Changeset 228632 in webkit


Ignore:
Timestamp:
Feb 19, 2018 1:59:43 AM (6 years ago)
Author:
Carlos Garcia Campos
Message:

Merge r228149 - Global objects should be able to use TLCs to allocate from different blocks from each other
​https://bugs.webkit.org/show_bug.cgi?id=182227

Source/JavaScriptCore:

Reviewed by JF Bastien.

This uses TLCs to create at least minimumDistanceBetweenCellsFromDifferenOrigins bytes of
distance between objects from different origins, using the following combination of things. For
short lets refer to that constant as K.

  • Since r227721, LargeAllocation puts K bytes padding at the end of each allocation.
  • Since r227718, MarkedBlock puts at least K bytes in its footer.
  • Since r227617, global objects can have their own TLCs, which make them allocate from a different set of blocks than other global objects. The TLC of a global object comes into effect when you enter the VM via that global object.
  • With this change, TLCs and blocks both have security origins. A TLC will only use blocks that share the same security origin or empty blocks (in which case we zero the block and change its security origin).

WebCore determines the TLC-GlobalObject mapping. By default, global objects would simply use
the VM's default TLC. WebCore makes it so that DOM windows (but not worker global objects) get
a TLC based on their document's SecurityOrigin.

  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Sources.txt:
  • heap/BlockDirectory.cpp:

(JSC::BlockDirectory::findBlockForAllocation):
(JSC::BlockDirectory::prepareForAllocation):

  • heap/BlockDirectory.h:
  • heap/LocalAllocator.cpp:

(JSC::LocalAllocator::LocalAllocator):
(JSC::LocalAllocator::reset):
(JSC::LocalAllocator::~LocalAllocator):
(JSC::LocalAllocator::allocateSlowCase):
(JSC::LocalAllocator::tryAllocateWithoutCollecting):

  • heap/LocalAllocator.h:

(JSC::LocalAllocator::tlc const):

  • heap/MarkStackMergingConstraint.cpp:
  • heap/MarkStackMergingConstraint.h:
  • heap/MarkedBlock.cpp:

(JSC::MarkedBlock::Handle::associateWithOrigin):

  • heap/MarkedBlock.h:

(JSC::MarkedBlock::Handle::securityOriginToken const):

  • heap/SecurityOriginToken.cpp: Added.

(JSC::uniqueSecurityOriginToken):

  • heap/SecurityOriginToken.h: Added.
  • heap/ThreadLocalCache.cpp:

(JSC::ThreadLocalCache::create):
(JSC::ThreadLocalCache::ThreadLocalCache):
(JSC::ThreadLocalCache::allocateData):
(JSC::ThreadLocalCache::installSlow):

  • heap/ThreadLocalCache.h:

(JSC::ThreadLocalCache::securityOriginToken const):

  • heap/ThreadLocalCacheInlines.h:

(JSC::ThreadLocalCache::install):

  • runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::JSGlobalObject):
(JSC::JSGlobalObject::createThreadLocalCache):

  • runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::threadLocalCache):
(JSC::JSGlobalObject::threadLocalCache const): Deleted.

  • runtime/VMEntryScope.cpp:

(JSC::VMEntryScope::VMEntryScope):
(JSC::VMEntryScope::~VMEntryScope):

  • runtime/VMEntryScope.h:

Source/WebCore:

Reviewed by Daniel Bates and Chris Dumez.

No new tests because no change in behavior.

Adopt JSC TLC API to put distance between objects from different security origins. WebCore has
a subclass of ThreadLocalCache that supports hash-consing based on the relevant origin data
using the existing SecurityOriginHash. It's Document's job to initiate this, but all of the
logic is in WebCore::OriginThreadLocalCache.

Workers don't opt into this. They just get the VM's default TLC all the time.

  • ForwardingHeaders/heap/ThreadLocalCache.h: Added.
  • Sources.txt:
  • WebCore.xcodeproj/project.pbxproj:
  • bindings/js/JSDOMGlobalObject.cpp:

(WebCore::JSDOMGlobalObject::JSDOMGlobalObject):

  • bindings/js/JSDOMGlobalObject.h:
  • bindings/js/JSDOMWindowBase.cpp:

(WebCore::JSDOMWindowBase::JSDOMWindowBase):

  • dom/Document.cpp:

(WebCore::Document::initSecurityContext):
(WebCore::Document::threadLocalCache):

  • dom/Document.h:
  • page/OriginThreadLocalCache.cpp: Added.

