Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(833)

Unified Diff: runtime/vm/intrinsifier_ia32.cc

Issue 10917223: Guard against allocation top overflow in ObjectArray_Allocate intrinsic. (Closed) Base URL: https://dart.googlecode.com/svn/branches/bleeding_edge/dart
Patch Set: remove debugging changes Created 8 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « runtime/vm/constants_x64.h ('k') | runtime/vm/intrinsifier_x64.cc » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: runtime/vm/intrinsifier_ia32.cc
diff --git a/runtime/vm/intrinsifier_ia32.cc b/runtime/vm/intrinsifier_ia32.cc
index fa1620561558faa4290270f8f7472abd2588a7c6..b947c8579edb659d0f7e4767c17f5eba7cc99a9c 100644
--- a/runtime/vm/intrinsifier_ia32.cc
+++ b/runtime/vm/intrinsifier_ia32.cc
@@ -58,9 +58,12 @@ bool Intrinsifier::ObjectArray_Allocate(Assembler* assembler) {
Isolate* isolate = Isolate::Current();
Heap* heap = isolate->heap();
- // EDI: allocation size.
__ movl(EAX, Address::Absolute(heap->TopAddress()));
- __ leal(EBX, Address(EAX, EDI, TIMES_1, 0));
+ __ movl(EBX, EAX);
+
+ // EDI: allocation size.
+ __ addl(EBX, EDI);
+ __ j(CARRY, &fall_through);
// Check if the allocation fits into the remaining space.
// EAX: potential new object start.
« no previous file with comments | « runtime/vm/constants_x64.h ('k') | runtime/vm/intrinsifier_x64.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698