AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix test for overflow in memory allocation Failure payload.

Browse Source 
It bailed out too early, and could give a DEBUG assertion failure due
to right shift being artihmetic. Changed values to unsigned to be safe.

Review URL: http://codereview.chromium.org/661076

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3948 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
lrn@chromium.org 2010-02-25 12:28:35 +00:00
parent 2c872c26fd
commit 024faf1105
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/objects-inl.h
View File

@ -840,15 +840,17 @@ Failure* Failure::OutOfMemoryException() {
intptr_t Failure::value() const {
return reinterpret_cast<intptr_t>(this) >> kFailureTagSize;
return static_cast<intptr_t>(
reinterpret_cast<uintptr_t>(this) >> kFailureTagSize);
}
Failure* Failure::RetryAfterGC(int requested_bytes) {
// Assert that the space encoding fits in the three bytes allotted for it.
ASSERT((LAST_SPACE & ~kSpaceTagMask) == 0);
intptr_t requested = requested_bytes >> kObjectAlignmentBits;
int tag_bits = kSpaceTagSize + kFailureTypeTagSize;
uintptr_t requested =
static_cast<uintptr_t>(requested_bytes >> kObjectAlignmentBits);
int tag_bits = kSpaceTagSize + kFailureTypeTagSize + kFailureTagSize;
if (((requested << tag_bits) >> tag_bits) != requested) {
// No room for entire requested size in the bits. Round down to
// maximally representable size.
@ -861,7 +863,8 @@ Failure* Failure::RetryAfterGC(int requested_bytes) {
Failure* Failure::Construct(Type type, intptr_t value) {
intptr_t info = (static_cast<intptr_t>(value) << kFailureTypeTagSize) | type;
uintptr_t info =
(static_cast<uintptr_t>(value) << kFailureTypeTagSize) | type;
ASSERT(((info << kFailureTagSize) >> kFailureTagSize) == info);
return reinterpret_cast<Failure*>((info << kFailureTagSize) | kFailureTag);
}