RESOLVED FIXED218733
REGRESSION (r269525): Many layout tests crash when run under ASan 
https://bugs.webkit.org/show_bug.cgi?id=218733
Summary REGRESSION (r269525): Many layout tests crash when run under ASan
Wenson Hsieh
Reported 2020-11-09 18:38:17 PST
<rdar://problem/71206273>
Attachments
Patch (32.23 KB, patch)
2020-11-09 20:17 PST, Wenson Hsieh 		no flags
DetailsFormatted DiffDiff
roundUpToMultipleOf + remove some reinterpret_casts (31.03 KB, patch)
2020-11-10 10:59 PST, Wenson Hsieh 		thorton: review+
DetailsFormatted DiffDiff
Patch for landing (31.00 KB, patch)
2020-11-10 11:59 PST, Wenson Hsieh 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Wenson Hsieh
Comment 1 2020-11-09 20:17:52 PST Comment hidden (obsolete)
Wenson Hsieh
Comment 2 2020-11-10 10:59:07 PST
Created attachment 413715 [details] roundUpToMultipleOf + remove some reinterpret_casts
Tim Horton
Comment 3 2020-11-10 11:10:34 PST
Comment on attachment 413715 [details] roundUpToMultipleOf + remove some reinterpret_casts View in context: https://bugs.webkit.org/attachment.cgi?id=413715&action=review > Source/WebCore/platform/graphics/displaylists/DisplayListItemBuffer.cpp:558 > + auto itemLocation = destination.data + sizeof(uint64_t); offset? > Source/WebCore/platform/graphics/displaylists/DisplayListItemBuffer.h:80 > - return *reinterpret_cast<T*>(&data[sizeof(ItemType)]); > + return *reinterpret_cast<T*>(&data[sizeof(uint64_t)]); Didn't want to just inflate ItemType? I guess that's OK
Wenson Hsieh
Comment 4 2020-11-10 11:25:10 PST
Comment on attachment 413715 [details] roundUpToMultipleOf + remove some reinterpret_casts View in context: https://bugs.webkit.org/attachment.cgi?id=413715&action=review >> Source/WebCore/platform/graphics/displaylists/DisplayListItemBuffer.cpp:558 >> + auto itemLocation = destination.data + sizeof(uint64_t); > > offset? Renamed! >> Source/WebCore/platform/graphics/displaylists/DisplayListItemBuffer.h:80 >> + return *reinterpret_cast<T*>(&data[sizeof(uint64_t)]); > > Didn't want to just inflate ItemType? I guess that's OK Interesting. I suppose I could! I wasn't sure if it made sense to make ItemType itself larger for the sake of aligning item data to 8 bytes…(for instance, if another data structure wants to keep just a list of item types, it would end up being much larger than necessary. But perhaps that's not really an issue, seeing as there's already padding after each type in the item buffer itself).
Wenson Hsieh
Comment 5 2020-11-10 11:59:38 PST
Created attachment 413720 [details] Patch for landing
EWS
Comment 6 2020-11-10 12:31:09 PST
Committed r269640: <https://trac.webkit.org/changeset/269640> All reviewed patches have been landed. Closing bug and clearing flags on attachment 413720 [details].
Note You need to log in before you can comment on or make changes to this bug.