ExecutableAllocator ::alloc assumed that m_freePtr would be aligned. This was not always true, since the first allocation from an additional pool would not be rounded up. Subsequent allocations would be unaligned, and too much memory could be erroneously allocated from the pool, when the size requested was available, but the size rounded up to word granularity was not available in the pool. This may result in the value of m_freePtr being greater than m_end. Under these circumstances, the unsigned check for space will always pass, resulting in pointers to memory outside of the arena being returned, and ultimately segfaulty goodness when attempting to memcpy the hot freshly jitted code from the AssemblerBuffer.
Created attachment 26224 [details] The patch
Comment on attachment 26224 [details] The patch ASSERT(m_freePtr < m_end); should be ASSERT(m_freePtr <= m_end);
Sending JavaScriptCore/ChangeLog Sending JavaScriptCore/jit/ExecutableAllocator.h Transmitting file data .. Committed revision 39450.