(WebCore::threadLocalCacheMap):
(WebCore::OriginThreadLocalCache::create):
(WebCore::OriginThreadLocalCache::~OriginThreadLocalCache):
(WebCore::OriginThreadLocalCache::OriginThreadLocalCache):

  • page/OriginThreadLocalCache.h: Added.
  • page/SecurityOrigin.cpp:

(WebCore::SecurityOrigin::passesFileCheck const):
(WebCore::SecurityOrigin::setEnforcesFilePathSeparation):
(WebCore::SecurityOrigin::toString const):
(WebCore::SecurityOrigin::enforceFilePathSeparation): Deleted.

  • page/SecurityOrigin.h:

(WebCore::SecurityOrigin::enforcesFilePathSeparation const):

Location:
releases/WebKitGTK/webkit-2.20/Source
Files:
1 added
28 edited
4 copied

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/CMakeLists.txt

    r228616 r228632  
    514514    heap/RegisterState.h
    515515    heap/RunningScope.h
     516    heap/SecurityOriginToken.h
    516517    heap/SimpleMarkingConstraint.h
    517518    heap/SlotVisitor.h

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/ChangeLog

    r228616 r228632  
     12018-01-28  Filip Pizlo  <fpizlo@apple.com>
     2
     3        Global objects should be able to use TLCs to allocate from different blocks from each other
     4        https://bugs.webkit.org/show_bug.cgi?id=182227
     5
     6        Reviewed by JF Bastien.
     7       
     8        This uses TLCs to create at least `minimumDistanceBetweenCellsFromDifferenOrigins` bytes of
     9        distance between objects from different origins, using the following combination of things. For
     10        short lets refer to that constant as K.
     11       
     12        - Since r227721, LargeAllocation puts K bytes padding at the end of each allocation.
     13       
     14        - Since r227718, MarkedBlock puts at least K bytes in its footer.
     15       
     16        - Since r227617, global objects can have their own TLCs, which make them allocate from a
     17          different set of blocks than other global objects. The TLC of a global object comes into
     18          effect when you enter the VM via that global object.
     19       
     20        - With this change, TLCs and blocks both have security origins. A TLC will only use blocks that
     21          share the same security origin or empty blocks (in which case we zero the block and change
     22          its security origin).
     23       
     24        WebCore determines the TLC-GlobalObject mapping. By default, global objects would simply use
     25        the VM's default TLC. WebCore makes it so that DOM windows (but not worker global objects) get
     26        a TLC based on their document's SecurityOrigin.
     27       
     28        * JavaScriptCore.xcodeproj/project.pbxproj:
     29        * Sources.txt:
     30        * heap/BlockDirectory.cpp:
     31        (JSC::BlockDirectory::findBlockForAllocation):
     32        (JSC::BlockDirectory::prepareForAllocation):
     33        * heap/BlockDirectory.h:
     34        * heap/LocalAllocator.cpp:
     35        (JSC::LocalAllocator::LocalAllocator):
     36        (JSC::LocalAllocator::reset):
     37        (JSC::LocalAllocator::~LocalAllocator):
     38        (JSC::LocalAllocator::allocateSlowCase):
     39        (JSC::LocalAllocator::tryAllocateWithoutCollecting):
     40        * heap/LocalAllocator.h:
     41        (JSC::LocalAllocator::tlc const):
     42        * heap/MarkStackMergingConstraint.cpp:
     43        * heap/MarkStackMergingConstraint.h:
     44        * heap/MarkedBlock.cpp:
     45        (JSC::MarkedBlock::Handle::associateWithOrigin):
     46        * heap/MarkedBlock.h:
     47        (JSC::MarkedBlock::Handle::securityOriginToken const):
     48        * heap/SecurityOriginToken.cpp: Added.
     49        (JSC::uniqueSecurityOriginToken):
     50        * heap/SecurityOriginToken.h: Added.
     51        * heap/ThreadLocalCache.cpp:
     52        (JSC::ThreadLocalCache::create):
     53        (JSC::ThreadLocalCache::ThreadLocalCache):
     54        (JSC::ThreadLocalCache::allocateData):
     55        (JSC::ThreadLocalCache::installSlow):
     56        * heap/ThreadLocalCache.h:
     57        (JSC::ThreadLocalCache::securityOriginToken const):
     58        * heap/ThreadLocalCacheInlines.h:
     59        (JSC::ThreadLocalCache::install):
     60        * runtime/JSGlobalObject.cpp:
     61        (JSC::JSGlobalObject::JSGlobalObject):
     62        (JSC::JSGlobalObject::createThreadLocalCache):
     63        * runtime/JSGlobalObject.h:
     64        (JSC::JSGlobalObject::threadLocalCache):
     65        (JSC::JSGlobalObject::threadLocalCache const): Deleted.
     66        * runtime/VMEntryScope.cpp:
     67        (JSC::VMEntryScope::VMEntryScope):
     68        (JSC::VMEntryScope::~VMEntryScope):
     69        * runtime/VMEntryScope.h:
     70
    1712018-02-05  Don Olmstead  <don.olmstead@sony.com>
    272

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r227738 r228632  
    295295                0F426A491460CBB700131F8F /* VirtualRegister.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A461460CBAB00131F8F /* VirtualRegister.h */; settings = {ATTRIBUTES = (Private, ); }; };
    296296                0F426A4B1460CD6E00131F8F /* DataFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A4A1460CD6B00131F8F /* DataFormat.h */; settings = {ATTRIBUTES = (Private, ); }; };
     297                0F42B3C3201EC9FF00357031 /* SecurityOriginToken.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F42B3C2201EC9FD00357031 /* SecurityOriginToken.h */; settings = {ATTRIBUTES = (Private, ); }; };
    297298                0F431738146BAC69007E3890 /* ListableHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F431736146BAC65007E3890 /* ListableHandler.h */; settings = {ATTRIBUTES = (Private, ); }; };
    298299                0F4570391BE44C910062A629 /* AirEliminateDeadCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4570371BE44C910062A629 /* AirEliminateDeadCode.h */; };
    … …  
    22632264                0F426A461460CBAB00131F8F /* VirtualRegister.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VirtualRegister.h; sourceTree = "<group>"; };
    22642265                0F426A4A1460CD6B00131F8F /* DataFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataFormat.h; sourceTree = "<group>"; };
     2266                0F42B3C0201EB50900357031 /* Allocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Allocator.cpp; sourceTree = "<group>"; };
     2267                0F42B3C2201EC9FD00357031 /* SecurityOriginToken.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SecurityOriginToken.h; sourceTree = "<group>"; };
    22652268                0F431736146BAC65007E3890 /* ListableHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ListableHandler.h; sourceTree = "<group>"; };
    22662269                0F4570361BE44C910062A629 /* AirEliminateDeadCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirEliminateDeadCode.cpp; path = b3/air/AirEliminateDeadCode.cpp; sourceTree = "<group>"; };
    … …  
    55605563                        isa = PBXGroup;
    55615564                        children = (
    5562                                 0F75A054200D25EF0038E2CF /* Allocator.h */,
    5563                                 0F75A05D200D25F10038E2CF /* AllocatorInlines.h */,
    5564                                 0F75A059200D25F00038E2CF /* LocalAllocator.cpp */,
    5565                                 0F75A057200D25F00038E2CF /* LocalAllocator.h */,
    5566                                 0F75A05A200D25F00038E2CF /* LocalAllocatorInlines.h */,
    5567                                 0F75A058200D25F00038E2CF /* ThreadLocalCache.cpp */,
    5568                                 0F75A055200D25EF0038E2CF /* ThreadLocalCache.h */,
    5569                                 0F75A056200D25EF0038E2CF /* ThreadLocalCacheInlines.h */,
    5570                                 0F75A05B200D25F10038E2CF /* ThreadLocalCacheLayout.cpp */,
    5571                                 0F75A05C200D25F10038E2CF /* ThreadLocalCacheLayout.h */,
    55725565                                0FEC3C501F33A41600F59B6C /* AlignedMemoryAllocator.cpp */,
    55735566                                0FEC3C511F33A41600F59B6C /* AlignedMemoryAllocator.h */,
