Changeset 228420 in webkit


Ignore:
Timestamp:
Feb 13, 2018 9:02:45 AM (6 years ago)
Author:
fpizlo@apple.com
Message:

Lock down JSFunction
​https://bugs.webkit.org/show_bug.cgi?id=182652

Reviewed by Saam Barati.

This poisons pointers in JSFunction and puts all of the types in the JSFunction hierarchy in
isospaces.

This is so neutral on JetStream: 0.01% slower with p = 0.969211.

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
(JSC::DFG::SpeculativeJIT::compileNewFunction):
(JSC::DFG::SpeculativeJIT::compileCreateThis):

  • dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::TrustedImmPtr::TrustedImmPtr):
(JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPointer):
(JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPoisonedPointer):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetExecutable):
(JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
(JSC::FTL::DFG::LowerDFGToB3::weakPointer):
(JSC::FTL::DFG::LowerDFGToB3::weakPoisonedPointer):

  • ftl/FTLOutput.h:

(JSC::FTL::Output::weakPointer):
(JSC::FTL::Output::weakPoisonedPointer):

  • heap/MarkedSpace.cpp:
  • jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_create_this):

  • jit/ThunkGenerators.cpp:

(JSC::virtualThunkFor):
(JSC::nativeForGenerator):
(JSC::boundThisNoArgsFunctionCallGenerator):

  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter64.asm:
  • runtime/JSAsyncFunction.h:

(JSC::JSAsyncFunction::subspaceFor):

  • runtime/JSAsyncGeneratorFunction.h:

(JSC::JSAsyncGeneratorFunction::subspaceFor):

  • runtime/JSBoundFunction.h:

(JSC::JSBoundFunction::subspaceFor):

  • runtime/JSCPoison.h:
  • runtime/JSCustomGetterSetterFunction.h:

(JSC::JSCustomGetterSetterFunction::subspaceFor):

  • runtime/JSFunction.h:

(JSC::JSFunction::subspaceFor):

  • runtime/JSGeneratorFunction.h:

(JSC::JSGeneratorFunction::subspaceFor):

  • runtime/JSNativeStdFunction.h:

(JSC::JSNativeStdFunction::subspaceFor):

  • runtime/VM.cpp:

(JSC::VM::VM):

  • runtime/VM.h:
  • wasm/js/WebAssemblyFunction.h:
  • wasm/js/WebAssemblyWrapperFunction.h:
Location:
trunk/Source/JavaScriptCore
Files:
24 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r228411 r228420  
     12018-02-10  Filip Pizlo  <fpizlo@apple.com>
     2
     3        Lock down JSFunction
     4        https://bugs.webkit.org/show_bug.cgi?id=182652
     5
     6        Reviewed by Saam Barati.
     7       
     8        This poisons pointers in JSFunction and puts all of the types in the JSFunction hierarchy in
     9        isospaces.
     10       
     11        This is so neutral on JetStream: 0.01% slower with p = 0.969211.
     12
     13        * dfg/DFGSpeculativeJIT.cpp:
     14        (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
     15        (JSC::DFG::SpeculativeJIT::compileNewFunction):
     16        (JSC::DFG::SpeculativeJIT::compileCreateThis):
     17        * dfg/DFGSpeculativeJIT.h:
     18        (JSC::DFG::SpeculativeJIT::TrustedImmPtr::TrustedImmPtr):
     19        (JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPointer):
     20        (JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPoisonedPointer):
     21        * dfg/DFGSpeculativeJIT64.cpp:
     22        (JSC::DFG::SpeculativeJIT::compile):
     23        * ftl/FTLLowerDFGToB3.cpp:
     24        (JSC::FTL::DFG::LowerDFGToB3::compileGetExecutable):
     25        (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
     26        (JSC::FTL::DFG::LowerDFGToB3::weakPointer):
     27        (JSC::FTL::DFG::LowerDFGToB3::weakPoisonedPointer):
     28        * ftl/FTLOutput.h:
     29        (JSC::FTL::Output::weakPointer):
     30        (JSC::FTL::Output::weakPoisonedPointer):
     31        * heap/MarkedSpace.cpp:
     32        * jit/JITOpcodes.cpp:
     33        (JSC::JIT::emit_op_create_this):
     34        * jit/ThunkGenerators.cpp:
     35        (JSC::virtualThunkFor):
     36        (JSC::nativeForGenerator):
     37        (JSC::boundThisNoArgsFunctionCallGenerator):
     38        * llint/LowLevelInterpreter.asm:
     39        * llint/LowLevelInterpreter64.asm:
     40        * runtime/JSAsyncFunction.h:
     41        (JSC::JSAsyncFunction::subspaceFor):
     42        * runtime/JSAsyncGeneratorFunction.h:
     43        (JSC::JSAsyncGeneratorFunction::subspaceFor):
     44        * runtime/JSBoundFunction.h:
     45        (JSC::JSBoundFunction::subspaceFor):
     46        * runtime/JSCPoison.h:
     47        * runtime/JSCustomGetterSetterFunction.h:
     48        (JSC::JSCustomGetterSetterFunction::subspaceFor):
     49        * runtime/JSFunction.h:
     50        (JSC::JSFunction::subspaceFor):
     51        * runtime/JSGeneratorFunction.h:
     52        (JSC::JSGeneratorFunction::subspaceFor):
     53        * runtime/JSNativeStdFunction.h:
     54        (JSC::JSNativeStdFunction::subspaceFor):
     55        * runtime/VM.cpp:
     56        (JSC::VM::VM):
     57        * runtime/VM.h:
     58        * wasm/js/WebAssemblyFunction.h:
     59        * wasm/js/WebAssemblyWrapperFunction.h:
     60
    1612018-02-12  Saam Barati  <sbarati@apple.com>
    262

