diff --git a/src/heap/cppgc/object-start-bitmap.h b/src/heap/cppgc/object-start-bitmap.h index 112ed653ac1..56aadd934de 100644 --- a/src/heap/cppgc/object-start-bitmap.h +++ b/src/heap/cppgc/object-start-bitmap.h @@ -129,6 +129,12 @@ HeapObjectHeader* ObjectStartBitmap::FindHeader( DCHECK_LT(0u, cell_index); byte = load(--cell_index); } + // Bandaid: if the scan reached cell 0 with no bit set, CountLeadingZeros(0) + // would yield object_start_number = SIZE_MAX and return page_base - 8 (i.e. + // the tail of the *adjacent* cage slot). This state is reachable on + // weak-memory hardware via a concurrent-marker / Member relaxed-store + // race. Crash safely instead of dereferencing groomed adjacent-page bytes. + CHECK_NE(0, byte); const int leading_zeroes = v8::base::bits::CountLeadingZeros(byte); object_start_number = (cell_index * kBitsPerCell) + (kBitsPerCell - 1) - leading_zeroes;