156780 2016-04-19 20:09:49 -0700 bmalloc: fix up overflow checks 2016-04-20 11:04:37 -0700 1 1 1 Unclassified WebKit bmalloc WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 ggaren ggaren ggaren mark.lam oldest_to_newest 1185309 0 ggaren 2016-04-19 20:09:49 -0700 bmalloc: fix up overflow checks 1185310 1 276795 ggaren 2016-04-19 20:12:50 -0700 Created attachment 276795 Patch 1185320 2 276795 mark.lam 2016-04-19 20:56:11 -0700 Comment on attachment 276795 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=276795&action=review r=me > Source/bmalloc/ChangeLog:11 > + we were missing smoe cases. typo: /smoe/some/. 1185321 3 276795 mark.lam 2016-04-19 20:57:04 -0700 Comment on attachment 276795 Patch Is it possible to add some tests that exercise the overflow cases? 1185327 4 ggaren 2016-04-19 21:12:50 -0700 > Is it possible to add some tests that exercise the overflow cases? Good question. This requires some changes to the MallocBench infrastructure to allow for failure. I'll tackle this in a follow-up patch. 1185328 5 ggaren 2016-04-19 21:13:43 -0700 Committed r199759: <http://trac.webkit.org/changeset/199759> 1185451 6 276795 oliver 2016-04-20 10:34:56 -0700 Comment on attachment 276795 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=276795&action=review > Source/bmalloc/bmalloc/Heap.cpp:347 > + size_t roundedSize = size ? roundUpToMultipleOf(largeAlignment, size) : largeAlignment; I wonder if we should make an override for roundUp... to take Checked<T> - then switch to Checked<> for bmalloc internal arithmetic? 1185465 7 ggaren 2016-04-20 11:04:37 -0700 > > Source/bmalloc/bmalloc/Heap.cpp:347 > > + size_t roundedSize = size ? roundUpToMultipleOf(largeAlignment, size) : largeAlignment; > > I wonder if we should make an override for roundUp... to take Checked<T> - > then switch to Checked<> for bmalloc internal arithmetic? I'd like to come up with a good idiom, maybe using builtin checked arithmetic. Not sure what the best option is. 276795 2016-04-19 20:12:50 -0700 2016-04-19 20:56:11 -0700 Patch bug-156780-20160419201310.patch text/plain 7167 ggaren SW5kZXg6IFNvdXJjZS9ibWFsbG9jL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvYm1h bGxvYy9DaGFuZ2VMb2cJKHJldmlzaW9uIDE5OTc1NikKKysrIFNvdXJjZS9ibWFsbG9jL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDM3IEBACisyMDE2LTA0LTE5ICBHZW9mZnJl eSBHYXJlbiAgPGdnYXJlbkBhcHBsZS5jb20+CisKKyAgICAgICAgYm1hbGxvYzogZml4IHVwIG92 ZXJmbG93IGNoZWNrcworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MTU2NzgwCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgV2UgdXNlZCB0byB0cnkgdG8gYXZvaWQgb3ZlcmZsb3cgaW4gbGFyZ2Ugb2JqZWN0IG1h dGggYnkgc2V0dGluZyBhIHZlcnkKKyAgICAgICAgaGlnaCBsaW1pdCBvbiB0aGUgbGFyZ2VzdCBs YXJnZSBvYmplY3QuIEJ1dCB0aGF0J3MgYSBiaXQgZXJyb3ItcHJvbmUKKyAgICAgICAgc2luY2Ug dGhlIGNoZWNrIGlzIGZhciBhd2F5IGZyb20gdGhlIG1hdGggdGhhdCBtaWdodCBvdmVyZmxvdyAt LSBhbmQKKyAgICAgICAgd2Ugd2VyZSBtaXNzaW5nIHNtb2UgY2FzZXMuCisKKyAgICAgICAgVGhp cyBwYXRjaCByZW1vdmVzIHRoZSBsaW1pdCBhbmQgaW5zdGVhZCBjaGVja3MgYXQgZWFjaCBtYXRo IHNpdGUuCisKKyAgICAgICAgKiBibWFsbG9jL0FsbG9jYXRvci5jcHA6CisgICAgICAgIChibWFs bG9jOjpBbGxvY2F0b3I6OnRyeUFsbG9jYXRlKToKKyAgICAgICAgKGJtYWxsb2M6OkFsbG9jYXRv cjo6YWxsb2NhdGUpOgorICAgICAgICAoYm1hbGxvYzo6QWxsb2NhdG9yOjpyZWFsbG9jYXRlKToK KyAgICAgICAgKGJtYWxsb2M6OkFsbG9jYXRvcjo6YWxsb2NhdGVTbG93Q2FzZSk6IFJlbW92ZSB0 aGUgbGltaXQuIHRyeUFsbG9jYXRlTGFyZ2UKKyAgICAgICAgd2lsbCBjaGVjayBmb3Igb3ZlcmZs b3cgZm9yIHVzLgorCisgICAgICAgICogYm1hbGxvYy9DaHVuay5oOiBUaGlzIEFTU0VSVCB3YXMg anVzdCB0b3RhbGx5IHdyb25nLgorCisgICAgICAgICogYm1hbGxvYy9IZWFwLmNwcDoKKyAgICAg ICAgKGJtYWxsb2M6OkhlYXA6OnRyeUFsbG9jYXRlTGFyZ2UpOiBDaGVjayBmb3Igb3ZlcmZsb3cg d2hlbiBhZGRpbmcuCisKKyAgICAgICAgKiBibWFsbG9jL1NpemVzLmg6CisKKyAgICAgICAgKiBi bWFsbG9jL1ZNQWxsb2NhdGUuaDoKKyAgICAgICAgKGJtYWxsb2M6OnRyeVZNQWxsb2NhdGUpOiBD aGVjayBmb3Igb3ZlcmZsb3cgd2hlbiBhZGRpbmcuCisKKyAgICAgICAgKiBibWFsbG9jL1ZNSGVh cC5jcHA6CisgICAgICAgIChibWFsbG9jOjpWTUhlYXA6OnRyeUFsbG9jYXRlTGFyZ2VDaHVuayk6 IENoZWNrIGZvciBvdmVyZmxvdyB3aGVuIGFkZGluZy4KKwogMjAxNi0wNC0xOSAgR2VvZmZyZXkg R2FyZW4gIDxnZ2FyZW5AYXBwbGUuY29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQsIHRyeSB0byBm aXggYW4gQVNTRVJUIHNlZW4gb24gdGhlIGJvdHMuCkluZGV4OiBTb3VyY2UvYm1hbGxvYy9ibWFs bG9jL0FsbG9jYXRvci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL2JtYWxsb2MvYm1hbGxvYy9B bGxvY2F0b3IuY3BwCShyZXZpc2lvbiAxOTk3NTUpCisrKyBTb3VyY2UvYm1hbGxvYy9ibWFsbG9j L0FsbG9jYXRvci5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTU4LDEyICs1OCw4IEBAIHZvaWQqIEFs bG9jYXRvcjo6dHJ5QWxsb2NhdGUoc2l6ZV90IHNpemUKICAgICBpZiAoc2l6ZSA8PSBzbWFsbE1h eCkKICAgICAgICAgcmV0dXJuIGFsbG9jYXRlKHNpemUpOwogCi0gICAgaWYgKHNpemUgPD0gbGFy