mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 04:07:44 +00:00
LibJS: Fix undefined behavior in HeapBlock
In C++, it's invalid to cast a block of memory to a complex type without invoking its constructor. It's even more invalid to simply cast a pointer to a block of memory to a pointer to *an abstract type*. To fix this, make sure FreelistEntry is a concrete type, and call its constructor whenever appropriate.
This commit is contained in:
parent
53a94b8bbd
commit
2fbc37befc
2 changed files with 23 additions and 12 deletions
|
@ -61,15 +61,16 @@ HeapBlock::HeapBlock(Heap& heap, size_t cell_size)
|
|||
: m_heap(heap)
|
||||
, m_cell_size(cell_size)
|
||||
{
|
||||
for (size_t i = 0; i < cell_count(); ++i) {
|
||||
auto* freelist_entry = static_cast<FreelistEntry*>(cell(i));
|
||||
ASSERT(cell_size >= sizeof(FreelistEntry));
|
||||
|
||||
FreelistEntry* next = nullptr;
|
||||
for (ssize_t i = cell_count() - 1; i >= 0; i--) {
|
||||
auto* freelist_entry = init_freelist_entry(i);
|
||||
freelist_entry->set_live(false);
|
||||
if (i == cell_count() - 1)
|
||||
freelist_entry->next = nullptr;
|
||||
else
|
||||
freelist_entry->next = static_cast<FreelistEntry*>(cell(i + 1));
|
||||
freelist_entry->next = next;
|
||||
next = freelist_entry;
|
||||
}
|
||||
m_freelist = static_cast<FreelistEntry*>(cell(0));
|
||||
m_freelist = next;
|
||||
}
|
||||
|
||||
Cell* HeapBlock::allocate()
|
||||
|
@ -84,7 +85,7 @@ void HeapBlock::deallocate(Cell* cell)
|
|||
ASSERT(cell->is_live());
|
||||
ASSERT(!cell->is_marked());
|
||||
cell->~Cell();
|
||||
auto* freelist_entry = static_cast<FreelistEntry*>(cell);
|
||||
auto* freelist_entry = new (cell) FreelistEntry();
|
||||
freelist_entry->set_live(false);
|
||||
freelist_entry->next = m_freelist;
|
||||
m_freelist = freelist_entry;
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue