From e47d310a3af2880fac7512251aee518b380b62fe Mon Sep 17 00:00:00 2001 From: Kent Hansen Date: Mon, 24 Jan 2011 15:32:11 +0100 Subject: Fix crash in QtScript/JSC stack allocator on Symbian The reserved (virtual) size of the chunk is not necessarily a multiple of the "pool" size (the physical growth increment). The reserved size is only rounded up to a multiple of the page size (4K), not the pool size (64K). This meant that the commit of the _last_ part of the chunk could (and did) fail, because we tried to commit 64K while only a size <64K was remaining. Detect this case and reduce the requested size accordingly. Also add a call to CRASH() in case Commit() returns an error, to avoid obscure crashes in JSC at a later point (grow() must not fail). Task-number: QTBUG-16685 Reviewed-by: Simon Hausmann (cherry picked from commit 81941e4c5dcd18ef04b2b22dd3f1b4c04620647c) --- .../JavaScriptCore/wtf/symbian/RegisterFileAllocatorSymbian.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/symbian/RegisterFileAllocatorSymbian.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/symbian/RegisterFileAllocatorSymbian.cpp index da5cc99..e89dd7a 100644 --- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/symbian/RegisterFileAllocatorSymbian.cpp +++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/symbian/RegisterFileAllocatorSymbian.cpp @@ -83,10 +83,16 @@ void RegisterFileAllocator::grow(void* newEnd) TInt nBytes = (TInt)(newEnd) - (TInt)(m_comEnd); nBytes = SYMBIAN_ROUNDUPTOMULTIPLE(nBytes, m_poolSize); TInt offset = (TInt)m_comEnd - (TInt)m_buffer; + // The reserved size is not guaranteed to be a multiple of the pool size. + TInt maxBytes = (TInt)m_resEnd - (TInt)m_comEnd; + if (nBytes > maxBytes) + nBytes = maxBytes; TInt ret = m_chunk.Commit(offset, nBytes); if (ret == KErrNone) m_comEnd = (void*)(m_chunk.Base() + m_chunk.Size()); + else + CRASH(); } } -- cgit v0.12