Z2VNYXgpIHsKLSAgICAgICAgc3RkOjpsb2NrX2d1YXJkPFN0YXRpY011dGV4PiBsb2NrKFBlclBy b2Nlc3M8SGVhcD46Om11dGV4KCkpOwotICAgICAgICByZXR1cm4gUGVyUHJvY2VzczxIZWFwPjo6 Z2V0RmFzdENhc2UoKS0+dHJ5QWxsb2NhdGVMYXJnZShsb2NrLCBhbGlnbm1lbnQsIHNpemUpOwot ICAgIH0KLQotICAgIHJldHVybiBudWxscHRyOworICAgIHN0ZDo6bG9ja19ndWFyZDxTdGF0aWNN dXRleD4gbG9jayhQZXJQcm9jZXNzPEhlYXA+OjptdXRleCgpKTsKKyAgICByZXR1cm4gUGVyUHJv Y2VzczxIZWFwPjo6Z2V0RmFzdENhc2UoKS0+dHJ5QWxsb2NhdGVMYXJnZShsb2NrLCBhbGlnbm1l bnQsIHNpemUpOwogfQogCiB2b2lkKiBBbGxvY2F0b3I6OmFsbG9jYXRlKHNpemVfdCBhbGlnbm1l bnQsIHNpemVfdCBzaXplKQpAQCAtODMsMTMgKzc5LDggQEAgdm9pZCogQWxsb2NhdG9yOjphbGxv Y2F0ZShzaXplX3QgYWxpZ25tZQogICAgIGlmIChzaXplIDw9IHNtYWxsTWF4ICYmIGFsaWdubWVu dCA8PSBzbWFsbE1heCkKICAgICAgICAgcmV0dXJuIGFsbG9jYXRlKHJvdW5kVXBUb011bHRpcGxl T2YoYWxpZ25tZW50LCBzaXplKSk7CiAKLSAgICBpZiAoc2l6ZSA8PSBsYXJnZU1heCAmJiBhbGln bm1lbnQgPD0gbGFyZ2VNYXggLyAyKSB7Ci0gICAgICAgIHN0ZDo6bG9ja19ndWFyZDxTdGF0aWNN dXRleD4gbG9jayhQZXJQcm9jZXNzPEhlYXA+OjptdXRleCgpKTsKLSAgICAgICAgcmV0dXJuIFBl clByb2Nlc3M8SGVhcD46OmdldEZhc3RDYXNlKCktPmFsbG9jYXRlTGFyZ2UobG9jaywgYWxpZ25t ZW50LCBzaXplKTsKLSAgICB9Ci0KLSAgICBCQ1JBU0goKTsKLSAgICByZXR1cm4gbnVsbHB0cjsK KyAgICBzdGQ6OmxvY2tfZ3VhcmQ8U3RhdGljTXV0ZXg+IGxvY2soUGVyUHJvY2VzczxIZWFwPjo6 bXV0ZXgoKSk7CisgICAgcmV0dXJuIFBlclByb2Nlc3M8SGVhcD46OmdldEZhc3RDYXNlKCktPmFs bG9jYXRlTGFyZ2UobG9jaywgYWxpZ25tZW50LCBzaXplKTsKIH0KIAogdm9pZCogQWxsb2NhdG9y OjpyZWFsbG9jYXRlKHZvaWQqIG9iamVjdCwgc2l6ZV90IG5ld1NpemUpCkBAIC0xOTMsMTEgKzE4 NCw3IEBAIHZvaWQqIEFsbG9jYXRvcjo6YWxsb2NhdGVTbG93Q2FzZShzaXplX3QKICAgICBpZiAo c2l6ZSA8PSBzbWFsbE1heCkKICAgICAgICAgcmV0dXJuIGFsbG9jYXRlTG9nU2l6ZUNsYXNzKHNp emUpOwogCi0gICAgaWYgKHNpemUgPD0gbGFyZ2VNYXgpCi0gICAgICAgIHJldHVybiBhbGxvY2F0 ZUxhcmdlKHNpemUpOwotCi0gICAgQkNSQVNIKCk7Ci0gICAgcmV0dXJuIG51bGxwdHI7CisgICAg cmV0dXJuIGFsbG9jYXRlTGFyZ2Uoc2l6ZSk7CiB9CiAKIH0gLy8gbmFtZXNwYWNlIGJtYWxsb2MK SW5kZXg6IFNvdXJjZS9ibWFsbG9jL2JtYWxsb2MvQ2h1bmsuaAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3Vy Y2UvYm1hbGxvYy9ibWFsbG9jL0NodW5rLmgJKHJldmlzaW9uIDE5OTc1NSkKKysrIFNvdXJjZS9i bWFsbG9jL2JtYWxsb2MvQ2h1bmsuaAkod29ya2luZyBjb3B5KQpAQCAtNTYsOCArNTYsNiBAQCBw cml2YXRlOgogICAgIHN0ZDo6YXJyYXk8U21hbGxQYWdlLCBjaHVua1NpemUgLyBzbWFsbFBhZ2VT aXplPiBtX3BhZ2VzOwogfTsKIAotc3RhdGljX2Fzc2VydChzaXplb2YoQ2h1bmspICsgbGFyZ2VN