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r228411 r228420  
    67196719
    67206720template <typename ClassType>
    6721 void SpeculativeJIT::compileNewFunctionCommon(GPRReg resultGPR, RegisteredStructure structure, GPRReg scratch1GPR, GPRReg scratch2GPR, GPRReg scopeGPR, MacroAssembler::JumpList& slowPath, size_t size, FunctionExecutable* executable, ptrdiff_t offsetOfScopeChain, ptrdiff_t offsetOfExecutable, ptrdiff_t offsetOfRareData)
     6721void SpeculativeJIT::compileNewFunctionCommon(GPRReg resultGPR, RegisteredStructure structure, GPRReg scratch1GPR, GPRReg scratch2GPR, GPRReg scopeGPR, MacroAssembler::JumpList& slowPath, size_t size, FunctionExecutable* executable)
    67226722{
    67236723    auto butterfly = TrustedImmPtr(nullptr);
    … …  
    67256725    emitAllocateJSObjectWithKnownSize<ClassType>(resultGPR, TrustedImmPtr(structure), butterfly, mask, scratch1GPR, scratch2GPR, slowPath, size);
    67266726   
    6727     m_jit.storePtr(scopeGPR, JITCompiler::Address(resultGPR, offsetOfScopeChain));
    6728     m_jit.storePtr(TrustedImmPtr::weakPointer(m_jit.graph(), executable), JITCompiler::Address(resultGPR, offsetOfExecutable));
    6729     m_jit.storePtr(TrustedImmPtr(0), JITCompiler::Address(resultGPR, offsetOfRareData));
     6727    m_jit.storePtr(scopeGPR, JITCompiler::Address(resultGPR, JSFunction::offsetOfScopeChain()));
     6728    m_jit.storePtr(TrustedImmPtr::weakPoisonedPointer<JSFunctionPoison>(m_jit.graph(), executable), JITCompiler::Address(resultGPR, JSFunction::offsetOfExecutable()));
     6729    m_jit.storePtr(TrustedImmPtr(0), JITCompiler::Address(resultGPR, JSFunction::offsetOfRareData()));
    67306730   
    67316731    m_jit.mutatorFence(*m_jit.vm());
    … …  
    67896789   
    67906790    if (nodeType == NewFunction) {
    6791         compileNewFunctionCommon<JSFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSFunction::allocationSize(0), executable, JSFunction::offsetOfScopeChain(), JSFunction::offsetOfExecutable(), JSFunction::offsetOfRareData());
     6791        compileNewFunctionCommon<JSFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSFunction::allocationSize(0), executable);
    67926792           
    67936793        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable));
    … …  
    67956795
    67966796    if (nodeType == NewGeneratorFunction) {
    6797         compileNewFunctionCommon<JSGeneratorFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSGeneratorFunction::allocationSize(0), executable, JSGeneratorFunction::offsetOfScopeChain(), JSGeneratorFunction::offsetOfExecutable(), JSGeneratorFunction::offsetOfRareData());
     6797        compileNewFunctionCommon<JSGeneratorFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSGeneratorFunction::allocationSize(0), executable);
    67986798
    67996799        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable));
    … …  
    68016801
    68026802    if (nodeType == NewAsyncFunction) {
    6803         compileNewFunctionCommon<JSAsyncFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSAsyncFunction::allocationSize(0), executable, JSAsyncFunction::offsetOfScopeChain(), JSAsyncFunction::offsetOfExecutable(), JSAsyncFunction::offsetOfRareData());
     6803        compileNewFunctionCommon<JSAsyncFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSAsyncFunction::allocationSize(0), executable);
    68046804
    68056805        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewAsyncFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable));
    … …  
    68076807
    68086808    if (nodeType == NewAsyncGeneratorFunction) {
    6809         compileNewFunctionCommon<JSAsyncGeneratorFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSAsyncGeneratorFunction::allocationSize(0), executable, JSAsyncGeneratorFunction::offsetOfScopeChain(), JSAsyncGeneratorFunction::offsetOfExecutable(), JSAsyncGeneratorFunction::offsetOfRareData());
     6809        compileNewFunctionCommon<JSAsyncGeneratorFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSAsyncGeneratorFunction::allocationSize(0), executable);
    68106810       
    68116811        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewAsyncGeneratorFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable));
    … …  
    1148611486    m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
    1148711487    slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR));
     11488    m_jit.xorPtr(JITCompiler::TrustedImmPtr(JSFunctionPoison::key()), rareDataGPR);
    1148811489    m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorGPR);
    1148911490    m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureGPR);
    … …  
    1149611497
    1149711498    m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
     11499    m_jit.xorPtr(JITCompiler::TrustedImmPtr(JSFunctionPoison::key()), rareDataGPR);
    1149811500    m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfInlineCapacity()), inlineCapacityGPR);
    1149911501    m_jit.emitInitializeInlineStorage(resultGPR, inlineCapacityGPR);

