Changeset 189012 in webkit
- Timestamp:
- Aug 26, 2015 10:54:21 PM (9 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 1 added
- 2 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r189009 r189012 1 2015-08-26 Saam barati <sbarati@apple.com> 2 3 MarkedBlock::allocateBlock will have the wrong allocation size when (sizeof(MarkedBlock) + bytes) is divisible by WTF::pageSize() 4 https://bugs.webkit.org/show_bug.cgi?id=148500 5 6 Reviewed by Mark Lam. 7 8 Consider the following scenario: 9 - On OS X, WTF::pageSize() is 4*1024 bytes. 10 - JSEnvironmentRecord::allocationSizeForScopeSize(6621) == 53000 11 - sizeof(MarkedBlock) == 248 12 - (248 + 53000) is a multiple of 4*1024. 13 - (248 + 53000)/(4*1024) == 13 14 15 We will allocate a chunk of memory of size 53248 bytes that looks like this: 16 0 248 256 53248 53256 17 [Marked Block | 8 bytes | payload ...... ] 8 bytes | 18 ^ ^ 19 Our Environment record starts here. ^ 20 ^ 21 Our last JSValue in the environment record will go from byte 53248 to 53256. But, we don't own this memory. 22 23 We need to ensure that we round up sizeof(MarkedBlock) to an 24 atomSize boundary. We need to do this because the first atom 25 inside the MarkedBlock will start at the rounded up multiple 26 of atomSize past MarkedBlock. If we end up with an allocation 27 that is perfectly aligned to the page size, then we will be short 28 8 bytes (in the current implementation where atomSize is 16 bytes, 29 and MarkedBlock is 248 bytes). 30 31 * heap/MarkedAllocator.cpp: 32 (JSC::MarkedAllocator::allocateBlock): 33 * tests/stress/heap-allocator-allocates-incorrect-size-for-activation.js: Added. 34 (use): 35 (makeFunction): 36 1 37 2015-08-26 Mark Lam <mark.lam@apple.com> 2 38 -
trunk/Source/JavaScriptCore/heap/MarkedAllocator.cpp
r182747 r189012 176 176 { 177 177 size_t minBlockSize = MarkedBlock::blockSize; 178 size_t minAllocationSize = WTF::roundUpToMultipleOf(WTF::pageSize(), sizeof(MarkedBlock) + bytes); 178 size_t minAllocationSize = WTF::roundUpToMultipleOf<MarkedBlock::atomSize>(sizeof(MarkedBlock)) + WTF::roundUpToMultipleOf<MarkedBlock::atomSize>(bytes); 179 minAllocationSize = WTF::roundUpToMultipleOf(WTF::pageSize(), minAllocationSize); 179 180 size_t blockSize = std::max(minBlockSize, minAllocationSize); 180 181
Note: See TracChangeset
for help on using the changeset viewer.