Commit bcb29fb
src: correctly report memory changes to V8
Call `V8::ExternalMemoryAccounter::Update` instead of
`V8::ExternalMemoryAccounter::Increase` to report memory difference to
V8
Calling `V8::ExternalMemoryAccounter::Increase` with a signed integer on
32-bit platforms causes instances where GC inside GC takes place leading
to a crash in certain cases.
During GC, native objects are destructed. In destructor for
`CompressionStream` class used by zlib, memory release information is
passed onto `V8::ExternalMemoryAccounter::Increase()` instead of
`V8::ExternalMemoryAccounter::Decrease()` which triggers V8's memory
limits, thus triggering GC inside GC which leads to crash.
Bug initially introduced in commit
1d5d7b6
For full report see https://hackerone.com/reports/3302484
PR-URL: #59623
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>1 parent 83d11f8 commit bcb29fb
2 files changed
Lines changed: 2 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -59,7 +59,7 @@ void* NgLibMemoryManager<Class, T>::ReallocImpl(void* ptr, | |||
| 59 | 59 | // Environment*/Isolate* parameter and call the V8 method transparently. | |
| 60 | 60 | const int64_t new_size = size - previous_size; | |
| 61 | 61 | manager->IncreaseAllocatedSize(new_size); | |
| 62 | - manager->env()->external_memory_accounter()->Increase( | ||
| 62 | + manager->env()->external_memory_accounter()->Update( | ||
| 63 | 63 | manager->env()->isolate(), new_size); | |
| 64 | 64 | *reinterpret_cast<size_t*>(mem) = size; | |
| 65 | 65 | mem += sizeof(size_t); | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -644,7 +644,7 @@ class CompressionStream : public AsyncWrap, public ThreadPoolWork { | |||
| 644 | 644 | if (report == 0) return; | |
| 645 | 645 | CHECK_IMPLIES(report < 0, zlib_memory_ >= static_cast<size_t>(-report)); | |
| 646 | 646 | zlib_memory_ += report; | |
| 647 | - AsyncWrap::env()->external_memory_accounter()->Increase( | ||
| 647 | + AsyncWrap::env()->external_memory_accounter()->Update( | ||
| 648 | 648 | AsyncWrap::env()->isolate(), report); | |
| 649 | 649 | } | |
| 650 | 650 | ||
0 commit comments