Deletion barrier preparation: validate overwritten references.

runtime/vm/pages.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/pages.h"
 
 #include "platform/assert.h"
 #include "vm/compiler_stats.h"
 #include "vm/gc_marker.h"
 #include "vm/gc_sweeper.h"
@@ skipping 858 matching lines @@
   if (result != 0) {
     usage_.used_in_words += size >> kWordSizeLog2;
     return result;
   }
   result = TryAllocateDataBumpLocked(size, growth_policy);
   if (result != 0) return result;
   return TryAllocateDataLocked(size, growth_policy);
 }
 
 
+uword PageSpace::TryAllocateSmiInitializedLocked(intptr_t size,
+                                                 GrowthPolicy growth_policy) {
+  uword result = TryAllocateDataBumpLocked(size, growth_policy);
+  if (collections() != 0) {
+#if defined(DEBUG)
+    FATAL1("%" Pd " GCs before TryAllocateSmiInitializedLocked", collections());
+#else
+    // Shouldn't happen, but prefer slight slowdown over (exploitable?) crash.

[Ivan Posva, 2015/01/02 17:09:39]

FATAL should better not be exploitable. We "reach" it in many other situations.

In this case I would prefer if we did not allow to get into this situation even
in release mode.

[koda, 2015/01/02 17:30:53]

Done.

+    memset(reinterpret_cast<void*>(result), 0, size);
+#endif  // DEBUG
+  }
+#if defined(DEBUG)
+  RawObject** begin = reinterpret_cast<RawObject**>(result);
+  RawObject** end = reinterpret_cast<RawObject**>(result + size);
+  for (RawObject** current = begin; current < end; ++current) {
+    ASSERT(!(*current)->IsHeapObject());
+  }
+#endif
+  return result;
+}
+
+
 PageSpaceController::PageSpaceController(Heap* heap,
                                          int heap_growth_ratio,
                                          int heap_growth_max,
                                          int garbage_collection_time_ratio)
     : heap_(heap),
       is_enabled_(false),
       grow_heap_(heap_growth_max / 2),
       heap_growth_ratio_(heap_growth_ratio),
       desired_utilization_((100.0 - heap_growth_ratio) / 100.0),
       heap_growth_max_(heap_growth_max),
@@ skipping 105 matching lines @@
   for (int i = 0; i < history_.Size() - 1; i++) {
     Entry current = history_.Get(i);
     Entry previous = history_.Get(i + 1);
     gc_time += current.end - current.start;
     total_time += current.end - previous.end;
   }
   if (total_time == 0) {
     return 0;
   } else {
     ASSERT(total_time >= gc_time);
-    int result= static_cast<int>((static_cast<double>(gc_time) /
-                             static_cast<double>(total_time)) * 100);
+    int result = static_cast<int>((static_cast<double>(gc_time) /
+                                   static_cast<double>(total_time)) * 100);
     return result;
   }
 }
 
 }  // namespace dart