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r228411 r228420  
    122122            : m_value(value)
    123123        {
    124             static_assert(!std::is_base_of<HeapCell, T>::value, "To use a GC pointer, the graph must be aware of it. Use SpeculativeJIT::TrustedImmPtr::weakPointer instead.");
     124            static_assert(!std::is_base_of<JSCell, T>::value, "To use a GC pointer, the graph must be aware of it. Use SpeculativeJIT::TrustedImmPtr::weakPointer instead.");
    125125        }
    126126
    … …  
    154154        static TrustedImmPtr weakPointer(Graph& graph, JSCell* cell)
    155155        {     
    156             // There are weird relationships in how optimized CodeBlocks
    157             // point to other CodeBlocks. We don't want to have them be
    158             // part of the weak pointer set. For example, an optimized CodeBlock
    159             // having a weak pointer to itself will cause it to get collected.
    160             ASSERT(!jsDynamicCast<CodeBlock*>(graph.m_vm, cell));
    161 
    162156            graph.m_plan.weakReferences.addLazily(cell);
    163157            return TrustedImmPtr(bitwise_cast<size_t>(cell));
     158        }
     159
     160        template<typename Key>
     161        static TrustedImmPtr weakPoisonedPointer(Graph& graph, JSCell* cell)
     162        {     
     163            graph.m_plan.weakReferences.addLazily(cell);
     164            return TrustedImmPtr(bitwise_cast<size_t>(cell) ^ Key::key());
    164165        }
    165166
    … …  
    30823083    void loadFromIntTypedArray(GPRReg baseReg, GPRReg storageReg, GPRReg propertyReg, GPRReg resultReg, TypedArrayType);
    30833084    void setIntTypedArrayLoadResult(Node*, GPRReg resultReg, TypedArrayType, bool canSpeculate = false);
    3084     template <typename ClassType> void compileNewFunctionCommon(GPRReg, RegisteredStructure, GPRReg, GPRReg, GPRReg, MacroAssembler::JumpList&, size_t, FunctionExecutable*, ptrdiff_t, ptrdiff_t, ptrdiff_t);
     3085    template <typename ClassType> void compileNewFunctionCommon(GPRReg, RegisteredStructure, GPRReg, GPRReg, GPRReg, MacroAssembler::JumpList&, size_t, FunctionExecutable*);
    30853086    void compileNewFunction(Node*);
    30863087    void compileSetFunctionName(Node*);

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r228411 r228420  
    11/*
    2  * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2011-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    42534253        speculateCellType(node->child1(), functionGPR, SpecFunction, JSFunctionType);
    42544254        m_jit.loadPtr(JITCompiler::Address(functionGPR, JSFunction::offsetOfExecutable()), resultGPR);
     4255        m_jit.xorPtr(JITCompiler::TrustedImmPtr(JSFunctionPoison::key()), resultGPR);
    42554256        cellResult(resultGPR, node);
    42564257        break;

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r228411 r228420  
    29452945        LValue cell = lowCell(m_node->child1());
    29462946        speculateFunction(m_node->child1(), cell);
    2947         setJSValue(m_out.loadPtr(cell, m_heaps.JSFunction_executable));
     2947        setJSValue(
     2948            m_out.bitXor(
     2949                m_out.loadPtr(cell, m_heaps.JSFunction_executable),
     2950                m_out.constIntPtr(JSFunctionPoison::key())));
    29482951    }
    29492952   
    … …  
    48704873        // must be young.
    48714874        m_out.storePtr(scope, fastObject, m_heaps.JSFunction_scope);
    4872         m_out.storePtr(weakPointer(executable), fastObject, m_heaps.JSFunction_executable);
     4875        m_out.storePtr(weakPoisonedPointer<JSFunctionPoison>(executable), fastObject, m_heaps.JSFunction_executable);
    48734876        m_out.storePtr(m_out.intPtrZero, fastObject, m_heaps.JSFunction_rareData);
    48744877       
    … …  
    1572615729    LValue weakPointer(JSCell* pointer)
    1572715730    {
    15728         // There are weird relationships in how optimized CodeBlocks
    15729         // point to other CodeBlocks. We don't want to have them be
    15730         // part of the weak pointer set. For example, an optimized CodeBlock
    15731         // having a weak pointer to itself will cause it to get collected.
    15732         RELEASE_ASSERT(!jsDynamicCast<CodeBlock*>(vm(), pointer));
    15733 
    1573415731        addWeakReference(pointer);
    1573515732        return m_out.weakPointer(m_graph, pointer);
     15733    }
     15734   
     15735    template<typename Key>
     15736    LValue weakPoisonedPointer(JSCell* pointer)
     15737    {
     15738        addWeakReference(pointer);
     15739        return m_out.weakPoisonedPointer<Key>(m_graph, pointer);
    1573615740    }
    1573715741

  • trunk/Source/JavaScriptCore/ftl/FTLOutput.h

    r225913 r228420  
    112112        ASSERT(graph.m_plan.weakReferences.contains(cell));
    113113
    114         if (sizeof(void*) == 8)
    115             return constInt64(bitwise_cast<intptr_t>(cell));
    116         return constInt32(bitwise_cast<intptr_t>(cell));
     114        return constIntPtr(bitwise_cast<intptr_t>(cell));
     115    }
     116
     117    template<typename Key>
     118    LValue weakPoisonedPointer(DFG::Graph& graph, JSCell* cell)
     119    {
     120        ASSERT(graph.m_plan.weakReferences.contains(cell));
     121
     122        return constIntPtr(bitwise_cast<intptr_t>(cell) ^ Key::key());
    117123    }
    118124
    … …  
    121127        RELEASE_ASSERT(value->value().isCell());
    122128
    123         if (sizeof(void*) == 8)
    124             return constInt64(bitwise_cast<intptr_t>(value->cell()));
    125         return constInt32(bitwise_cast<intptr_t>(value->cell()));
     129        return constIntPtr(bitwise_cast<intptr_t>(value->cell()));
    126130    }
    127131

  • trunk/Source/JavaScriptCore/heap/MarkedSpace.cpp

    r227718 r228420  
    142142            add(sizeof(UnlinkedFunctionCodeBlock));
    143143            add(sizeof(JSString));
    144             add(sizeof(JSFunction));
    145144
    146145            {

  • trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

    r227617 r228420  
    768768    loadPtr(Address(calleeReg, JSFunction::offsetOfRareData()), rareDataReg);
    769769    addSlowCase(branchTestPtr(Zero, rareDataReg));
     770    xorPtr(TrustedImmPtr(JSFunctionPoison::key()), rareDataReg);
    770771    load32(Address(rareDataReg, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorReg);
    771772    loadPtr(Address(rareDataReg, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureReg);
    … …  
    783784    emitGetVirtualRegister(callee, scratchReg);
    784785    loadPtr(Address(scratchReg, JSFunction::offsetOfRareData()), scratchReg);
     786    xorPtr(TrustedImmPtr(JSFunctionPoison::key()), scratchReg);
    785787    load32(Address(scratchReg, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfInlineCapacity()), scratchReg);
    786788    emitInitializeInlineStorage(resultReg, scratchReg);

  • trunk/Source/JavaScriptCore/jit/Repatch.cpp

    r225768 r228420  
    937937            CCallHelpers::Address(calleeGPR, JSFunction::offsetOfExecutable()),
    938938            scratchGPR);
     939        stubJit.xorPtr(CCallHelpers::TrustedImmPtr(JSFunctionPoison::key()), scratchGPR);
    939940       
    940941        comparisonValueGPR = scratchGPR;

  • trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp

    r227527 r228420  
    205205        CCallHelpers::Address(GPRInfo::regT0, JSFunction::offsetOfExecutable()),
    206206        GPRInfo::regT4);
     207    jit.xorPtr(CCallHelpers::TrustedImmPtr(JSFunctionPoison::key()), GPRInfo::regT4);
    207208    jit.loadPtr(
    208209        CCallHelpers::Address(
    … …  
    293294    if (thunkFunctionType == ThunkFunctionType::JSFunction) {
    294295        jit.loadPtr(JSInterfaceJIT::Address(JSInterfaceJIT::regT1, JSFunction::offsetOfExecutable()), JSInterfaceJIT::regT1);
     296        jit.xorPtr(JSInterfaceJIT::TrustedImmPtr(JSFunctionPoison::key()), JSInterfaceJIT::regT1);
    295297        jit.call(JSInterfaceJIT::Address(JSInterfaceJIT::regT1, executableOffsetToFunction));
    296298    } else
    … …  
    308310    if (thunkFunctionType == ThunkFunctionType::JSFunction) {
    309311        jit.loadPtr(JSInterfaceJIT::Address(X86Registers::esi, JSFunction::offsetOfExecutable()), X86Registers::r9);
     312        jit.xorPtr(JSInterfaceJIT::TrustedImmPtr(JSFunctionPoison::key()), X86Registers::r9);
    310313        jit.loadPtr(JSInterfaceJIT::Address(X86Registers::r9, executableOffsetToFunction), X86Registers::r9);
    311314    } else
    … …  
    327330    if (thunkFunctionType == ThunkFunctionType::JSFunction) {
    328331        jit.loadPtr(JSInterfaceJIT::Address(X86Registers::edx, JSFunction::offsetOfExecutable()), X86Registers::r9);
     332        jit.xorPtr(JSInterfaceJIT::TrustedImmPtr(JSFunctionPoison::key()), X86Registers::r9);
    329333        jit.call(JSInterfaceJIT::Address(X86Registers::r9, executableOffsetToFunction));
    330334    } else
    … …  
    345349    if (thunkFunctionType == ThunkFunctionType::JSFunction) {
    346350        jit.loadPtr(JSInterfaceJIT::Address(ARM64Registers::x1, JSFunction::offsetOfExecutable()), ARM64Registers::x2);
     351        jit.xorPtr(JSInterfaceJIT::TrustedImmPtr(JSFunctionPoison::key()), ARM64Registers::x2);
    347352        jit.loadPtr(JSInterfaceJIT::Address(ARM64Registers::x2, executableOffsetToFunction), ARM64Registers::x2);
    348353    } else
    … …  
    365370    if (thunkFunctionType == ThunkFunctionType::JSFunction) {
    366371        jit.loadPtr(JSInterfaceJIT::Address(JSInterfaceJIT::argumentGPR1, JSFunction::offsetOfExecutable()), JSInterfaceJIT::regT2);
     372        jit.xorPtr(JSInterfaceJIT::TrustedImmPtr(JSFunctionPoison::key()), JSInterfaceJIT::regT2);
    367373        jit.call(JSInterfaceJIT::Address(JSInterfaceJIT::regT2, executableOffsetToFunction));
    368374    } else
    … …  
    11651171        CCallHelpers::Address(GPRInfo::regT3, JSFunction::offsetOfExecutable()),
    11661172        GPRInfo::regT0);
     1173    jit.xorPtr(CCallHelpers::TrustedImmPtr(JSFunctionPoison::key()), GPRInfo::regT0);
    11671174    jit.loadPtr(
    11681175        CCallHelpers::Address(

