Bug 233831

Summary:

[libpas] Bitfit allocator has a wrong assertion when a page's max_free is enough for the size of an allocation, not enough for that allocation's size class, and the object of that size is not aligned to the currently requested alignment

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

bmalloc

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

ggaren, webkit-bug-importer, ysuzuki

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

All

OS:

All

Attachments:

Description	Flags
WRONG PATCH	none
the patch	ysuzuki: review+

Filip Pizlo

Reported 2021-12-03 11:15:42 PST

What a combination of conditions: - We just failed bitfit allocation in a page, which gives us some max_free (aka largest_available), and the allocation had nontrivial alignment. - The max_free is smaller than the size class. - The max_free is larger than the requested size. - The max_free object is not aligned to the requested alignment. The code handles this fine, but has a wrong assertion about it.

Attachments
WRONG PATCH (314.04 KB, patch) 2021-12-03 11:20 PST, Filip Pizlo	no flags	Details Formatted Diff Diff
the patch (14.33 KB, patch) 2021-12-03 11:20 PST, Filip Pizlo	ysuzuki: review+	Details Formatted Diff Diff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.