tree 6adb7e82b8971c88eb5853c3411c45014e2c4b93
parent f88303717d5ed67e6ba13c7177ebd3aada958caf
author Bryan Ferris <bferris@google.com> 1551838011 -0800
committer Bryan Ferris <bferris@google.com> 1551997948 -0800

Fix Integer Overflow in libpac

From the upstream patch
(https://chromium.googlesource.com/v8/v8.git/+/7b27040e66c8a83006aebc90fe97d21bb42156a7%5E%21/#F0):

"""
Harden JSFunction::CalculateInstanceSizeHelper(...)
"""

Bug: 117556220

Test: /data/local/nativetest/proxy_resolver_v8_unittest/proxy_resolver_v8_unittest

Test: gts-tradefed run gts --test \
  com.google.android.gts.devicepolicy.DeviceOwnerTest#testProxyPacProxyTest \
  --module GtsGmscoreHostTestCases

Test: PoC from bug report

Merged-In: I2e02d994f107e64e4f465b4d8a02d4159a95240e

Change-Id: I72321236f4d4cf8da993addc3ef7a1dc018c434b