Commit cbf81194 authored by David Benjamin's avatar David Benjamin Committed by Commit Bot

[zone] Avoid undefined behavior in edge case

If buffer_ is empty and start_ is zero, even though the MemCopy would be
a no-op, &buffer_[start_] is undefined. buffer_.data() + start_ would
work, but due to a C/C++ language bug, that is technically undefined
too[*] if an empty buffer_.data() returns nullptr, so add a length() ==
0 check, matching methods above.

This was caught by building with _LIBCPP_DEBUG=0.

[*] https://www.imperialviolet.org/2016/06/26/nonnull.html

Bug: chromium:893810
Change-Id: I9f0834ffae6769e0e191e786842e6ecc6c95a58a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1483616Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
Commit-Queue: David Benjamin <davidben@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60016}
parent 37ff95ad
......@@ -7,6 +7,7 @@
#include <algorithm>
#include <limits>
#include <vector>
#include "src/base/hashmap.h"
#include "src/base/logging.h"
......@@ -365,7 +366,9 @@ class ScopedPtrList final {
Vector<T*> CopyTo(Zone* zone) {
DCHECK_LE(end_, buffer_.size());
T** data = zone->NewArray<T*>(length());
MemCopy(data, &buffer_[start_], length() * sizeof(T*));
if (length() != 0) {
MemCopy(data, &buffer_[start_], length() * sizeof(T*));
}
return Vector<T*>(data, length());
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment