1607186 - Cell memory tracking for BigInt digits can be off by four bytes on 32-bit

Status: RESOLVED WONTFIX

(Core :: JavaScript: GC, defect, P3)

Description

[André Bargull [:anba]]

BigInt::Digit is pointer-sized, so four bytes on 32-bits platforms, but when allocating the digits through AllocateBigIntDigits, the storage size needs to be Value-sized (*) for Nursery::allocateBuffer. So for example when requesting 20 bytes for digits storage, AllocateBigIntDigits will round it up to 24 bytes, but AddCellMemory will only track 20 bytes.

To fix this bug, we could either pass two size_t parameters to Nursery::allocateBuffer (for nursery and non-nursery allocation), or alternatively move the alignment code into Nursery::allocateBuffer.

(*) Actually ´CellAlignBytes-sized, but the code uses sizeof(Value)and relies on it being the same asCellAlignBytes`.

Comment 1

[Jon Coppeard (:jonco)]

This is correct, however the exact size tracked doesn't need to be exact. It must balance, and should be close to give us the best chance of triggering GC at appropriate times.