From efe23b7595744eb1f068bbd2816ba973ad4fcee2 Mon Sep 17 00:00:00 2001
From: Cheng Zhao <zcbenz@gmail.com>
Date: Tue, 9 May 2017 14:12:39 +0900
Subject: [PATCH] Use Node's memory allocator for ArrayBuffer

For Buffers created in Node, they are usually allocated in Node and
freed by Chromium's allocator, which will cause crashes when Node and
Chromium are using different allocators.

This commit makes Chromium use Node' allocator for ArrayBuffers.
---
 atom/browser/javascript_environment.cc | 31 ++++++++++++++++++++++++--
 atom/browser/javascript_environment.h  |  9 ++++++++
 atom/node/osfhandle.cc                 | 13 +++++++++++
 atom/node/osfhandle.h                  |  6 +++++
 4 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/atom/browser/javascript_environment.cc b/atom/browser/javascript_environment.cc
index b7e3aae20a..d13b955972 100644
--- a/atom/browser/javascript_environment.cc
+++ b/atom/browser/javascript_environment.cc
@@ -10,13 +10,40 @@
 #include "base/message_loop/message_loop.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/public/common/content_switches.h"
-#include "gin/array_buffer.h"
 #include "gin/v8_initializer.h"
 
+#if defined(OS_WIN)
+#include "atom/node/osfhandle.h"
+#endif
+
 #include "atom/common/node_includes.h"
 
 namespace atom {
 
+void* ArrayBufferAllocator::Allocate(size_t length) {
+#if defined(OS_WIN)
+  return node::ArrayBufferCalloc(length);
+#else
+  return calloc(1, length);
+#endif
+}
+
+void* ArrayBufferAllocator::AllocateUninitialized(size_t length) {
+#if defined(OS_WIN)
+  return node::ArrayBufferMalloc(length);
+#else
+  return malloc(length);
+#endif
+}
+
+void ArrayBufferAllocator::Free(void* data, size_t length) {
+#if defined(OS_WIN)
+  node::ArrayBufferFree(data, length);
+#else
+  free(data);
+#endif
+}
+
 JavascriptEnvironment::JavascriptEnvironment()
     : initialized_(Initialize()),
       isolate_holder_(base::ThreadTaskRunnerHandle::Get()),
@@ -46,7 +73,7 @@ bool JavascriptEnvironment::Initialize() {
 
   gin::IsolateHolder::Initialize(gin::IsolateHolder::kNonStrictMode,
                                  gin::IsolateHolder::kStableV8Extras,
-                                 gin::ArrayBufferAllocator::SharedInstance());
+                                 &allocator_);
   return true;
 }
 
diff --git a/atom/browser/javascript_environment.h b/atom/browser/javascript_environment.h
index 43a7295f90..75d1629f66 100644
--- a/atom/browser/javascript_environment.h
+++ b/atom/browser/javascript_environment.h
@@ -14,6 +14,14 @@ class Environment;
 
 namespace atom {
 
+// ArrayBuffer's allocator, used on Chromium's side.
+class ArrayBufferAllocator : public v8::ArrayBuffer::Allocator {
+ public:
+  void* Allocate(size_t length) override;
+  void* AllocateUninitialized(size_t length) override;
+  void Free(void* data, size_t length) override;
+};
+
 // Manage the V8 isolate and context automatically.
 class JavascriptEnvironment {
  public:
@@ -31,6 +39,7 @@ class JavascriptEnvironment {
   bool Initialize();
 
   bool initialized_;
+  ArrayBufferAllocator allocator_;
   gin::IsolateHolder isolate_holder_;
   v8::Isolate* isolate_;
   v8::Isolate::Scope isolate_scope_;
diff --git a/atom/node/osfhandle.cc b/atom/node/osfhandle.cc
index ae5ee725d7..e9ec03a5c8 100644
--- a/atom/node/osfhandle.cc
+++ b/atom/node/osfhandle.cc
@@ -25,6 +25,7 @@
 #include "third_party/icu/source/i18n/unicode/uregex.h"
 #include "third_party/icu/source/i18n/unicode/uspoof.h"
 #include "third_party/icu/source/i18n/unicode/usearch.h"
+#include "util-inl.h"
 #include "v8-profiler.h"
 #include "v8-inspector.h"
 
@@ -38,6 +39,18 @@ int close(int fd) {
   return _close(fd);
 }
 
+void* ArrayBufferCalloc(size_t length) {
+  return UncheckedCalloc(length);
+}
+
+void* ArrayBufferMalloc(size_t length) {
+  return UncheckedMalloc(length);
+}
+
+void ArrayBufferFree(void* data, size_t length) {
+  return ::free(data);
+}
+
 void ReferenceSymbols() {
   // Following symbols are used by electron.exe but got stripped by compiler,
   // by using the symbols we can force compiler to keep the objects in node.dll,
diff --git a/atom/node/osfhandle.h b/atom/node/osfhandle.h
index 1427bb8951..58f87198ae 100644
--- a/atom/node/osfhandle.h
+++ b/atom/node/osfhandle.h
@@ -21,6 +21,12 @@ namespace node {
 __declspec(dllexport) int open_osfhandle(intptr_t osfhandle, int flags);
 __declspec(dllexport) int close(int fd);
 
+// Memory allocation functions from Node's module, used by ArrayBuffer allocator
+// to make sure memories are allocated and freed with the same allocator.
+__declspec(dllexport) void* ArrayBufferCalloc(size_t length);
+__declspec(dllexport) void* ArrayBufferMalloc(size_t length);
+__declspec(dllexport) void ArrayBufferFree(void* data, size_t length);
+
 // A trick to force referencing symbols.
 __declspec(dllexport) void ReferenceSymbols();