| Summary: | REGRESSION (r269525): Many layout tests crash when run under ASan | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Wenson Hsieh <wenson_hsieh> | ||||||||
| Component: | Layout and Rendering | Assignee: | Wenson Hsieh <wenson_hsieh> | ||||||||
| Status: | RESOLVED FIXED | ||||||||||
| Severity: | Normal | CC: | bfulgham, sabouhallawa, simon.fraser, thorton, webkit-bug-importer, zalan | ||||||||
| Priority: | P2 | Keywords: | InRadar | ||||||||
| Version: | WebKit Nightly Build | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Wenson Hsieh
2020-11-09 18:38:17 PST
Created attachment 413658 [details]
Patch
Created attachment 413715 [details]
roundUpToMultipleOf + remove some reinterpret_casts
Comment on attachment 413715 [details] roundUpToMultipleOf + remove some reinterpret_casts View in context: https://bugs.webkit.org/attachment.cgi?id=413715&action=review > Source/WebCore/platform/graphics/displaylists/DisplayListItemBuffer.cpp:558 > + auto itemLocation = destination.data + sizeof(uint64_t); offset? > Source/WebCore/platform/graphics/displaylists/DisplayListItemBuffer.h:80 > - return *reinterpret_cast<T*>(&data[sizeof(ItemType)]); > + return *reinterpret_cast<T*>(&data[sizeof(uint64_t)]); Didn't want to just inflate ItemType? I guess that's OK Comment on attachment 413715 [details] roundUpToMultipleOf + remove some reinterpret_casts View in context: https://bugs.webkit.org/attachment.cgi?id=413715&action=review >> Source/WebCore/platform/graphics/displaylists/DisplayListItemBuffer.cpp:558 >> + auto itemLocation = destination.data + sizeof(uint64_t); > > offset? Renamed! >> Source/WebCore/platform/graphics/displaylists/DisplayListItemBuffer.h:80 >> + return *reinterpret_cast<T*>(&data[sizeof(uint64_t)]); > > Didn't want to just inflate ItemType? I guess that's OK Interesting. I suppose I could! I wasn't sure if it made sense to make ItemType itself larger for the sake of aligning item data to 8 bytes…(for instance, if another data structure wants to keep just a list of item types, it would end up being much larger than necessary. But perhaps that's not really an issue, seeing as there's already padding after each type in the item buffer itself). Created attachment 413720 [details]
Patch for landing
Committed r269640: <https://trac.webkit.org/changeset/269640> All reviewed patches have been landed. Closing bug and clearing flags on attachment 413720 [details]. |