Commit 4f9d7a94 authored by Jakob Gruber's avatar Jakob Gruber Committed by Commit Bot

[snapshot] Align internal snapshot data

When the snapshot blob is not aligned properly, loading it can cause a
crash on platforms such as arm.

This was exposed by a SIGBUS/BUS_ADRALN crash on arm when accessing
the blob_data symbol (declared as a byte array) through a reinterpret
cast to uintptr_t in an internal snapshot build.

Thanks to florian.dold@gmail.com for the initial patch.

Bug: v8:9171
Change-Id: I99b071dec3733416f2f01b58a770e30d8f2dcdf2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1582402
Commit-Queue: Dan Elphick <delphick@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: 's avatarDan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61000}
parent 78dfde9d
......@@ -87,7 +87,8 @@ class SnapshotFileWriter {
static void WriteSnapshotFileData(FILE* fp,
const i::Vector<const i::byte>& blob) {
fprintf(fp, "static const byte blob_data[] = {\n");
fprintf(fp,
"alignas(kPointerAlignment) static const byte blob_data[] = {\n");
WriteBinaryContentsAsCArray(fp, blob);
fprintf(fp, "};\n");
fprintf(fp, "static const int blob_size = %d;\n", blob.length());
......
......@@ -375,8 +375,9 @@ class Checksum {
// Fletcher's checksum. Modified to reduce 64-bit sums to 32-bit.
uintptr_t a = 1;
uintptr_t b = 0;
const uintptr_t* cur = reinterpret_cast<const uintptr_t*>(payload.start());
DCHECK(IsAligned(reinterpret_cast<intptr_t>(payload.start()), kIntptrSize));
DCHECK(IsAligned(payload.length(), kIntptrSize));
const uintptr_t* cur = reinterpret_cast<const uintptr_t*>(payload.start());
const uintptr_t* end = cur + payload.length() / kIntptrSize;
while (cur < end) {
// Unsigned overflow expected and intended.
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment