diff options
| author | Xin Li <delphij@google.com> | 2020-09-08 16:55:06 -0700 |
|---|---|---|
| committer | Xin Li <delphij@google.com> | 2020-09-08 16:55:06 -0700 |
| commit | 3c4b113b747f5d5471d6c648993f120ad73b8869 (patch) | |
| tree | 294ce12a0b988dff27483e1b0662d6f82d23a959 | |
| parent | c81061f0e7ff2770c8c4aee88f8c3c7df80f85f0 (diff) | |
| parent | 2ec5f7384933e31f90fa0c5a24a4e14205a95372 (diff) | |
| download | v8-3c4b113b747f5d5471d6c648993f120ad73b8869.tar.gz | |
Merge Android R
Bug: 168057903
Merged-In: Idf5e53bd1a54aa5b8b8a831db8bf1c67703e5552
Change-Id: I84b14fdd858f0afc9b7143518ff7a898dc3a97ad
| -rw-r--r-- | Android.v8.bp | 4 | ||||
| -rw-r--r-- | src/heap/factory.cc | 2 | ||||
| -rw-r--r-- | tools/cfi/blacklist.txt | 3 |
3 files changed, 8 insertions, 1 deletions
diff --git a/Android.v8.bp b/Android.v8.bp index 81f82af0..bd839ab7 100644 --- a/Android.v8.bp +++ b/Android.v8.bp @@ -614,4 +614,8 @@ cc_library_static { ], generated_headers: ["v8_torque_file"], generated_sources: ["v8_torque_file_cc"], + sanitize: { + cfi: true, + blocklist: "./tools/cfi/blacklist.txt", + }, } diff --git a/src/heap/factory.cc b/src/heap/factory.cc index c8528f9f..2ac0d990 100644 --- a/src/heap/factory.cc +++ b/src/heap/factory.cc @@ -469,7 +469,7 @@ Handle<FixedArrayBase> Factory::NewFixedDoubleArray(int length, PretenureFlag pretenure) { DCHECK_LE(0, length); if (length == 0) return empty_fixed_array(); - if (length > FixedDoubleArray::kMaxLength) { + if (length < 0 || length > FixedDoubleArray::kMaxLength) { isolate()->heap()->FatalProcessOutOfMemory("invalid array length"); } int size = FixedDoubleArray::SizeFor(length); diff --git a/tools/cfi/blacklist.txt b/tools/cfi/blacklist.txt index c1571b8c..822f83f1 100644 --- a/tools/cfi/blacklist.txt +++ b/tools/cfi/blacklist.txt @@ -24,3 +24,6 @@ fun:*PendingPhantomCallback*Invoke* fun:*GlobalHandles*PostGarbageCollectionProcessing* fun:*InvokeAccessorGetterCallback* + +# check for type failed during indirect function call +fun:*MemMove* |