blink::LargeObjectPage::PayloadEnd returns a wrong value
Reported by
leamov...@gmail.com,
May 30 2018
|
||||
Issue descriptionJust found a possible code defect while browsing the chromium code. Probably this does not break any functionality for now, but if anyone considers fixing this, it's really appreciated. Currently LargeObjectPage::PayloadEnd() returns Payload() + PayloadSize() where we count the size of HeapObjectHeader twice. A correct logic would be Payload() + GetHeapObjectHeader()->PayloadSize() as GetHeapObjectHeader()->PayloadSize() does not count the size of HeapObjectHeader. https://chromium.googlesource.com/chromium/src.git/+/f7658f9c5022136748b5b6f5bbb9412f562ea36e/third_party/blink/renderer/platform/heap/heap_page.h#593 // LargeObjectPage has the following memory layout: // // | metadata | HeapObjectHeader | payload | // // LargeObjectPage::PayloadSize returns the size of HeapObjectHeader and the // object payload. HeapObjectHeader::PayloadSize returns just the size of the // payload. Address Payload() { return GetHeapObjectHeader()->Payload(); } size_t PayloadSize() { return payload_size_; } Address PayloadEnd() { return Payload() + PayloadSize(); } <<<< should use GetHeapObjectHeader()->PayloadSize()?
,
Jun 13 2018
Correct, the method is not used right now afaics but we should still fix this asap.
,
Jun 14 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/1ef408b10e1809223c6939c68657fa53c64e9c07 commit 1ef408b10e1809223c6939c68657fa53c64e9c07 Author: Michael Lippautz <mlippautz@chromium.org> Date: Thu Jun 14 09:46:11 2018 [oilpan] Fix LargeObjectPage sizes Bug: chromium:847679 Change-Id: I36061d52a69fb89ce3d4a224904be39c82c40d59 Reviewed-on: https://chromium-review.googlesource.com/1098746 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Commit-Position: refs/heads/master@{#567207} [modify] https://crrev.com/1ef408b10e1809223c6939c68657fa53c64e9c07/third_party/blink/renderer/platform/heap/heap.cc [modify] https://crrev.com/1ef408b10e1809223c6939c68657fa53c64e9c07/third_party/blink/renderer/platform/heap/heap_page.cc [modify] https://crrev.com/1ef408b10e1809223c6939c68657fa53c64e9c07/third_party/blink/renderer/platform/heap/heap_page.h [modify] https://crrev.com/1ef408b10e1809223c6939c68657fa53c64e9c07/third_party/blink/renderer/platform/heap/heap_test.cc [modify] https://crrev.com/1ef408b10e1809223c6939c68657fa53c64e9c07/third_party/blink/renderer/platform/heap/marking_visitor.cc
,
Jun 15 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/b0fd211f0a1557130f8c192802122d75597eaeb8 commit b0fd211f0a1557130f8c192802122d75597eaeb8 Author: Michael Lippautz <mlippautz@chromium.org> Date: Fri Jun 15 05:38:43 2018 [oilpan] LargeObject payload fix No-try: true Bug: chromium:853055 , chromium:847679 , chromium:852980 Change-Id: I019eea9d101cbd8e368607e6309a99b0e9779cc2 Reviewed-on: https://chromium-review.googlesource.com/1101605 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Commit-Position: refs/heads/master@{#567561} [modify] https://crrev.com/b0fd211f0a1557130f8c192802122d75597eaeb8/third_party/blink/renderer/platform/heap/heap_page.h
,
Jun 15 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/09704f44b190b6b8fbccb5358768fc49647dc056 commit 09704f44b190b6b8fbccb5358768fc49647dc056 Author: Michael Lippautz <mlippautz@chromium.org> Date: Fri Jun 15 06:16:52 2018 [oilpan] LargeObject payload fix No-try: true Bug: chromium:853055 , chromium:847679 , chromium:852980 , chromium:853090 Change-Id: I019eea9d101cbd8e368607e6309a99b0e9779cc2 Reviewed-on: https://chromium-review.googlesource.com/1101605 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#567561}(cherry picked from commit b0fd211f0a1557130f8c192802122d75597eaeb8) Reviewed-on: https://chromium-review.googlesource.com/1102257 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/branch-heads/3461@{#3} Cr-Branched-From: c8a271c2b9964bd832b32a9a143f7bf28b658e70-refs/heads/master@{#567544} [modify] https://crrev.com/09704f44b190b6b8fbccb5358768fc49647dc056/third_party/blink/renderer/platform/heap/heap_page.h
,
Jun 15 2018
|
||||
►
Sign in to add a comment |
||||
Comment 1 by tkent@chromium.org
, May 30 2018