    55745567                                0FA7620A1DB959F600B7A2FD /* AllocatingScope.h */,
    55755568                                0FDCE11B1FAE61F4006F3901 /* AllocationFailureMode.h */,
     5569                                0F42B3C0201EB50900357031 /* Allocator.cpp */,
     5570                                0F75A054200D25EF0038E2CF /* Allocator.h */,
    55765571                                0F30CB5D1FCE46B4004B5323 /* AllocatorForMode.h */,
     5572                                0F75A05D200D25F10038E2CF /* AllocatorInlines.h */,
    55775573                                0FB4677E1FDDA6E5003FCB09 /* AtomIndices.h */,
    55785574                                C2B916C414DA040C00CBAC86 /* BlockDirectory.cpp */,
    … …  
    56755671                                0F070A461D543A89006E7232 /* LargeAllocation.h */,
    56765672                                0F431736146BAC65007E3890 /* ListableHandler.h */,
     5673                                0F75A059200D25F00038E2CF /* LocalAllocator.cpp */,
     5674                                0F75A057200D25F00038E2CF /* LocalAllocator.h */,
     5675                                0F75A05A200D25F00038E2CF /* LocalAllocatorInlines.h */,
    56775676                                0F208AD61DF0925A007D3269 /* LockDuringMarking.h */,
    56785677                                14B7233F12D7D0DA003BD5ED /* MachineStackMarker.cpp */,
    … …  
    57045703                                0F7CF94E1DBEEE860098CC12 /* ReleaseHeapAccessScope.h */,
    57055704                                0F2C63A91E4FA42C00C13839 /* RunningScope.h */,
     5705                                0F42B3C2201EC9FD00357031 /* SecurityOriginToken.h */,
    57065706                                0F4D8C761FCA3CF2001D32AC /* SimpleMarkingConstraint.cpp */,
    57075707                                0F4D8C771FCA3CF3001D32AC /* SimpleMarkingConstraint.h */,
    … …  
    57255725                                0F1FB38A1E173A6200A9BE50 /* SynchronousStopTheWorldMutatorScheduler.cpp */,
    57265726                                0F1FB38B1E173A6200A9BE50 /* SynchronousStopTheWorldMutatorScheduler.h */,
     5727                                0F75A058200D25F00038E2CF /* ThreadLocalCache.cpp */,
     5728                                0F75A055200D25EF0038E2CF /* ThreadLocalCache.h */,
     5729                                0F75A056200D25EF0038E2CF /* ThreadLocalCacheInlines.h */,
     5730                                0F75A05B200D25F10038E2CF /* ThreadLocalCacheLayout.cpp */,
     5731                                0F75A05C200D25F10038E2CF /* ThreadLocalCacheLayout.h */,
    57275732                                141448CC13A1783700F5BA1A /* TinyBloomFilter.h */,
    57285733                                0F5F08CE146C762F000472A9 /* UnconditionalFinalizer.h */,
    … …  
    85238528                                A7D89CFE17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.h in Headers */,
    85248529                                0FD82E57141DAF1000179C94 /* DFGOSREntry.h in Headers */,
     8530                                0F42B3C3201EC9FF00357031 /* SecurityOriginToken.h in Headers */,
    85258531                                0FD8A32617D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.h in Headers */,
    85268532                                0FC0976A1468A6F700CF2442 /* DFGOSRExit.h in Headers */,

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/Sources.txt

    r227617 r228632  
    1 // Copyright (C) 2017 Apple Inc. All rights reserved.
     1// Copyright (C) 2017-2018 Apple Inc. All rights reserved.
    22//
    33// Redistribution and use in source and binary forms, with or without
    … …  
    513513heap/MutatorScheduler.cpp
    514514heap/MutatorState.cpp
     515heap/SecurityOriginToken.cpp
    515516heap/SimpleMarkingConstraint.cpp
    516517heap/SlotVisitor.cpp

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/BlockDirectory.cpp

    r227717 r228632  
    3434#include "MarkedBlockInlines.h"
    3535#include "SuperSampler.h"
     36#include "ThreadLocalCacheInlines.h"
    3637#include "VM.h"
    3738#include <wtf/CurrentTime.h>
    … …  
    8182}
    8283
    83 MarkedBlock::Handle* BlockDirectory::findBlockForAllocation()
    84 {
    85     m_allocationCursor = (m_canAllocateButNotEmpty | m_empty).findBit(m_allocationCursor, true);
    86     if (m_allocationCursor >= m_blocks.size())
    87         return nullptr;
    88    
    89     setIsCanAllocateButNotEmpty(NoLockingNecessary, m_allocationCursor, false);
    90     return m_blocks[m_allocationCursor];
     84MarkedBlock::Handle* BlockDirectory::findBlockForAllocation(LocalAllocator& allocator)
     85{
     86    for (;;) {
     87        allocator.m_allocationCursor = (m_canAllocateButNotEmpty | m_empty).findBit(allocator.m_allocationCursor, true);
     88        if (allocator.m_allocationCursor >= m_blocks.size())
     89            return nullptr;
     90       
     91        size_t blockIndex = allocator.m_allocationCursor++;
     92        MarkedBlock::Handle* result = m_blocks[blockIndex];
     93        if (result->securityOriginToken() == allocator.tlc()->securityOriginToken()) {
     94            setIsCanAllocateButNotEmpty(NoLockingNecessary, blockIndex, false);
     95            return result;
     96        }
     97    }
    9198}
    9299
    … …  
    184191        });
    185192   
    186     m_allocationCursor = 0;
    187     m_emptyCursor = 0;
    188193    m_unsweptCursor = 0;
    189194   

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/BlockDirectory.h

    r227717 r228632  
    4444class MarkedSpace;
    4545class LLIntOffsetsExtractor;
     46class ThreadLocalCache;
    4647class ThreadLocalCacheLayout;
    4748
    … …  
    163164   
    164165private:
     166    friend class IsoCellSet;
    165167    friend class LocalAllocator;
    166     friend class IsoCellSet;
     168    friend class LocalSideAllocator;
    167169    friend class MarkedBlock;
    168170    friend class ThreadLocalCacheLayout;
    169171   
    170     MarkedBlock::Handle* findBlockForAllocation();
     172    MarkedBlock::Handle* findBlockForAllocation(LocalAllocator&);
    171173   
    172174    MarkedBlock::Handle* tryAllocateBlock();
    … …  
    185187    // After you do something to a block based on one of these cursors, you clear the bit in the
    186188    // corresponding bitvector and leave the cursor where it was.
    187     size_t m_allocationCursor { 0 }; // Points to the next block that is a candidate for allocation.
    188     size_t m_emptyCursor { 0 }; // Points to the next block that is a candidate for empty allocation (allocating in empty blocks).
     189    size_t m_emptyCursor { 0 };
    189190    size_t m_unsweptCursor { 0 }; // Points to the next block that is a candidate for incremental sweeping.
    190191   

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/LocalAllocator.cpp

    r227617 r228632  
    3333namespace JSC {
    3434
    35 LocalAllocator::LocalAllocator(BlockDirectory* directory)
    36     : m_directory(directory)
     35LocalAllocator::LocalAllocator(ThreadLocalCache* tlc, BlockDirectory* directory)
     36    : m_tlc(tlc)
     37    , m_directory(directory)
    3738    , m_cellSize(directory->m_cellSize)
    3839    , m_freeList(m_cellSize)
    … …  
    4344
    4445LocalAllocator::LocalAllocator(LocalAllocator&& other)
    45     : m_directory(other.m_directory)
     46    : m_tlc(other.m_tlc)
     47    , m_directory(other.m_directory)
    4648    , m_cellSize(other.m_cellSize)
    4749    , m_freeList(WTFMove(other.m_freeList))
    4850    , m_currentBlock(other.m_currentBlock)
    4951    , m_lastActiveBlock(other.m_lastActiveBlock)
     52    , m_allocationCursor(other.m_allocationCursor)
    5053{
    5154    other.reset();
    … …  
    6265    m_currentBlock = nullptr;
    6366    m_lastActiveBlock = nullptr;
     67    m_allocationCursor = 0;
    6468}
    6569
    … …  
    8185    //   time of destruction because for it to get into any other state, someone must have allocated
    8286    //   in it (which is impossible because it's supposedly unreachable).
     87    //
     88    // My biggest worry with these assertions is that there will be some TLC that gets set as the
     89    // current one but then never reset, and in the meantime the global object that owns it gets
     90    // destroyed.
     91    //
     92    // Note that if we did hold onto some memory and we wanted to return it then this could be weird.
     93    // We would potentially have to stopAllocating(). That would mean having to return a block to the
     94    // BlockDirectory. It's not clear that the BlockDirectory is prepared to handle that during
     95    // sweeping another block, for example.
    8396    bool ok = true;
    8497    if (!m_freeList.allocationWillFail()) {
    … …  
    165178            return nullptr;
    166179    }
     180    block->associateWithOrigin(m_tlc->securityOriginToken());
    167181    m_directory->addBlock(block);
    168182    result = allocateIn(block);
    … …  
    202216   
    203217    for (;;) {
    204         MarkedBlock::Handle* block = m_directory->findBlockForAllocation();
     218        MarkedBlock::Handle* block = m_directory->findBlockForAllocation(*this);
    205219        if (!block)
    206220            break;
    … …  
    221235            // and empty set at the same time.
    222236            block->removeFromDirectory();
     237            block->associateWithOrigin(m_tlc->securityOriginToken());
    223238            m_directory->addBlock(block);
    224239            return allocateIn(block);

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/LocalAllocator.h

    r227617 r228632  
    3434class BlockDirectory;
    3535class GCDeferralContext;
     36class ThreadLocalCache;
    3637
    3738class LocalAllocator : public BasicRawSentinelNode<LocalAllocator> {
    … …  
    3940   
    4041public:
    41     LocalAllocator(BlockDirectory*);
     42    LocalAllocator(ThreadLocalCache*, BlockDirectory*);
    4243    LocalAllocator(LocalAllocator&&);
    4344    ~LocalAllocator();
    … …  
    5455   
    5556    bool isFreeListedCell(const void*) const;
     57   
     58    ThreadLocalCache* tlc() const { return m_tlc; }
    5659
    5760private:
     61    friend class BlockDirectory;
     62   
    5863    void reset();
    5964    JS_EXPORT_PRIVATE void* allocateSlowCase(GCDeferralContext*, AllocationFailureMode failureMode);
    … …  
    6469    ALWAYS_INLINE void doTestCollectionsIfNeeded(GCDeferralContext*);
    6570
     71    ThreadLocalCache* m_tlc;
    6672    BlockDirectory* m_directory;
    6773    unsigned m_cellSize;
    … …  
    6975    MarkedBlock::Handle* m_currentBlock { nullptr };
    7076    MarkedBlock::Handle* m_lastActiveBlock { nullptr };
     77   
     78    // After you do something to a block based on one of these cursors, you clear the bit in the
     79    // corresponding bitvector and leave the cursor where it was.
     80    size_t m_allocationCursor { 0 }; // Points to the next block that is a candidate for allocation.
    7181};
    7282

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/MarkStackMergingConstraint.cpp

    r226783 r228632  
    2626#include "config.h"
    2727#include "MarkStackMergingConstraint.h"
     28
     29#include "GCSegmentedArrayInlines.h"
     30#include "JSCInlines.h"
    2831
    2932namespace JSC {

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/MarkStackMergingConstraint.h

    r226783 r228632  
    3030namespace JSC {
    3131
     32class Heap;
     33class SlotVisitor;
     34
    3235class MarkStackMergingConstraint : public MarkingConstraint {
    3336public:

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/MarkedBlock.cpp

    r227718 r228632  
    489489}
    490490
     491void MarkedBlock::Handle::associateWithOrigin(SecurityOriginToken securityOriginToken)
     492{
     493    if (m_securityOriginToken == securityOriginToken)
     494        return;
     495   
     496    memset(&block(), 0, endAtom * atomSize);
     497    m_securityOriginToken = securityOriginToken;
     498}
     499
    491500} // namespace JSC
    492501

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/MarkedBlock.h

    r227721 r228632  
    2626#include "HeapCell.h"
    2727#include "IterationStatus.h"
     28#include "SecurityOriginToken.h"
    2829#include "WeakSet.h"
    2930#include <wtf/Atomics.h>
    … …  
    195196        void dumpState(PrintStream&);
    196197       
     198        void associateWithOrigin(SecurityOriginToken);
     199        SecurityOriginToken securityOriginToken() const { return m_securityOriginToken; }
     200       
    197201    private:
    198202        Handle(Heap&, AlignedMemoryAllocator*, void*);
    … …  
    230234       
    231235        MarkedBlock* m_block { nullptr };
     236       
     237        SecurityOriginToken m_securityOriginToken { 0 };
    232238    };
    233239

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/SecurityOriginToken.cpp

    r228631 r228632  
    11/*
    2  * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2424 */
    2525
    26 #pragma once
     26#include "config.h"
     27#include "SecurityOriginToken.h"
    2728
    28 #include <functional>
    29 #include <wtf/Vector.h>
     29#include <wtf/Atomics.h>
    3030
    3131namespace JSC {
    3232
    33 class JSGlobalObject;
    34 class VM;
    35 
    36 class VMEntryScope {
    37 public:
    38     JS_EXPORT_PRIVATE VMEntryScope(VM&, JSGlobalObject*);
    39     JS_EXPORT_PRIVATE ~VMEntryScope();
    40 
    41     VM& vm() const { return m_vm; }
    42     JSGlobalObject* globalObject() const { return m_globalObject; }
    43 
    44     void addDidPopListener(std::function<void ()>);
    45 
    46 private:
    47     VM& m_vm;
    48     JSGlobalObject* m_globalObject;
    49     Vector<std::function<void ()>> m_didPopListeners;
    50 };
     33SecurityOriginToken uniqueSecurityOriginToken()
     34{
     35    static SecurityOriginToken counter;
     36    return WTF::atomicExchangeAdd(&counter, 1) + 1;
     37}
    5138
    5239} // namespace JSC
     40

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/SecurityOriginToken.h

    r228631 r228632  
    11/*
    2  * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2626#pragma once
    2727
    28 #include <functional>
    29 #include <wtf/Vector.h>
    30 
    3128namespace JSC {
    3229
    33 class JSGlobalObject;
    34 class VM;
     30typedef uint64_t SecurityOriginToken;
    3531
    36 class VMEntryScope {
    37 public:
    38     JS_EXPORT_PRIVATE VMEntryScope(VM&, JSGlobalObject*);
    39     JS_EXPORT_PRIVATE ~VMEntryScope();
    40 
    41     VM& vm() const { return m_vm; }
    42     JSGlobalObject* globalObject() const { return m_globalObject; }
    43 
    44     void addDidPopListener(std::function<void ()>);
    45 
    46 private:
    47     VM& m_vm;
    48     JSGlobalObject* m_globalObject;
    49     Vector<std::function<void ()>> m_didPopListeners;
    50 };
     32JS_EXPORT_PRIVATE SecurityOriginToken uniqueSecurityOriginToken();
    5133
    5234} // namespace JSC
     35

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/ThreadLocalCache.cpp

    r227683 r228632  
    3333namespace JSC {
    3434
    35 RefPtr<ThreadLocalCache> ThreadLocalCache::create(Heap& heap)
     35RefPtr<ThreadLocalCache> ThreadLocalCache::create(Heap& heap, SecurityOriginToken securityOriginToken)
    3636{
    37     return adoptRef(new ThreadLocalCache(heap));
     37    return adoptRef(new ThreadLocalCache(heap, securityOriginToken));
    3838}
    3939
    40 ThreadLocalCache::ThreadLocalCache(Heap& heap)
     40ThreadLocalCache::ThreadLocalCache(Heap& heap, SecurityOriginToken securityOriginToken)
    4141    : m_heap(heap)
     42    , m_securityOriginToken(securityOriginToken)
    4243{
    4344    m_data = allocateData();
    … …  
    6061        new (&allocator(*result, offset)) LocalAllocator(WTFMove(allocator(*m_data, offset)));
    6162    for (size_t offset = oldSize; offset < layout.size; offset += sizeof(LocalAllocator))
    62         new (&allocator(*result, offset)) LocalAllocator(layout.directories[offset / sizeof(LocalAllocator)]);
     63        new (&allocator(*result, offset)) LocalAllocator(this, layout.directories[offset / sizeof(LocalAllocator)]);
    6364    return result;
    6465}
    … …  
    7172}
    7273
    73 void ThreadLocalCache::installSlow(VM& vm)
     74void ThreadLocalCache::installSlow(VM& vm, RefPtr<ThreadLocalCache>* previous)
    7475{
    7576#if USE(FAST_TLS_FOR_TLC)
    … …  
    8485    ref();
    8586   
    86     if (RefPtr<ThreadLocalCache> oldCache = get(vm))
    87         oldCache->deref();
     87    if (ThreadLocalCache::Data* oldCacheData = getImpl(vm)) {
     88        ThreadLocalCache* oldCache = oldCacheData->cache;
     89        if (previous)
     90            *previous = adoptRef(oldCache);
     91        else
     92            oldCache->deref();
     93    }
    8894   
    8995    installData(vm, m_data);