YXggPD0gY2h1bmtTaXplLCAibGFyZ2VNYXggaXMgdG9vIGJpZyIpOwotCiBzdHJ1Y3QgQ2h1bmtI YXNoIHsKICAgICBzdGF0aWMgdW5zaWduZWQgaGFzaChDaHVuayoga2V5KQogICAgIHsKSW5kZXg6 IFNvdXJjZS9ibWFsbG9jL2JtYWxsb2MvSGVhcC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL2Jt YWxsb2MvYm1hbGxvYy9IZWFwLmNwcAkocmV2aXNpb24gMTk5NzU2KQorKysgU291cmNlL2JtYWxs b2MvYm1hbGxvYy9IZWFwLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMzQyLDEyICszNDIsMTcgQEAg WExhcmdlUmFuZ2UgSGVhcDo6c3BsaXRBbmRBbGxvY2F0ZShYTGFyZwogCiB2b2lkKiBIZWFwOjp0 cnlBbGxvY2F0ZUxhcmdlKHN0ZDo6bG9ja19ndWFyZDxTdGF0aWNNdXRleD4mIGxvY2ssIHNpemVf dCBhbGlnbm1lbnQsIHNpemVfdCBzaXplKQogewotICAgIEJBU1NFUlQoc2l6ZSA8PSBsYXJnZU1h eCk7Ci0gICAgQkFTU0VSVChhbGlnbm1lbnQgPD0gbGFyZ2VNYXggLyAyKTsKICAgICBCQVNTRVJU KGlzUG93ZXJPZlR3byhhbGlnbm1lbnQpKTsKIAotICAgIHNpemUgPSBzaXplID8gcm91bmRVcFRv TXVsdGlwbGVPZihsYXJnZUFsaWdubWVudCwgc2l6ZSkgOiBsYXJnZUFsaWdubWVudDsKLSAgICBh bGlnbm1lbnQgPSByb3VuZFVwVG9NdWx0aXBsZU9mPGxhcmdlQWxpZ25tZW50PihhbGlnbm1lbnQp OworICAgIHNpemVfdCByb3VuZGVkU2l6ZSA9IHNpemUgPyByb3VuZFVwVG9NdWx0aXBsZU9mKGxh cmdlQWxpZ25tZW50LCBzaXplKSA6IGxhcmdlQWxpZ25tZW50OworICAgIGlmIChyb3VuZGVkU2l6 ZSA8IHNpemUpIC8vIENoZWNrIGZvciBvdmVyZmxvdworICAgICAgICByZXR1cm4gbnVsbHB0cjsK KyAgICBzaXplID0gcm91bmRlZFNpemU7CisKKyAgICBzaXplX3Qgcm91bmRlZEFsaWdubWVudCA9 IHJvdW5kVXBUb011bHRpcGxlT2Y8bGFyZ2VBbGlnbm1lbnQ+KGFsaWdubWVudCk7CisgICAgaWYg KHJvdW5kZWRBbGlnbm1lbnQgPCBhbGlnbm1lbnQpIC8vIENoZWNrIGZvciBvdmVyZmxvdworICAg ICAgICByZXR1cm4gbnVsbHB0cjsKKyAgICBhbGlnbm1lbnQgPSByb3VuZGVkQWxpZ25tZW50Owog CiAgICAgWExhcmdlUmFuZ2UgcmFuZ2UgPSBtX2xhcmdlRnJlZS5yZW1vdmUoYWxpZ25tZW50LCBz aXplKTsKICAgICBpZiAoIXJhbmdlKSB7CkluZGV4OiBTb3VyY2UvYm1hbGxvYy9ibWFsbG9jL1Np emVzLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PQotLS0gU291cmNlL2JtYWxsb2MvYm1hbGxvYy9TaXplcy5oCShyZXZp c2lvbiAxOTk3NTUpCisrKyBTb3VyY2UvYm1hbGxvYy9ibWFsbG9jL1NpemVzLmgJKHdvcmtpbmcg Y29weSkKQEAgLTY0LDcgKzY0LDYgQEAgbmFtZXNwYWNlIFNpemVzIHsKIAogICAgIHN0YXRpYyBj b25zdCBzaXplX3QgbGFyZ2VBbGlnbm1lbnQgPSBzbWFsbE1heCAvIHBhZ2VTaXplV2FzdGVGYWN0 b3I7CiAgICAgc3RhdGljIGNvbnN0IHNpemVfdCBsYXJnZUFsaWdubWVudE1hc2sgPSBsYXJnZUFs aWdubWVudCAtIDE7Ci0gICAgc3RhdGljIGNvbnN0IHNpemVfdCBsYXJnZU1heCA9IHN0ZDo6bnVt ZXJpY19saW1pdHM8c2l6ZV90Pjo6bWF4KCkgLSBsYXJnZUFsaWdubWVudDsgLy8gTWFrZSBzdXJl IHRoYXQgcm91bmRpbmcgdXAgdG8gbGFyZ2VBbGlnbm1lbnQgZG9lcyBub3Qgb3ZlcmZsb3cuCiAK