[codegen] Fix signed integer overflow in Assembler::GrowBuffer [v8/v8 : main]
0 views
Skip to first unread message
Victor Gomes (Gerrit)
Apr 27, 2026, 9:36:29 AM (yesterday) Apr 27
to Leszek Swirski, leszek...@chromium.org, v8-mip...@googlegroups.com, v8-ppc...@googlegroups.com, v8-re...@googlegroups.com, v8-risc...@chromium.org, verwaes...@chromium.org
Attention needed from Leszek Swirski
Victor Gomes voted and added 1 comment![]( "Open in Gerrit")
Votes added by Victor Gomes
| Auto-Submit | +1 |
| Commit-Queue | +1 |
1 comment
Patchset-level comments
File-level comment, Patchset 1 (Latest):
Victor Gomes . resolved
PTAL!
Currently x64 and ia32 we double the buffer size when we grow, while arm/arm64 it is capped to 1MB. I replicated that, but maybe we should only use the 1MB strategy? It might make more sense?
Regarding repro, it is too slow even in release mode...
Related details
Attention is currently required from:
- Leszek Swirski
Submit Requirements:
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Leszek Swirski (Gerrit)
8:12 AM (11 hours ago) 8:12 AM
to Victor Gomes, v8-s...@luci-project-accounts.iam.gserviceaccount.com, leszek...@chromium.org, v8-mip...@googlegroups.com, v8-ppc...@googlegroups.com, v8-re...@googlegroups.com, v8-risc...@chromium.org, verwaes...@chromium.org
Attention needed from Victor Gomes
Leszek Swirski voted![]( "Open in Gerrit")
Attention is currently required from:
- Victor Gomes
Submit Requirements:
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
v8-scoped@luci-project-accounts.iam.gserviceaccount.com (Gerrit)
8:14 AM (11 hours ago) 8:14 AM
to Victor Gomes, Leszek Swirski, leszek...@chromium.org, v8-mip...@googlegroups.com, v8-ppc...@googlegroups.com, v8-re...@googlegroups.com, v8-risc...@chromium.org, verwaes...@chromium.org
v8-s...@luci-project-accounts.iam.gserviceaccount.com submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[codegen] Fix signed integer overflow in Assembler::GrowBuffer
Compiling extremely large functions could cause `Assembler::GrowBuffer`
to calculate a negative buffer size due to a signed integer overflow
when doubling the size. This bypassed the out-of-memory guard and
resulted in a massive heap-based buffer overflow.
This CL fixes the issue by:
1. Moving `kMaximalBufferSize` to `AssemblerBase` as a common constant.
2. Adding a non-static helper method `ComputeNewBufferSize` to
`AssemblerBase` that takes a `BufferGrowthStrategy` enum flag.
3. Adding a `DCHECK` to ensure the new size fits within `int` boundaries.
4. Updating `GrowBuffer` in arm, arm64, ia32, and x64 to use this helper.
5. Adding a check against `kMaximalBufferSize` in
`BaselineCompiler::AllocateBuffer` to prevent huge initial
allocations.
TAG=agy
CONV=d58d11be-b7cb-4eab-a315-ddefcb616292
Fixed: 506629455
Change-Id: Iff3ee491f911b9183c9680db84417de9e89ed72d
Commit-Queue: Leszek Swirski <les...@chromium.org>
Reviewed-by: Leszek Swirski <les...@chromium.org>
Auto-Submit: Victor Gomes <victo...@chromium.org>
Cr-Commit-Position: refs/heads/main@{#106882}
Files:
- M src/baseline/baseline-compiler.cc
- M src/codegen/arm/assembler-arm.cc
- M src/codegen/arm/assembler-arm.h
- M src/codegen/arm64/assembler-arm64.cc
- M src/codegen/arm64/assembler-arm64.h
- M src/codegen/assembler.cc
- M src/codegen/assembler.h
- M src/codegen/ia32/assembler-ia32.cc
- M src/codegen/ia32/assembler-ia32.h
- M src/codegen/x64/assembler-x64.cc
- M src/codegen/x64/assembler-x64.h
Change size: M
Delta: 11 files changed, 34 insertions(+), 41 deletions(-)
Branch: refs/heads/main
Submit Requirements:
Code-Review: +1 by Leszek Swirski
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Yahan Lu (LuYahan) (Gerrit)
10:48 AM (9 hours ago) 10:48 AM
to Ji Qiu, v8-s...@luci-project-accounts.iam.gserviceaccount.com, v8-re...@googlegroups.com, v8-risc...@chromium.org
Attention needed from Ji Qiu
Yahan Lu (LuYahan) voted Auto-Submit+1![]( "Open in Gerrit")
Attention is currently required from:
- Ji Qiu
Submit Requirements:
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages