[Webkit-unassigned] [Bug 287518] New: usePreciseAllocationsOnly size accounting is incorrect.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=287518

            Bug ID: 287518
           Summary: usePreciseAllocationsOnly size accounting is
                    incorrect.
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: New Bugs
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.lam at apple.com

When usePreciseAllocationsOnly is true, we currently allocate the JSCell using PreciseAllocation::tryCreate() for an IsoSubspace.  As a result, the cell is not tracked as a lowerTierPreciseAllocation.  This results in MarkedSpace::m_capacity being decremented on free.  However, MarkedSpace::m_capacity was never incremented on allocation by IsoSubspace::tryAllocatePreciseOrLowerTierPrecise.  As a result, under some circumstances, MarkedSpace::m_capacity can contain a garbage value.

The fix is to simply always use lowerTierPreciseAllocation for IsoSubspace allocations.  We just need to introduce a new mode where the number of lowerTierPreciseAllocations is not bounded to MarkedBlock::maxNumberOfLowerTierPreciseCells.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20250211/12def818/attachment-0001.htm>