[Webkit-unassigned] [Bug 210685] REGRESSION(r251875): Crash in JSC::StructureIDTable::get on ppc64le

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Thu May 7 09:03:46 PDT 2020


https://bugs.webkit.org/show_bug.cgi?id=210685

--- Comment #23 from Daniel Kolesa <daniel at octaforge.org> ---
Created attachment 398740

  --> https://bugs.webkit.org/attachment.cgi?id=398740&action=review

Patch to fix the regression

To quote the commit message:

The problem at hand here is that the control flow is wrong. As it was, we'd do something like:

```
if (bytes <= smallCutoff) {
    slow path
} else if (aarch64 || bytes <= mediumCutoff) {
    either x86_64 path, aarch64 path or slow path
} else {
    assert(x86_64)
    do x86_64 path, or nothing on other archs
}
```

That means everything on non-x86_64/aarch64 that tried to memcpy more than mediumCutoff would end up doing nothing.

Fix the code so that slow path is taken automatically always if running non-x86_64/aarch64 architectures. Remove the #else in the mediumCutoff branch as that is now never taken.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200507/a4b719e2/attachment-0001.htm>


More information about the webkit-unassigned mailing list