ICAgICBzdGF0aWMgY29uc3Qgc2l6ZV90IGRlYWxsb2NhdG9yTG9nQ2FwYWNpdHkgPSAyNTY7CiAg ICAgc3RhdGljIGNvbnN0IHNpemVfdCBidW1wUmFuZ2VDYWNoZUNhcGFjaXR5ID0gMzsKSW5kZXg6 IFNvdXJjZS9ibWFsbG9jL2JtYWxsb2MvVk1BbGxvY2F0ZS5oCj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJj ZS9ibWFsbG9jL2JtYWxsb2MvVk1BbGxvY2F0ZS5oCShyZXZpc2lvbiAxOTk3NTUpCisrKyBTb3Vy Y2UvYm1hbGxvYy9ibWFsbG9jL1ZNQWxsb2NhdGUuaAkod29ya2luZyBjb3B5KQpAQCAtMTQ1LDcg KzE0NSwxMCBAQCBpbmxpbmUgdm9pZCogdHJ5Vk1BbGxvY2F0ZShzaXplX3Qgdm1BbGlnCiAgICAg dm1WYWxpZGF0ZSh2bVNpemUpOwogICAgIHZtVmFsaWRhdGUodm1BbGlnbm1lbnQpOwogCi0gICAg c2l6ZV90IG1hcHBlZFNpemUgPSB2bUFsaWdubWVudCAtIHZtUGFnZVNpemUoKSArIHZtU2l6ZTsK KyAgICBzaXplX3QgbWFwcGVkU2l6ZSA9IHZtQWxpZ25tZW50ICsgdm1TaXplOworICAgIGlmICht YXBwZWRTaXplIDwgdm1BbGlnbm1lbnQgfHwgbWFwcGVkU2l6ZSA8IHZtU2l6ZSkgLy8gQ2hlY2sg Zm9yIG92ZXJmbG93CisgICAgICAgIHJldHVybiBudWxscHRyOworCiAgICAgY2hhciogbWFwcGVk ID0gc3RhdGljX2Nhc3Q8Y2hhcio+KHRyeVZNQWxsb2NhdGUobWFwcGVkU2l6ZSkpOwogICAgIGlm ICghbWFwcGVkKQogICAgICAgICByZXR1cm4gbnVsbHB0cjsKSW5kZXg6IFNvdXJjZS9ibWFsbG9j L2JtYWxsb2MvVk1IZWFwLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvYm1hbGxvYy9ibWFsbG9j L1ZNSGVhcC5jcHAJKHJldmlzaW9uIDE5OTc1NSkKKysrIFNvdXJjZS9ibWFsbG9jL2JtYWxsb2Mv Vk1IZWFwLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMzMsOCArMzMsMTUgQEAgWExhcmdlUmFuZ2Ug Vk1IZWFwOjp0cnlBbGxvY2F0ZUxhcmdlQ2h1bgogewogICAgIC8vIFdlIGFsbG9jYXRlIFZNIGlu IGFsaWduZWQgbXVsdGlwbGVzIHRvIGluY3JlYXNlIHRoZSBjaGFuY2VzIHRoYXQKICAgICAvLyB0 aGUgT1Mgd2lsbCBwcm92aWRlIGNvbnRpZ3VvdXMgcmFuZ2VzIHRoYXQgd2UgY2FuIG1lcmdlLgot ICAgIGFsaWdubWVudCA9IHJvdW5kVXBUb011bHRpcGxlT2Y8Y2h1bmtTaXplPihhbGlnbm1lbnQp OwotICAgIHNpemUgPSByb3VuZFVwVG9NdWx0aXBsZU9mPGNodW5rU2l6ZT4oc2l6ZSk7CisgICAg c2l6ZV90IHJvdW5kZWRBbGlnbm1lbnQgPSByb3VuZFVwVG9NdWx0aXBsZU9mPGNodW5rU2l6ZT4o YWxpZ25tZW50KTsKKyAgICBpZiAocm91bmRlZEFsaWdubWVudCA8IGFsaWdubWVudCkgLy8gQ2hl Y2sgZm9yIG92ZXJmbG93CisgICAgICAgIHJldHVybiBYTGFyZ2VSYW5nZSgpOworICAgIGFsaWdu bWVudCA9IHJvdW5kZWRBbGlnbm1lbnQ7CisKKyAgICBzaXplX3Qgcm91bmRlZFNpemUgPSByb3Vu ZFVwVG9NdWx0aXBsZU9mPGNodW5rU2l6ZT4oc2l6ZSk7CisgICAgaWYgKHJvdW5kZWRTaXplIDwg c2l6ZSkgLy8gQ2hlY2sgZm9yIG92ZXJmbG93CisgICAgICAgIHJldHVybiBYTGFyZ2VSYW5nZSgp OworICAgIHNpemUgPSByb3VuZGVkU2l6ZTsKIAogICAgIHZvaWQqIG1lbW9yeSA9IHRyeVZNQWxs b2NhdGUoYWxpZ25tZW50LCBzaXplKTsKICAgICBpZiAoIW1lbW9yeSkK