V8 crashes when profile generator is trying to allocate a raw_entries_ buffer more than 2Gb.

src/profile-generator.h

Index: src/profile-generator.h
diff --git a/src/profile-generator.h b/src/profile-generator.h
index f9ae5f9d26bd5b66ff7fda38312654e5ed8073b2..e06a87cb6b4c825ce2492615321cd792d163df18 100644
--- a/src/profile-generator.h
+++ b/src/profile-generator.h
@@ -575,16 +575,18 @@ class HeapEntry BASE_EMBEDDED {
                          int retainer_index);
   void SetUnidirElementReference(int child_index, int index, HeapEntry* entry);
 
-  int EntrySize() { return EntriesSize(1, children_count_, retainers_count_); }
+  uint64_t EntrySize() {
+    return EntriesSize(1, children_count_, retainers_count_);
+  }
 
   void Print(
       const char* prefix, const char* edge_name, int max_depth, int indent);
 
   Handle<HeapObject> GetHeapObject();
 
-  static int EntriesSize(int entries_count,
-                         int children_count,
-                         int retainers_count);
+  static uint64_t EntriesSize(int entries_count,
+                              int children_count,
+                              int retainers_count);
 
  private:
   HeapGraphEdge* children_arr() {
@@ -617,6 +619,7 @@ class HeapEntry BASE_EMBEDDED {
 
 
 class HeapSnapshotsCollection;
+class RawEntriesStorage;
 
 // HeapSnapshot represents a single heap snapshot. It is stored in
 // HeapSnapshotsCollection, which is also a factory for
@@ -645,7 +648,7 @@ class HeapSnapshot {
   HeapEntry* natives_root() { return natives_root_entry_; }
   HeapEntry* gc_subroot(int index) { return gc_subroot_entries_[index]; }
   List<HeapEntry*>* entries() { return &entries_; }
-  int raw_entries_size() { return raw_entries_size_; }
+  uint64_t raw_entries_size() { return raw_entries_size_; }

[mnaganov (inactive), 2012/03/08 15:25:10]

Why not size_t?

 
   void AllocateEntries(
       int entries_count, int children_count, int retainers_count);
@@ -672,7 +675,7 @@ class HeapSnapshot {
   void PrintEntriesSize();
 
  private:
-  HeapEntry* GetNextEntryToInit();
+  HeapEntry* GetNextEntryToInit(size_t size);
 
   HeapSnapshotsCollection* collection_;
   Type type_;
@@ -682,10 +685,10 @@ class HeapSnapshot {
   HeapEntry* gc_roots_entry_;
   HeapEntry* natives_root_entry_;
   HeapEntry* gc_subroot_entries_[VisitorSynchronization::kNumberOfSyncTags];
-  char* raw_entries_;
+  RawEntriesStorage* raw_entries_;
   List<HeapEntry*> entries_;
   bool entries_sorted_;
-  int raw_entries_size_;
+  uint64_t raw_entries_size_;
 
   friend class HeapSnapshotTester;
 
@@ -1142,8 +1145,6 @@ class HeapSnapshotJSONSerializer {
   void SerializeStrings();
   void SortHashMap(HashMap* map, List<HashMap::Entry*>* sorted_entries);
 
-  static const int kMaxSerializableSnapshotRawSize;
-
   HeapSnapshot* snapshot_;
   HashMap nodes_;
   HashMap strings_;