Summary: | JSArrayBufferViews of length 0 allocate 0 CopiedSpace bytes, which is invalid | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Mark Hahnenberg <mhahnenberg> | ||||
Component: | JavaScriptCore | Assignee: | Mark Hahnenberg <mhahnenberg> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | fpizlo | ||||
Priority: | P2 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Bug Depends on: | |||||||
Bug Blocks: | 122679 | ||||||
Attachments: |
|
Description
Mark Hahnenberg
2013-11-04 10:14:39 PST
Created attachment 215936 [details]
Patch
(In reply to comment #2) > Created an attachment (id=215936) [details] > Patch Forgot to svn add the new test, uploading new version... Comment on attachment 215936 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=215936&action=review r=me > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:4712 > + slowCases.append(m_jit.branchTest32(MacroAssembler::Zero, sizeGPR)); I think it's probably reasonably common to make a typed array and then append to it. Instead of a slow case, I think this should ultimately be a branch around the allocation code, followed by a store of 0 to JSArrayBufferView::offsetOfVector(). Can you file a follow-up bug? (In reply to comment #4) > (From update of attachment 215936 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=215936&action=review > > r=me > > > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:4712 > > + slowCases.append(m_jit.branchTest32(MacroAssembler::Zero, sizeGPR)); > > I think it's probably reasonably common to make a typed array and then append to it. Instead of a slow case, I think this should ultimately be a branch around the allocation code, followed by a store of 0 to JSArrayBufferView::offsetOfVector(). Can you file a follow-up bug? Is it possible to have a dynamically sized TypedArray? I thought they had a fixed size. Committed r158583: <http://trac.webkit.org/changeset/158583> Reopening because Phil has beef. Marking as blocking bug 122679, because this prevents running a WebCrypto test suite. Can we track the remaining issues in a separate bug? It doesn't seem right that this bug blocks WebCrypto at this point. (In reply to comment #9) > Can we track the remaining issues in a separate bug? It doesn't seem right that this bug blocks WebCrypto at this point. Filed bug 124799. |