Attachment 343005 Details for Bug 186795 – Patch

[patch] Patch

bug-186795-20180618190753.patch (text/plain), 2.08 KB, created by Keith Miller on 2018-06-18 19:07:56 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Keith Miller

Created: 2018-06-18 19:07:56 PDT

Size: 2.08 KB

patch

obsolete

>Subversion Revision: 232953
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 13a25dbabfc1f12eed06dc5adf850f088a584f4f..e96b9a8facfbb521f8c6963448dd27d8a5418af3 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,13 @@
>+2018-06-18  Keith Miller  <keith_miller@apple.com>
>+
>+        JSImmutableButterfly should assert m_header is adjacent to the data
>+        https://bugs.webkit.org/show_bug.cgi?id=186795
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * runtime/JSImmutableButterfly.cpp:
>+        * runtime/JSImmutableButterfly.h:
>+
> 2018-06-18  Keith Miller  <keith_miller@apple.com>
> 
>         Unreviewed, fix the build...
>diff --git a/Source/JavaScriptCore/runtime/JSImmutableButterfly.cpp b/Source/JavaScriptCore/runtime/JSImmutableButterfly.cpp
>index d25bfc606b9ef3d4c037f0cc8ad424abc930336f..b38098c72ceb2c68e8812dfac6bc64cd5dd2c822 100644
>--- a/Source/JavaScriptCore/runtime/JSImmutableButterfly.cpp
>+++ b/Source/JavaScriptCore/runtime/JSImmutableButterfly.cpp
>@@ -54,4 +54,6 @@ void JSImmutableButterfly::copyToArguments(ExecState* exec, VirtualRegister firs
>     }
> }
> 
>+static_assert(JSImmutableButterfly::offsetOfData() == sizeof(JSImmutableButterfly), "m_header needs to be adjacent to Data");
>+
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/runtime/JSImmutableButterfly.h b/Source/JavaScriptCore/runtime/JSImmutableButterfly.h
>index 0a69ec7165ea8573eedb83a3cf39302c8d8792ff..3ace0ad3003983980297d7f025035acbd887ceeb 100644
>--- a/Source/JavaScriptCore/runtime/JSImmutableButterfly.h
>+++ b/Source/JavaScriptCore/runtime/JSImmutableButterfly.h
>@@ -101,12 +101,12 @@ public:
>             toButterfly()->contiguous().atUnsafe(index).set(vm, this, value);
>     }
> 
>-private:
>     static constexpr size_t offsetOfData()
>     {
>         return WTF::roundUpToMultipleOf<sizeof(WriteBarrier<Unknown>)>(sizeof(JSImmutableButterfly));
>     }
> 
>+private:
>     static Checked<size_t, RecordOverflow> allocationSize(Checked<size_t, RecordOverflow> numItems)
>     {
>         return offsetOfData() + numItems * sizeof(WriteBarrier<Unknown>);

Actions: View | Formatted Diff | Diff

Attachments on bug 186795: 343005