Bug 161427 – [JSC] AbstractValue can contain padding which is not zero-filled

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Yusuke Suzuki]

[JSC][GTK] AbstractValue can contain padding which is not zero-filled

[Yusuke Suzuki]

Created attachment 287489 [details]
Patch

[Carlos Garcia Campos]

Note that this is not GTK+ specific, JSCOnly compiled with GCC also fails, so it's more GCC vs clang issue.

[Yusuke Suzuki]

Created attachment 287493 [details]
Patch

[Yusuke Suzuki]

(In reply to comment #2)
> Note that this is not GTK+ specific, JSCOnly compiled with GCC also fails,
> so it's more GCC vs clang issue.

Renamed the issue & ChangeLog :)

[Carlos Garcia Campos]

Comment on attachment 287489 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=287489&action=review

Thanks for working on this!

> Source/JavaScriptCore/ChangeLog:12
> +        So debug assertion fails in GTK port.

So debug assertion fails when building with GCC.

> Source/JavaScriptCore/dfg/DFGAbstractValue.cpp:547
> +void AbstractValue::ensureCanInitializeWithZeros()
> +{
> +    std::aligned_storage<sizeof(AbstractValue), alignof(AbstractValue)>::type zeroFilledStorage;
> +    memset(static_cast<void*>(&zeroFilledStorage), 0, sizeof(AbstractValue));
> +    ASSERT(*this == *static_cast<AbstractValue*>(static_cast<void*>(&zeroFilledStorage)));
> +}

This is only used inside a #if USE(JSVALUE64) && !defined(NDEBUG) block, so maybe it should be defined using the same #if.

> Source/JavaScriptCore/dfg/DFGAbstractValue.h:461
> +    void ensureCanInitializeWithZeros();

Ditto.

[Yusuke Suzuki]

Created attachment 287495 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 287489 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=287489&action=review

>> Source/JavaScriptCore/ChangeLog:12
>> +        So debug assertion fails in GTK port.
> 
> So debug assertion fails when building with GCC.

Thanks. Fixed.

>> Source/JavaScriptCore/dfg/DFGAbstractValue.cpp:547
>> +}
> 
> This is only used inside a #if USE(JSVALUE64) && !defined(NDEBUG) block, so maybe it should be defined using the same #if.

OK, wrapped.

>> Source/JavaScriptCore/dfg/DFGAbstractValue.h:461
>> +    void ensureCanInitializeWithZeros();
> 
> Ditto.

Done.

[Saam Barati]

Comment on attachment 287495 [details]
Patch

r=me

[Yusuke Suzuki]

Comment on attachment 287495 [details]
Patch

Thanks!

[WebKit Commit Bot]

Comment on attachment 287495 [details]
Patch

Clearing flags on attachment: 287495

Committed r205254: <http://trac.webkit.org/changeset/205254>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.