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

    r227874 r228420  
    941941end
    942942
    943 macro functionForCallCodeBlockGetter(targetRegister)
     943macro functionForCallCodeBlockGetter(targetRegister, scratch)
    944944    if JSVALUE64
    945945        loadp Callee[cfr], targetRegister
    … …  
    948948    end
    949949    loadp JSFunction::m_executable[targetRegister], targetRegister
     950    unpoison(_g_JSFunctionPoison, targetRegister, scratch)
    950951    loadp FunctionExecutable::m_codeBlockForCall[targetRegister], targetRegister
    951952    loadp ExecutableToCodeBlockEdge::m_codeBlock[targetRegister], targetRegister
    952953end
    953954
    954 macro functionForConstructCodeBlockGetter(targetRegister)
     955macro functionForConstructCodeBlockGetter(targetRegister, scratch)
    955956    if JSVALUE64
    956957        loadp Callee[cfr], targetRegister
    … …  
    959960    end
    960961    loadp JSFunction::m_executable[targetRegister], targetRegister
     962    unpoison(_g_JSFunctionPoison, targetRegister, scratch)
    961963    loadp FunctionExecutable::m_codeBlockForConstruct[targetRegister], targetRegister
    962964    loadp ExecutableToCodeBlockEdge::m_codeBlock[targetRegister], targetRegister
    963965end
    964966
    965 macro notFunctionCodeBlockGetter(targetRegister)
     967macro notFunctionCodeBlockGetter(targetRegister, ignored)
    966968    loadp CodeBlock[cfr], targetRegister
    967969end
    … …  
    986988        addp maxFrameExtentForSlowPathCall, sp
    987989    end
    988     codeBlockGetter(t1)
     990    codeBlockGetter(t1, t2)
    989991    if not C_LOOP
    990992        baddis 5, CodeBlock::m_llintExecuteCounter + BaselineExecutionCounter::m_counter[t1], .continue
    … …  
    10151017        jmp r0
    10161018    .recover:
    1017         codeBlockGetter(t1)
     1019        codeBlockGetter(t1, t2)
    10181020    .continue:
    10191021    end
    … …  
    10561058    # Stack check slow path returned that the stack was ok.
    10571059    # Since they were clobbered, need to get CodeBlock and new sp
    1058     codeBlockGetter(t1)
     1060    codeBlockGetter(t1, t2)
    10591061    getFrameRegisterSizeForCodeBlock(t1, t0)
    10601062    subp cfr, t0, t0

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r227874 r228420  
    21032103    loadp Callee[cfr], t1
    21042104    loadp JSFunction::m_executable[t1], t1
     2105    unpoison(_g_JSFunctionPoison, t1, t2)
    21052106    checkStackPointerAlignment(t3, 0xdead0001)
    21062107    if C_LOOP

  • trunk/Source/JavaScriptCore/runtime/JSAsyncFunction.h

    r215345 r228420  
    11/*
    22 * Copyright (C) 2016 Caitlin Potter <caitp@igalia.com>.
     3 * Copyright (C) 2018 Apple Inc. All rights reserved.
    34 *
    45 * Redistribution and use in source and binary forms, with or without
    … …  
    3839    const static unsigned StructureFlags = Base::StructureFlags;
    3940
     41    template<typename CellType>
     42    static IsoSubspace* subspaceFor(VM& vm)
     43    {
     44        return &vm.asyncFunctionSpace;
     45    }
     46
    4047    DECLARE_EXPORT_INFO;
    4148

  • trunk/Source/JavaScriptCore/runtime/JSAsyncGeneratorFunction.h

    r221080 r228420  
    11/*
    22 * Copyright (C) 2017 Oleksandr Skachkov <gskachkov@gmail.com>.
     3 * Copyright (C) 2018 Apple Inc. All rights reserved.
    34 *
    45 * Redistribution and use in source and binary forms, with or without
    … …  
    3738
    3839    const static unsigned StructureFlags = Base::StructureFlags;
     40
     41    template<typename CellType>
     42    static IsoSubspace* subspaceFor(VM& vm)
     43    {
     44        return &vm.asyncGeneratorFunctionSpace;
     45    }
    3946
    4047    DECLARE_EXPORT_INFO;

  • trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h

    r216561 r228420  
    11/*
    2  * Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2011-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4242    const static unsigned StructureFlags = ~ImplementsDefaultHasInstance & Base::StructureFlags;
    4343
     44    template<typename CellType>
     45    static IsoSubspace* subspaceFor(VM& vm)
     46    {
     47        return &vm.boundFunctionSpace;
     48    }
     49
    4450    static JSBoundFunction* create(VM&, ExecState*, JSGlobalObject*, JSObject* targetFunction, JSValue boundThis, JSArray* boundArgs, int, const String& name);
    4551   
    … …  
    7076    void finishCreation(VM&, NativeExecutable*, int length);
    7177
     78    // FIXME: Consider poisoning these pointers.
     79    // https://bugs.webkit.org/show_bug.cgi?id=182713
    7280    WriteBarrier<JSObject> m_targetFunction;
    7381    WriteBarrier<Unknown> m_boundThis;

  • trunk/Source/JavaScriptCore/runtime/JSCPoison.h

    r227874 r228420  
    4040    v(JSArrayBuffer) \
    4141    v(JSCallbackObject) \
     42    v(JSFunction) \
    4243    v(JSGlobalObject) \
    4344    v(JSScriptFetchParameters) \

  • trunk/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.h

    r206525 r228420  
    11/*
    2  * Copyright (C) 2015, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4141    static const unsigned StructureFlags = Base::StructureFlags;
    4242
     43    template<typename CellType>
     44    static IsoSubspace* subspaceFor(VM& vm)
     45    {
     46        return &vm.customGetterSetterFunctionSpace;
     47    }
     48
    4349    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
    4450    {

  • trunk/Source/JavaScriptCore/runtime/JSFunction.h

    r225891 r228420  
    11/*
    22 *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
    3  *  Copyright (C) 2003, 2006-2009, 2015-2016 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2003-2018 Apple Inc. All rights reserved.
    44 *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
    55 *  Copyright (C) 2007 Maks Orlovich
    … …  
    6262
    6363public:
     64   
     65    template<typename CellType>
     66    static IsoSubspace* subspaceFor(VM& vm)
     67    {
     68        return &vm.functionSpace;
     69    }
     70   
    6471    typedef JSCallee Base;
    6572    const static unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
    … …  
    213220    static EncodedJSValue nameGetter(ExecState*, EncodedJSValue, PropertyName);
    214221
    215     WriteBarrier<ExecutableBase> m_executable;
    216     WriteBarrier<FunctionRareData> m_rareData;
     222    template<typename T>
     223    using PoisonedBarrier = PoisonedWriteBarrier<JSFunctionPoison, T>;
     224   
     225    PoisonedBarrier<ExecutableBase> m_executable;
     226    PoisonedBarrier<FunctionRareData> m_rareData;
    217227};
    218228

  • trunk/Source/JavaScriptCore/runtime/JSGeneratorFunction.h

    r215345 r228420  
    11/*
    22 * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
     3 * Copyright (C) 2018 Apple Inc. All rights reserved.
    34 *
    45 * Redistribution and use in source and binary forms, with or without
    … …  
    6768    const static unsigned StructureFlags = Base::StructureFlags;
    6869
     70    template<typename CellType>
     71    static IsoSubspace* subspaceFor(VM& vm)
     72    {
     73        return &vm.generatorFunctionSpace;
     74    }
     75
    6976    DECLARE_EXPORT_INFO;
    7077

  • trunk/Source/JavaScriptCore/runtime/JSNativeStdFunction.h

    r206525 r228420  
    11/*
    2  * Copyright (C) 2015 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4141    const static unsigned StructureFlags = Base::StructureFlags;
    4242
     43    template<typename CellType>
     44    static IsoSubspace* subspaceFor(VM& vm)
     45    {
     46        return &vm.nativeStdFunctionSpace;
     47    }
     48
    4349    DECLARE_EXPORT_INFO;
    4450

