Commit 7edeea56 authored by Ken Rockot's avatar Ken Rockot Committed by Commit Bot

Crash when large BigBuffer shm allocation fails

This intentionally CHECK-fails when shared memory allocation fails on
BigBuffer construction in the case where the buffer is would be too
large for IPC if inlined. This allows such cases to be disambiguated
from other large-IPC failures.

Bug: 872237
Change-Id: I518dbea3007094a3136bfa1449f85eaefbbc7171
Reviewed-on: https://chromium-review.googlesource.com/1208719Reviewed-by: default avatarReilly Grant <reillyg@chromium.org>
Commit-Queue: Ken Rockot <rockot@chromium.org>
Cr-Commit-Position: refs/heads/master@{#589170}
parent d5335bb2
...@@ -101,6 +101,12 @@ BigBufferView::BigBufferView(base::span<const uint8_t> bytes) { ...@@ -101,6 +101,12 @@ BigBufferView::BigBufferView(base::span<const uint8_t> bytes) {
static_cast<uint8_t*>(shared_memory_->buffer_mapping_.get())); static_cast<uint8_t*>(shared_memory_->buffer_mapping_.get()));
return; return;
} }
// Shared memory allocation failed, so we're going to inline the data. If
// the data is large enough to be rejected by Mojo internals, we crash early
// to disambiguate this case from other intentional large-IPC crashes. See
// https://crbug.com/872237.
CHECK_LE(bytes.size(), 127u * 1024 * 1024);
} }
// Either the data is small enough or shared memory allocation failed. Either // Either the data is small enough or shared memory allocation failed. Either
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment