Commit 7cb5c09
deps: cherry-pick 9a49b22 from V8 upstream
Original commit message:
Fix alloc/dealloc size mismatch for v8::BackingStore
On newer compilers the {operator delete} with explicit {size_t}
argument would be instantiated for {v8::BackingStore} and used
in the destructor of {std::unique_ptr<v8::BackingStore>}. The {size_t}
argument is wrong though, since the pointer actually points
to a {v8::internal::BackingStore} object.
The solution is to explicitly provide a {operator delete}, preventing
an implicitly generated {size_t} operator.
Bug:v8:11081
Change-Id: Iee0aa47a67f0e41000bea628942f7e3d70198b83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2506712
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70916}
PR-URL: #35939
Fixes: #35669
Refs: v8/v8@9a49b22
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>1 parent af2a560 commit 7cb5c09
2 files changed
Lines changed: 8 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -36,7 +36,7 @@ | |||
| 36 | 36 | ||
| 37 | 37 | # Reset this number to 0 on major V8 upgrades. | |
| 38 | 38 | # Increment by one for each non-official patch applied to deps/v8. | |
| 39 | - 'v8_embedder_string': '-node.16', | ||
| 39 | + 'v8_embedder_string': '-node.17', | ||
| 40 | 40 | ||
| 41 | 41 | ##### V8 defaults for Node.js ##### | |
| 42 | 42 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -5020,6 +5020,13 @@ class V8_EXPORT BackingStore : public v8::internal::BackingStoreBase { | |||
| 5020 | 5020 | */ | |
| 5021 | 5021 | bool IsShared() const; | |
| 5022 | 5022 | ||
| 5023 | + /** | ||
| 5024 | + * Prevent implicit instantiation of operator delete with size_t argument. | ||
| 5025 | + * The size_t argument would be incorrect because ptr points to the | ||
| 5026 | + * internal BackingStore object. | ||
| 5027 | + */ | ||
| 5028 | + void operator delete(void* ptr) { ::operator delete(ptr); } | ||
| 5029 | + | ||
| 5023 | 5030 | /** | |
| 5024 | 5031 | * Wrapper around ArrayBuffer::Allocator::Reallocate that preserves IsShared. | |
| 5025 | 5032 | * Assumes that the backing_store was allocated by the ArrayBuffer allocator | |
0 commit comments