144815 2015-05-08 14:39:44 -0700 Creating a large MarkedBlock sometimes results in more than one cell in the block 2015-05-08 15:55:44 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff webkit-bug-importer oldest_to_newest 1093310 0 msaboff 2015-05-08 14:39:44 -0700 The large block allocator is designed so that only one block should be in a MarkedBlock. In some cases the current code can allocate a large MarkedBlock that has 2 cells. Things fall over dead when this happens. rdar://problem/20764509 1093319 1 252752 msaboff 2015-05-08 15:22:55 -0700 Created attachment 252752 Patch 1093320 2 252752 mark.lam 2015-05-08 15:24:51 -0700 Comment on attachment 252752 Patch r=me 1093321 3 252752 mark.lam 2015-05-08 15:25:46 -0700 Comment on attachment 252752 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=252752&action=review > Source/JavaScriptCore/ChangeLog:9 > + m_endAtom for large blocks to use the location of the first block + 1. This s/first block/first cell/ 1093323 4 msaboff 2015-05-08 15:27:20 -0700 (In reply to comment #3) > Comment on attachment 252752 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=252752&action=review > > > Source/JavaScriptCore/ChangeLog:9 > > + m_endAtom for large blocks to use the location of the first block + 1. This > > s/first block/first cell/ Fixed locally. 1093324 5 msaboff 2015-05-08 15:55:44 -0700 Committed r184019: <http://trac.webkit.org/changeset/184019> 252752 2015-05-08 15:22:55 -0700 2015-05-08 15:24:51 -0700 Patch 144815.patch text/plain 1709 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTg0MDE2KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBA CisyMDE1LTA1LTA4ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENyZWF0aW5nIGEgbGFyZ2UgTWFya2VkQmxvY2sgc29tZXRpbWVzIHJlc3VsdHMgaW4gbW9y ZSB0aGFuIG9uZSBjZWxsIGluIHRoZSBibG9jaworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQ0ODE1CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgTGFyZ2UgTWFya2VkQmxvY2tzIHNob3VsZCBoYXZlIG9uZSBh bmQgb25seSBvbmUgY2VsbC4gIENoYW5nZWQgdGhlIGNhbGN1bGF0aW9uIG9mCisgICAgICAgIG1f ZW5kQXRvbSBmb3IgbGFyZ2UgYmxvY2tzIHRvIHVzZSB0aGUgbG9jYXRpb24gb2YgdGhlIGZpcnN0 IGJsb2NrICsgMS4gIFRoaXMKKyAgICAgICAgYXNzdXJlcyB0aGF0IGxhcmdlIGJsb2NrcyBvbmx5 IGhhdmUgb25lIGNlbGwuCisKKyAgICAgICAgKiBoZWFwL01hcmtlZEJsb2NrLmNwcDoKKyAgICAg ICAgKEpTQzo6TWFya2VkQmxvY2s6Ok1hcmtlZEJsb2NrKToKKwogMjAxNS0wNS0wOCAgT2xpdmVy IEh1bnQgIDxvbGl2ZXJAYXBwbGUuY29tPgogCiAgICAgICAgIE1hcERhdGFJbXBsOjphZGQoKSBz aG91bGRuJ3QgZG8gdGhlIHNhbWUgaGFzaCBsb29rdXAgdHdpY2UuCkluZGV4OiBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvaGVhcC9NYXJrZWRCbG9jay5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0ph dmFTY3JpcHRDb3JlL2hlYXAvTWFya2VkQmxvY2suY3BwCShyZXZpc2lvbiAxODQwMTUpCisrKyBT b3VyY2UvSmF2YVNjcmlwdENvcmUvaGVhcC9NYXJrZWRCbG9jay5jcHAJKHdvcmtpbmcgY29weSkK QEAgLTQ3LDcgKzQ3LDcgQEAgdm9pZCBNYXJrZWRCbG9jazo6ZGVzdHJveShNYXJrZWRCbG9jayog YgogTWFya2VkQmxvY2s6Ok1hcmtlZEJsb2NrKE1hcmtlZEFsbG9jYXRvciogYWxsb2NhdG9yLCBz aXplX3QgY2FwYWNpdHksIHNpemVfdCBjZWxsU2l6ZSwgYm9vbCBuZWVkc0Rlc3RydWN0aW9uKQog ICAgIDogRG91Ymx5TGlua2VkTGlzdE5vZGU8TWFya2VkQmxvY2s+KCkKICAgICAsIG1fYXRvbXNQ ZXJDZWxsKChjZWxsU2l6ZSArIGF0b21TaXplIC0gMSkgLyBhdG9tU2l6ZSkKLSAgICAsIG1fZW5k QXRvbSgoYWxsb2NhdG9yLT5jZWxsU2l6ZSgpID8gYXRvbXNQZXJCbG9jayA6IGNhcGFjaXR5IC8g YXRvbVNpemUpIC0gbV9hdG9tc1BlckNlbGwgKyAxKQorICAgICwgbV9lbmRBdG9tKChhbGxvY2F0 b3ItPmNlbGxTaXplKCkgPyBhdG9tc1BlckJsb2NrIC0gbV9hdG9tc1BlckNlbGwgOiBmaXJzdEF0 b20oKSkgKyAxKQogICAgICwgbV9jYXBhY2l0eShjYXBhY2l0eSkKICAgICAsIG1fbmVlZHNEZXN0 cnVjdGlvbihuZWVkc0Rlc3RydWN0aW9uKQogICAgICwgbV9hbGxvY2F0b3IoYWxsb2NhdG9yKQo=