Title: [199448] releases/WebKitGTK/webkit-2.12/Source/bmalloc
- Revision
- 199448
- Author
- [email protected]
- Date
- 2016-04-13 02:37:42 -0700 (Wed, 13 Apr 2016)
Log Message
Merge r198680 - bmalloc: stress_aligned fails when allocating a zero-sized object with XLarge alignment
https://bugs.webkit.org/show_bug.cgi?id=155896
Reviewed by Andreas Kling.
We normally filter zero-sized allocations into small allocations, but
a zero-sized allocation can sneak through if it requires sufficiently
large alignment.
* bmalloc/Heap.cpp:
(bmalloc::Heap::tryAllocateXLarge): Set a floor on allocation size to
catch zero-sized allocations.
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/ChangeLog (199447 => 199448)
--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/ChangeLog 2016-04-13 09:37:31 UTC (rev 199447)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/ChangeLog 2016-04-13 09:37:42 UTC (rev 199448)
@@ -1,5 +1,20 @@
2016-03-25 Geoffrey Garen <[email protected]>
+ bmalloc: stress_aligned fails when allocating a zero-sized object with XLarge alignment
+ https://bugs.webkit.org/show_bug.cgi?id=155896
+
+ Reviewed by Andreas Kling.
+
+ We normally filter zero-sized allocations into small allocations, but
+ a zero-sized allocation can sneak through if it requires sufficiently
+ large alignment.
+
+ * bmalloc/Heap.cpp:
+ (bmalloc::Heap::tryAllocateXLarge): Set a floor on allocation size to
+ catch zero-sized allocations.
+
+2016-03-25 Geoffrey Garen <[email protected]>
+
Unreviewed, try to fix a crash seen on the bots.
* bmalloc/Allocator.cpp:
Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Heap.cpp (199447 => 199448)
--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Heap.cpp 2016-04-13 09:37:31 UTC (rev 199447)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Heap.cpp 2016-04-13 09:37:42 UTC (rev 199448)
@@ -429,6 +429,7 @@
m_isAllocatingPages = true;
+ size = std::max(vmPageSize, size);
alignment = roundUpToMultipleOf<xLargeAlignment>(alignment);
XLargeRange range = m_xLargeMap.takeFree(alignment, size);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
