[Webkit-unassigned] [Bug 210685] REGRESSION(r251875): Crash in JSC::StructureIDTable::get on ppc64le
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu May 7 09:03:46 PDT 2020
https://bugs.webkit.org/show_bug.cgi?id=210685
--- Comment #23 from Daniel Kolesa <daniel at octaforge.org> ---
Created attachment 398740
--> https://bugs.webkit.org/attachment.cgi?id=398740&action=review
Patch to fix the regression
To quote the commit message:
The problem at hand here is that the control flow is wrong. As it was, we'd do something like:
```
if (bytes <= smallCutoff) {
slow path
} else if (aarch64 || bytes <= mediumCutoff) {
either x86_64 path, aarch64 path or slow path
} else {
assert(x86_64)
do x86_64 path, or nothing on other archs
}
```
That means everything on non-x86_64/aarch64 that tried to memcpy more than mediumCutoff would end up doing nothing.
Fix the code so that slow path is taken automatically always if running non-x86_64/aarch64 architectures. Remove the #else in the mediumCutoff branch as that is now never taken.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200507/a4b719e2/attachment-0001.htm>
More information about the webkit-unassigned
mailing list