deps: update ChakraCore to chakra-core/ChakraCore@153b5c60a2

[MERGE #5526 @leirocks] fix CustomHeap Page::CanAllocate calculation Merge pull request #5526 from leirocks:customheap CustomHeap page use power of 2 bucketing, CanAllocate uses linear method to find the big enough chunk to split later there's check again while allocation from this page, and the allocation would fail so it's not a security issue Reviewed-By: chakrabot <[email protected]>
nodejs · Aug 4, 2018 · 2cbfd42 · 2cbfd42
1 parent 1935684
commit 2cbfd42
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 12 deletions.
diff --git a/deps/chakrashim/core/lib/Common/Memory/CustomHeap.cpp b/deps/chakrashim/core/lib/Common/Memory/CustomHeap.cpp
@@ -1102,17 +1102,9 @@ inline BucketId GetBucketForSize(size_t bytes)
         return BucketId::LargeObjectList;
     }
 
-    BucketId bucket = (BucketId) (log2(bytes) - 7);
-
-    // < 8 => 0
-    // 8 => 1
-    // 9 => 2 ...
+    BucketId bucket = (BucketId) (log2(bytes / Page::sizePerBit));
     Assert(bucket < BucketId::LargeObjectList);
-
-    if (bucket < BucketId::SmallObjectList)
-    {
-        bucket = BucketId::SmallObjectList;
-    }
+    Assert(bucket >= BucketId::SmallObjectList);
 
     return bucket;
 }

diff --git a/deps/chakrashim/core/lib/Common/Memory/CustomHeap.h b/deps/chakrashim/core/lib/Common/Memory/CustomHeap.h
@@ -57,7 +57,7 @@ struct Page
 
     bool CanAllocate(BucketId targetBucket)
     {
-        return freeBitVector.FirstStringOfOnes(targetBucket + 1) != BVInvalidIndex;
+        return freeBitVector.FirstStringOfOnes(1 << targetBucket) != BVInvalidIndex;
     }
 
     Page(__in char* address, void* segment, BucketId bucket):
@@ -72,8 +72,9 @@ struct Page
 
     // Each bit in the bit vector corresponds to 128 bytes of memory
     // This implies that 128 bytes is the smallest allocation possible
-    static const uint Alignment = 128;
     static const uint MaxAllocationSize = 4096;
+    static const uint sizePerBit = MaxAllocationSize / 32; // pagesize / freeBitVector bit count
+    static const uint Alignment = sizePerBit; // 128
 };
 
 struct Allocation