tree bc23feb2fc51195414d53798b43605efe8857448
parent 987358ede382fc725785660430be3ec70fdc0a7d
author Bryan Ferris <bferris@google.com> 1551838011 -0800
committer android-build-team Robot <android-build-team-robot@google.com> 1552508049 +0000

[RESTRICT AUTOMERGE] Fix Integer Overflow in libpac

Bug: 117556220

Test: /data/local/nativetest/proxy_resolver_v8_unittest/proxy_resolver_v8_unittest

Test: gts-tradefed run gts --test \
  com.google.android.gts.devicepolicy.DeviceOwnerTest#testProxyPacProxyTest \
  --module GtsGmscoreHostTestCases

Test: PoC from bug report

From the upstream patch
(https://chromium.googlesource.com/v8/v8.git/+/7b27040e66c8a83006aebc90fe97d21bb42156a7%5E%21/#F0):

"""
Harden JSFunction::CalculateInstanceSizeHelper(...)
"""

Change-Id: I72321236f4d4cf8da993addc3ef7a1dc018c434b
(cherry picked from commit 359b0da753d41b6b10307323c20ae662b20ec70a)