Changeset 41854 in webkit for trunk/JavaScriptCore/runtime/Collector.cpp

Timestamp:

Mar 19, 2009, 10:57:01 PM (16 years ago)

Author:

[email protected]

Message:

2009-03-19 Geoffrey Garen <​[email protected]>

Reviewed by Oliver Hunt.

Fixed <rdar://problem/6033712> -- a little bit of hardening in the Collector.

SunSpider reports no change. I also verified in the disassembly that
we end up with a single compare to constant.

• runtime/Collector.cpp: (JSC::Heap::heapAllocate):

File:

• trunk/JavaScriptCore/runtime/Collector.cpp (modified) (1 diff)

trunk/JavaScriptCore/runtime/Collector.cpp

@@ -350 +350 @@
         size_t numBlocks = heap.numBlocks;
         if (usedBlocks == numBlocks) {
+            static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
+            if (numBlocks > maxNumBlocks)
+                CRASH();
             numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
             heap.numBlocks = numBlocks;