Title: [186439] releases/WebKitGTK/webkit-2.8/Source/bmalloc
- Revision
- 186439
- Author
- [email protected]
- Date
- 2015-07-07 04:04:26 -0700 (Tue, 07 Jul 2015)
Log Message
Merge r186203 - bmalloc: realloc of an XLarge range can unmap adjacent VM ranges
https://bugs.webkit.org/show_bug.cgi?id=146535
Reviewed by Anders Carlsson.
This bug causes a crash when running fast/css/large-list-of-rules-crash.html
with the fix applied for https://bugs.webkit.org/show_bug.cgi?id=146519.
* bmalloc/Allocator.cpp:
(bmalloc::Allocator::reallocate): Start at object + newSize since starting
at object + oldSize means deleting the adjacent VM range.
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/ChangeLog (186438 => 186439)
--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/ChangeLog 2015-07-07 11:00:07 UTC (rev 186438)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/ChangeLog 2015-07-07 11:04:26 UTC (rev 186439)
@@ -1,3 +1,17 @@
+2015-07-01 Geoffrey Garen <[email protected]>
+
+ bmalloc: realloc of an XLarge range can unmap adjacent VM ranges
+ https://bugs.webkit.org/show_bug.cgi?id=146535
+
+ Reviewed by Anders Carlsson.
+
+ This bug causes a crash when running fast/css/large-list-of-rules-crash.html
+ with the fix applied for https://bugs.webkit.org/show_bug.cgi?id=146519.
+
+ * bmalloc/Allocator.cpp:
+ (bmalloc::Allocator::reallocate): Start at object + newSize since starting
+ at object + oldSize means deleting the adjacent VM range.
+
2015-05-26 Geoffrey Garen <[email protected]>
Integer overflow in XLarge allocation (due to unchecked roundUpToMultipleOf)
Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Allocator.cpp (186438 => 186439)
--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Allocator.cpp 2015-07-07 11:00:07 UTC (rev 186438)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Allocator.cpp 2015-07-07 11:04:26 UTC (rev 186439)
@@ -166,7 +166,7 @@
newSize = roundUpToMultipleOf<xLargeAlignment>(newSize);
if (oldSize - newSize >= xLargeAlignment) {
lock.unlock();
- vmDeallocate(static_cast<char*>(object) + oldSize, oldSize - newSize);
+ vmDeallocate(static_cast<char*>(object) + newSize, oldSize - newSize);
lock.lock();
range = Range(object, newSize);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
