diff --git a/deps/v8/src/zone-inl.h b/deps/v8/src/zone-inl.h index e312b20899d12d..076556e1462fb8 100644 --- a/deps/v8/src/zone-inl.h +++ b/deps/v8/src/zone-inl.h @@ -55,7 +55,10 @@ inline void* Zone::New(int size) { // Check if the requested size is available without expanding. Address result = position_; - if (size > limit_ - position_) { + const uintptr_t limit = reinterpret_cast(limit_); + const uintptr_t position = reinterpret_cast(position_); + // position_ > limit_ can be true after the alignment correction above. + if (limit < position || size > limit - position) { result = NewExpand(size); } else { position_ += size; diff --git a/deps/v8/src/zone.cc b/deps/v8/src/zone.cc index 51b8113a0d912e..5db12be3e33ad1 100644 --- a/deps/v8/src/zone.cc +++ b/deps/v8/src/zone.cc @@ -168,7 +168,10 @@ Address Zone::NewExpand(int size) { // Make sure the requested size is already properly aligned and that // there isn't enough room in the Zone to satisfy the request. ASSERT(size == RoundDown(size, kAlignment)); - ASSERT(size > limit_ - position_); + ASSERT(limit_ < position_ || + reinterpret_cast(limit_) - + reinterpret_cast(position_) < + size); // Compute the new segment size. We use a 'high water mark' // strategy, where we increase the segment size every time we expand