mirror of
https://github.com/RPCS3/llvm-mirror.git
synced 2024-11-24 11:42:57 +01:00
0b9b4fd582
Context:
/// Double the size of the allocated memory, guaranteeing space for at
/// least one more element or MinSize if specified.
void grow(size_t MinSize = 0) { this->grow_pod(MinSize, sizeof(T)); }
void push_back(const T &Elt) {
if (LLVM_UNLIKELY(this->size() >= this->capacity()))
this->grow();
memcpy(reinterpret_cast<void *>(this->end()), &Elt, sizeof(T));
this->set_size(this->size() + 1);
}
When grow is called in push_back() without a MinSize specified, this is
relying on the guarantee of space for at least one more element.
There is an edge case bug where the SmallVector is already at its maximum size
and push_back() calls grow() with default MinSize of zero. Grow is unable to
provide space for one more element, but push_back() assumes the additional
element it will be available. This can result in silent memory corruption, as
this->end() will be an invalid pointer and the program may continue executing.
Another alternative to fix would be to remove the default argument from
grow(), which would mean several changing grow() to grow(this->size()+1)
in several places.
No test case added because it would require allocating ~4GB.
Reviewers: echristo
Subscribers: hiraditya, llvm-commits
Tags: #llvm
Differential Revision: https://reviews.llvm.org/D77601
73 lines
2.9 KiB
C++
73 lines
2.9 KiB
C++
//===- llvm/ADT/SmallVector.cpp - 'Normally small' vectors ----------------===//
|
|
//
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This file implements the SmallVector class.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "llvm/ADT/SmallVector.h"
|
|
using namespace llvm;
|
|
|
|
// Check that no bytes are wasted and everything is well-aligned.
|
|
namespace {
|
|
struct Struct16B {
|
|
alignas(16) void *X;
|
|
};
|
|
struct Struct32B {
|
|
alignas(32) void *X;
|
|
};
|
|
}
|
|
static_assert(sizeof(SmallVector<void *, 0>) ==
|
|
sizeof(unsigned) * 2 + sizeof(void *),
|
|
"wasted space in SmallVector size 0");
|
|
static_assert(alignof(SmallVector<Struct16B, 0>) >= alignof(Struct16B),
|
|
"wrong alignment for 16-byte aligned T");
|
|
static_assert(alignof(SmallVector<Struct32B, 0>) >= alignof(Struct32B),
|
|
"wrong alignment for 32-byte aligned T");
|
|
static_assert(sizeof(SmallVector<Struct16B, 0>) >= alignof(Struct16B),
|
|
"missing padding for 16-byte aligned T");
|
|
static_assert(sizeof(SmallVector<Struct32B, 0>) >= alignof(Struct32B),
|
|
"missing padding for 32-byte aligned T");
|
|
static_assert(sizeof(SmallVector<void *, 1>) ==
|
|
sizeof(unsigned) * 2 + sizeof(void *) * 2,
|
|
"wasted space in SmallVector size 1");
|
|
|
|
/// grow_pod - This is an implementation of the grow() method which only works
|
|
/// on POD-like datatypes and is out of line to reduce code duplication.
|
|
/// This function will report a fatal error if it cannot increase capacity.
|
|
void SmallVectorBase::grow_pod(void *FirstEl, size_t MinCapacity,
|
|
size_t TSize) {
|
|
// Ensure we can fit the new capacity in 32 bits.
|
|
if (MinCapacity > UINT32_MAX)
|
|
report_bad_alloc_error("SmallVector capacity overflow during allocation");
|
|
|
|
// Ensure we can meet the guarantee of space for at least one more element.
|
|
// The above check alone will not catch the case where grow is called with a
|
|
// default MinCapacity of 0, but the current capacity cannot be increased.
|
|
if (capacity() == size_t(UINT32_MAX))
|
|
report_bad_alloc_error("SmallVector capacity unable to grow");
|
|
|
|
size_t NewCapacity = 2 * capacity() + 1; // Always grow.
|
|
NewCapacity =
|
|
std::min(std::max(NewCapacity, MinCapacity), size_t(UINT32_MAX));
|
|
|
|
void *NewElts;
|
|
if (BeginX == FirstEl) {
|
|
NewElts = safe_malloc(NewCapacity * TSize);
|
|
|
|
// Copy the elements over. No need to run dtors on PODs.
|
|
memcpy(NewElts, this->BeginX, size() * TSize);
|
|
} else {
|
|
// If this wasn't grown from the inline copy, grow the allocated space.
|
|
NewElts = safe_realloc(this->BeginX, NewCapacity * TSize);
|
|
}
|
|
|
|
this->BeginX = NewElts;
|
|
this->Capacity = NewCapacity;
|
|
}
|