Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f1b67901270cc342925dc9e57f65c503bef8d6dc
https://github.com/WebKit/WebKit/commit/f1b67901270cc342925dc9e57f65c503bef8d6dc
Author: Marcus Plutowski <[email protected]>
Date: 2026-10-13 (Tue, 13 Oct 2026)
Changed paths:
M Source/bmalloc/libpas/src/libpas/pas_mte.h
Log Message:
-----------
[libpas] Round up compact SystemHeap allocation sizes
https://bugs.webkit.org/show_bug.cgi?id=327432
rdar://189778284
Reviewed by Mark Lam.
When the memory for compact objects is allocated via the SystemHeap (as
when pas_system_heap_should_supplant_bmalloc() is true), the
malloc_zone_malloc_with_options_np interface is used with the
MALLOC_NP_OPTION_CANONICAL_TAG flag to ensure that libmalloc
does not return MTE-tagged memory. 322175@main ([libpas] Use
tagged_bmalloc_heap for MTE allocations) rearchitected bmalloc such that
when MTE is disabled, *all* bmalloc allocations are treated as 'compact'
in this regard, meaning they all go down this route.
However, there is a documented difference between
malloc_zone_malloc_with_options_np and malloc, in that the size given
must be a multiple of the alignment. We correctly accomodate this in the
case of large-heap delegation to libmalloc, but do not do so in the
system heap. Consequently, over-aligned allocations with non-multiple
sizes from certain parts of WebKit (especially audio code -- e.g.
Biquad::Biquad is C*4104B and 32B-aligned) were failing in
configurations like PGM.
This patch transparently rounds up the requested size to meet the
stricter requirements of malloc_zone_malloc_with_options_np.
No new tests since the SystemHeap can't currently be tested from libpas.
* Source/bmalloc/libpas/src/libpas/pas_mte.h:
(pas_mte_system_heap_round_up_size_for_alignment):
(pas_mte_system_heap_malloc_zero_tagged):
(pas_mte_system_heap_zeroed_malloc_zero_tagged):
Canonical link: https://commits.webkit.org/323646@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
