From bf973073d98660edf35e01e6984029e46eb85368 Mon Sep 17 00:00:00 2001

From: "dslomov@chromium.org"

 <dslomov@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>

Date: Mon, 13 Jan 2014 13:00:09 +0000

Subject: [PATCH] Use unsigned integer arithmetic in Zone::NewExpand.

    BUG=328202

    R=jkummerow@chromium.org

    LOG=N

    Review URL: https://codereview.chromium.org/108783005

    git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18564 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

---

 src/zone.cc | 29 +++++++++++++++++++----------

 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/src/zone.cc b/src/zone.cc

index 51b8113..c12978f 100644

--- a/src/zone.cc

+++ b/src/zone.cc

@@ -175,25 +175,31 @@ Address Zone::NewExpand(int size) {

   // except that we employ a maximum segment size when we delete. This

   // is to avoid excessive malloc() and free() overhead.

   Segment* head = segment_head_;

-  int old_size = (head == NULL) ? 0 : head->size();

-  static const int kSegmentOverhead = sizeof(Segment) + kAlignment;

-  int new_size_no_overhead = size + (old_size << 1);

-  int new_size = kSegmentOverhead + new_size_no_overhead;

+  const size_t old_size = (head == NULL) ? 0 : head->size();

+  static const size_t kSegmentOverhead = sizeof(Segment) + kAlignment;

+  const size_t new_size_no_overhead = size + (old_size << 1);

+  size_t new_size = kSegmentOverhead + new_size_no_overhead;

+  const size_t min_new_size = kSegmentOverhead + static_cast<size_t>(size);

   // Guard against integer overflow.

-  if (new_size_no_overhead < size || new_size < kSegmentOverhead) {

+  if (new_size_no_overhead < static_cast<size_t>(size) ||

+      new_size < static_cast<size_t>(kSegmentOverhead)) {

     V8::FatalProcessOutOfMemory("Zone");

     return NULL;

   }

-  if (new_size < kMinimumSegmentSize) {

+  if (new_size < static_cast<size_t>(kMinimumSegmentSize)) {

     new_size = kMinimumSegmentSize;

-  } else if (new_size > kMaximumSegmentSize) {

+  } else if (new_size > static_cast<size_t>(kMaximumSegmentSize)) {

     // Limit the size of new segments to avoid growing the segment size

     // exponentially, thus putting pressure on contiguous virtual address space.

     // All the while making sure to allocate a segment large enough to hold the

     // requested size.

-    new_size = Max(kSegmentOverhead + size, kMaximumSegmentSize);

+    new_size = Max(min_new_size, static_cast<size_t>(kMaximumSegmentSize));

   }

-  Segment* segment = NewSegment(new_size);

+  if (new_size > INT_MAX) {

+    V8::FatalProcessOutOfMemory("Zone");

+    return NULL;

+  }

+  Segment* segment = NewSegment(static_cast<int>(new_size));

   if (segment == NULL) {

     V8::FatalProcessOutOfMemory("Zone");

     return NULL;

@@ -203,7 +209,10 @@ Address Zone::NewExpand(int size) {

   Address result = RoundUp(segment->start(), kAlignment);

   position_ = result + size;

   // Check for address overflow.

-  if (position_ < result) {

+  // (Should not happen since the segment is guaranteed to accomodate

+  // size bytes + header and alignment padding)

+  if (reinterpret_cast<uintptr_t>(position_)

+      < reinterpret_cast<uintptr_t>(result)) {

     V8::FatalProcessOutOfMemory("Zone");

     return NULL;

   }

-- 

1.8.5.3