314529 2026-05-10 22:15:28 -0700 codePointCompare dereferences pointer to unaligned ChunkType 2026-05-12 23:44:12 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 xry111 webkit-unassigned webkit-bug-importer oldest_to_newest 2209587 0 xry111 2026-05-10 22:15:28 -0700 The code reads: #if CPU(REGISTER64) && !CPU(NEEDS_ALIGNED_ACCESS) && CPU(LITTLE_ENDIAN) if constexpr (sizeof(CharacterType1) == sizeof(CharacterType2) && (sizeof(CharacterType1) == 1 || sizeof(CharacterType1) == 2)) { using ChunkType = std::conditional_t<sizeof(CharacterType1) == 1, uint32_t, uint64_t>; constexpr size_t stride = sizeof(ChunkType) / sizeof(CharacterType1); for (; position + (stride - 1) < commonLength;) { auto lhs = *std::bit_cast<const ChunkType*>(characters1Ptr); auto rhs = *std::bit_cast<const ChunkType*>(characters2Ptr); ... ... Despite it's only applied for CPUs not requiring aligned access, dereferencing const ChunkType* causes the compiler to assume the address is naturally aligned for ChunkType and make optimizations based on this assumption. For example, with GCC 16 and -mavx, the loop is optimized to use a 256-bit vmovdqa after handling 0-3 64-bit scalars, causing a segfault. 2210410 1 ews-feeder 2026-05-12 23:43:30 -0700 Committed 313136@main (54862905a65e): <https://commits.webkit.org/313136@main> Reviewed commits have been landed. Closing PR #64655 and removing active labels. 2210411 2 webkit-bug-importer 2026-05-12 23:44:12 -0700 <rdar://problem/176952645>