-
Dominik Inführ authored
The counter as size_t can legitimately overflow on 32-bit systems, since decreasing the counters is performed after all backing stores were freed on a background thread. Before sweeping is finished a new backing store could already be allocated which then leads to the overflow. Bug: v8:11788, chromium:1211437 Change-Id: Id9f3e58b0e84e831fe47109f7deb3a05ae7e489c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2922242 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#74836}
0ebe286f