 485 context->allocate = oom_killer_cfallocator_system_default; | |
| 486 | |
| 487 context = ContextForCFAllocator(kCFAllocatorMalloc); | |
| 488 CHECK(context) << "Failed to get context for kCFAllocatorMalloc."; | |
| 489 g_old_cfallocator_malloc = context->allocate; | |
| 490 CHECK(g_old_cfallocator_malloc) | |
| 491 << "Failed to get kCFAllocatorMalloc allocation function."; | |
| 492 context->allocate = oom_killer_cfallocator_malloc; | |
| 493 | |
| 494 context = ContextForCFAllocator(kCFAllocatorMallocZone); | |
| 495 CHECK(context) << "Failed to get context for kCFAllocatorMallocZone."; | |
| 496 g_old_cfallocator_malloc_zone = context->allocate; | |
| 497 CHECK(g_old_cfallocator_malloc_zone) | |
| 498 << "Failed to get kCFAllocatorMallocZone allocation function."; | |
| 499 context->allocate = oom_killer_cfallocator_malloc_zone; | |
| 500 } else { | |
| 501 DLOG(WARNING) << "Internals of CFAllocator not known; out-of-memory " | |
| 502 "failures via CFAllocator will not result in termination. " | |
| 503 "http://crbug.com/45650"; | |
| 504 } | |
| 505 #endif | |
| 506 | |
| 507 // === Cocoa NSObject allocation === | |
| 508 | |
| 509 // Note that both +[NSObject new] and +[NSObject alloc] call through to | |
| 510 // +[NSObject allocWithZone:]. | |
| 511 | |
| 512 CHECK(!g_old_allocWithZone) << "Old allocator unexpectedly non-null"; | |
| 513 | |
| 514 Class nsobject_class = [NSObject class]; | |
| 515 Method orig_method = | |
| 516 class_getClassMethod(nsobject_class, @selector(allocWithZone:)); | |
| 517 g_old_allocWithZone = | |
| 518 reinterpret_cast<allocWithZone_t>(method_getImplementation(orig_method)); | |
| 519 CHECK(g_old_allocWithZone) | |
| 520 << "Failed to get allocWithZone allocation function."; | |
| 521 method_setImplementation(orig_method, | |
| 522 reinterpret_cast<IMP>(oom_killer_allocWithZone)); | |
| 523 } | |
| 524 | |
| 525 } // namespace allocator | |
| 526 } // namespace base | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2658083002:
Revert of Move logic from memory_mac to allocator_interception_mac. (Closed)
