Changeset 252341 in webkit

Timestamp:

Nov 11, 2019 3:57:40 PM (4 years ago)

Author:

ysuzuki@apple.com

Message:

Unreviewed, fix alignment adjustment when reusing PreciseAllocation
​https://bugs.webkit.org/show_bug.cgi?id=201908

• heap/PreciseAllocation.cpp:

(JSC::PreciseAllocation::reuseForLowerTier):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• heap/PreciseAllocation.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-11-11  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        Unreviewed, fix alignment adjustment when reusing PreciseAllocation
+        https://bugs.webkit.org/show_bug.cgi?id=201908
+
+        * heap/PreciseAllocation.cpp:
+        (JSC::PreciseAllocation::reuseForLowerTier):
+
 2019-11-11  Tuomas Karkkainen  <tuomas.webkit@apple.com>
 

trunk/Source/JavaScriptCore/heap/PreciseAllocation.cpp

@@ -153 +153 @@
     bool adjustedAlignment = m_adjustedAlignment;
     uint8_t lowerTierIndex = m_lowerTierIndex;
-
-    void* space = this->basePointer();
+    void* basePointer = this->basePointer();
+
     this->~PreciseAllocation();
+
+    void* space = basePointer;
+    ASSERT(isAlignedForPreciseAllocation(basePointer) == adjustedAlignment);
+    if (adjustedAlignment)
+        space = bitwise_cast<void*>(bitwise_cast<uintptr_t>(basePointer) + halfAlignment);
 
     PreciseAllocation* preciseAllocation = new (NotNull, space) PreciseAllocation(heap, size, subspace, 0, adjustedAlignment);