  • trunk/Source/JavaScriptCore/runtime/VM.cpp

    r228366 r228420  
    6969#include "JSAPIValueWrapper.h"
    7070#include "JSArray.h"
     71#include "JSAsyncFunction.h"
    7172#include "JSBigInt.h"
     73#include "JSBoundFunction.h"
    7274#include "JSCInlines.h"
     75#include "JSCustomGetterSetterFunction.h"
    7376#include "JSDestructibleObjectHeapCellType.h"
    7477#include "JSFixedArray.h"
    … …  
    132135#include "Watchdog.h"
    133136#include "WeakGCMapInlines.h"
     137#include "WebAssemblyFunction.h"
     138#include "WebAssemblyWrapperFunction.h"
    134139#include <wtf/CurrentTime.h>
    135140#include <wtf/ProcessID.h>
    … …  
    251256    , webAssemblyCodeBlockSpace("JSWebAssemblyCodeBlockSpace", heap, webAssemblyCodeBlockHeapCellType.get(), fastMallocAllocator.get())
    252257#endif
     258    , asyncFunctionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSAsyncFunction)
     259    , asyncGeneratorFunctionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSAsyncGeneratorFunction)
     260    , boundFunctionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSBoundFunction)
     261    , customGetterSetterFunctionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSCustomGetterSetterFunction)
    253262    , directEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), DirectEvalExecutable)
    254263    , errorInstanceSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ErrorInstance)
    … …  
    256265    , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ExecutableToCodeBlockEdge)
    257266    , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable)
     267    , functionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSFunction)
     268    , generatorFunctionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSGeneratorFunction)
    258269    , indirectEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), IndirectEvalExecutable)
    259270    , inferredTypeSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), InferredType)
    … …  
    261272    , moduleProgramExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramExecutable)
    262273    , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), NativeExecutable)
     274    , nativeStdFunctionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSNativeStdFunction)
    263275    , programExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramExecutable)
    264276    , propertyTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), PropertyTable)
    … …  
    267279    , weakSetSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakSet)
    268280    , weakMapSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakMap)
     281#if ENABLE(WEBASSEMBLY)
     282    , webAssemblyFunctionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), WebAssemblyFunction)
     283    , webAssemblyWrapperFunctionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), WebAssemblyWrapperFunction)
     284#endif
    269285    , errorInstancesWithFinalizers(errorInstanceSpace)
    270286    , exceptionsWithFinalizers(exceptionSpace)

  • trunk/Source/JavaScriptCore/runtime/VM.h

    r228366 r228420  
    339339#endif
    340340   
     341    IsoSubspace asyncFunctionSpace;
     342    IsoSubspace asyncGeneratorFunctionSpace;
     343    IsoSubspace boundFunctionSpace;
     344    IsoSubspace customGetterSetterFunctionSpace;
    341345    IsoSubspace directEvalExecutableSpace;
    342346    IsoSubspace errorInstanceSpace;
    … …  
    344348    IsoSubspace executableToCodeBlockEdgeSpace;
    345349    IsoSubspace functionExecutableSpace;
     350    IsoSubspace functionSpace;
     351    IsoSubspace generatorFunctionSpace;
    346352    IsoSubspace indirectEvalExecutableSpace;
    347353    IsoSubspace inferredTypeSpace;
    … …  
    349355    IsoSubspace moduleProgramExecutableSpace;
    350356    IsoSubspace nativeExecutableSpace;
     357    IsoSubspace nativeStdFunctionSpace;
    351358    IsoSubspace programExecutableSpace;
    352359    IsoSubspace propertyTableSpace;
    … …  
    355362    IsoSubspace weakSetSpace;
    356363    IsoSubspace weakMapSpace;
     364#if ENABLE(WEBASSEMBLY)
     365    IsoSubspace webAssemblyFunctionSpace;
     366    IsoSubspace webAssemblyWrapperFunctionSpace;
     367#endif
    357368   
    358369    IsoCellSet errorInstancesWithFinalizers;

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h

    r225363 r228420  
    11/*
    2  * Copyright (C) 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2016-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4949    const static unsigned StructureFlags = Base::StructureFlags | TypeOfShouldCallGetCallData;
    5050
     51    template<typename CellType>
     52    static IsoSubspace* subspaceFor(VM& vm)
     53    {
     54        return &vm.webAssemblyFunctionSpace;
     55    }
     56
    5157    DECLARE_EXPORT_INFO;
    5258

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.h

    r227527 r228420  
    3939    const static unsigned StructureFlags = Base::StructureFlags;
    4040
     41    template<typename CellType>
     42    static IsoSubspace* subspaceFor(VM& vm)
     43    {
     44        return &vm.webAssemblyWrapperFunctionSpace;
     45    }
     46
    4147    DECLARE_INFO;
    4248
Note: See TracChangeset for help on using the changeset viewer.