| Summary: | [JSC][MSVC] custom getter creation needs to include classInfo since MSVC ICF is not "safe" variant | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Pavel Feldman <pfeldman> | ||||||
| Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | ashvayka, ews-watchlist, Hironori.Fujii, keith_miller, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer, ysuzuki | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | WebKit Nightly Build | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Windows 10 | ||||||||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=236097 | ||||||||
| Attachments: |
|
||||||||
|
Description
Pavel Feldman
2022-03-17 11:05:32 PDT
Setting a env var JSC_useJIT to 0 has no effect for this issue. WinCairo Debug (64bit, compiled by MSVC) can load the page successfully. (See also Bug 236097) I confirmed WinCairo (64bit, Release) compiled by clang-cl also has the same issue.
I used attachment#455038 [details] patch to compile with clang-cl.
I confirmed the same error without VirtualAlloc2.
diff --git a/Source/WTF/wtf/win/OSAllocatorWin.cpp b/Source/WTF/wtf/win/OSAllocatorWin.cpp
index b7f4eddd288d..96133a38f5ae 100644
--- a/Source/WTF/wtf/win/OSAllocatorWin.cpp
+++ b/Source/WTF/wtf/win/OSAllocatorWin.cpp
@@ -60,6 +60,7 @@ void* OSAllocator::tryReserveUncommittedAligned(size_t bytes, size_t alignment,
{
ASSERT(hasOneBitSet(alignment) && alignment >= pageSize());
+#if 0
if (VirtualAlloc2Ptr()) {
MEM_ADDRESS_REQUIREMENTS addressReqs = { };
MEM_EXTENDED_PARAMETER param = { };
@@ -69,6 +70,7 @@ void* OSAllocator::tryReserveUncommittedAligned(size_t bytes, size_t alignment,
void* result = VirtualAlloc2Ptr()(nullptr, nullptr, bytes, MEM_RESERVE, protection(writable, executable), ¶m, 1);
return result;
}
+#endif
void* result = tryReserveUncommitted(bytes + alignment);
// There's no way to release the reserved memory on Windows, from what I can tell as the whole segment has to be released at once.
(In reply to Fujii Hironori from comment #2) > I confirmed WinCairo (64bit, Release) compiled by clang-cl also has the same > issue. > I used attachment#455038 [details] patch to compile with clang-cl. I confirmed WinCairo (64bit, Debug) compiled by clang-cl can load the page successfully. Created attachment 455477 [details]
Patch
Created attachment 455478 [details]
Patch
Comment on attachment 455478 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=455478&action=review > Source/JavaScriptCore/ChangeLog:12 > + Since JSCustomGetterFunction does separate thing based on attached DOMAttribute, we need to include const ClassInfo* There is no way we can use slotBase() pointer instead, right? To fix the issue for all possibly accessors rather than only DOMAttribute? Comment on attachment 455478 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=455478&action=review >> Source/JavaScriptCore/ChangeLog:12 >> + Since JSCustomGetterFunction does separate thing based on attached DOMAttribute, we need to include const ClassInfo* > > There is no way we can use slotBase() pointer instead, right? To fix the issue for all possibly accessors rather than only DOMAttribute? I think this is fine: if DOMAttribute is not attached, the function itself includes ClassInfo check. This means that each function is not identical. Only case we get identical code for function is, DOMAttribute is attached and ClassInfo check is delegated into JSCustomGetterFunction side. *** Bug 238180 has been marked as a duplicate of this bug. *** Committed r291756 (248787@main): <https://commits.webkit.org/248787@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 455478 [details]. *** Bug 236097 has been marked as a duplicate of this bug. *** |