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/ThreadLocalCache.h

    r227683 r228632  
    2626#pragma once
    2727
     28#include "AllocationFailureMode.h"
     29#include "LocalAllocator.h"
     30#include "SecurityOriginToken.h"
    2831#include <wtf/FastMalloc.h>
    2932#include <wtf/FastTLS.h>
    3033#include <wtf/ThreadSafeRefCounted.h>
     34#include <wtf/Vector.h>
    3135
    3236namespace JSC {
    … …  
    4044   
    4145public:
    42     static RefPtr<ThreadLocalCache> create(Heap&);
     46    JS_EXPORT_PRIVATE static RefPtr<ThreadLocalCache> create(Heap&, SecurityOriginToken = uniqueSecurityOriginToken());
    4347   
    44     JS_EXPORT_PRIVATE ~ThreadLocalCache();
     48    JS_EXPORT_PRIVATE virtual ~ThreadLocalCache();
    4549
    4650    static RefPtr<ThreadLocalCache> get(VM&);
    … …  
    5054    // assumes a relatively small number of caches or low chance of actual context switch combined
    5155    // with possibly high rate of "I may have context switched" sites that call this out of paranoia.
    52     void install(VM&);
     56    void install(VM&, RefPtr<ThreadLocalCache>* = nullptr);
    5357   
    5458    static LocalAllocator& allocator(VM&, size_t offset);
    … …  
    6064    static ptrdiff_t offsetOfFirstAllocatorInData() { return OBJECT_OFFSETOF(Data, allocator); }
    6165   
     66    SecurityOriginToken securityOriginToken() const { return m_securityOriginToken; }
     67
     68protected:   
     69    JS_EXPORT_PRIVATE ThreadLocalCache(Heap&, SecurityOriginToken);
     70   
    6271private:
    6372    friend class VM;
    64    
    65     ThreadLocalCache(Heap&);
    6673   
    6774    struct Data {
    … …  
    7784    static LocalAllocator& allocator(Data& data, size_t offset);
    7885
    79     void installSlow(VM&);
     86    void installSlow(VM&, RefPtr<ThreadLocalCache>*);
    8087    static void installData(VM&, Data*);
    8188   
    … …  
    9299    Heap& m_heap;
    93100    Data* m_data { nullptr };
     101   
     102    SecurityOriginToken m_securityOriginToken;
    94103
    95104#if USE(FAST_TLS_FOR_TLC)

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/heap/ThreadLocalCacheInlines.h

    r227683 r228632  
    2727
    2828#include "ThreadLocalCache.h"
     29#include "VM.h"
    2930
    3031namespace JSC {
    … …  
    4849}
    4950
    50 inline void ThreadLocalCache::install(VM& vm)
     51inline void ThreadLocalCache::install(VM& vm, RefPtr<ThreadLocalCache>* previous)
    5152{
    52     if (getImpl(vm) == m_data)
     53    if (getImpl(vm) == m_data) {
     54        if (previous)
     55            *previous = nullptr;
    5356        return;
    54     installSlow(vm);
     57    }
     58    installSlow(vm, previous);
    5559}
    5660

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/runtime/JSGlobalObject.h

    r227959 r228632  
    492492
    493493protected:
    494     JS_EXPORT_PRIVATE explicit JSGlobalObject(VM&, Structure*, const GlobalObjectMethodTable* = 0, RefPtr<ThreadLocalCache> = nullptr);
     494    JS_EXPORT_PRIVATE explicit JSGlobalObject(VM&, Structure*, const GlobalObjectMethodTable* = nullptr, RefPtr<ThreadLocalCache> = nullptr);
    495495
    496496    JS_EXPORT_PRIVATE void finishCreation(VM&);

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/runtime/VMEntryScope.cpp

    r227617 r228632  
    4242    , m_globalObject(globalObject)
    4343{
    44     globalObject->threadLocalCache().install(vm);
     44    globalObject->threadLocalCache().install(vm, &m_previousTLC);
    4545    ASSERT(!DisallowVMReentry::isInEffectOnCurrentThread());
    4646    ASSERT(Thread::current().stack().isGrowingDownward());
    … …  
    7272VMEntryScope::~VMEntryScope()
    7373{
     74    if (m_previousTLC)
     75        m_previousTLC->install(m_vm);
     76   
    7477    if (m_vm.entryScope != this)
    7578        return;
    7679
    7780    TracePoint(VMEntryScopeEnd);
    78 
     81   
    7982    if (m_vm.watchdog())
    8083        m_vm.watchdog()->exitedVM();

  • releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/runtime/VMEntryScope.h

    r218794 r228632  
    3232
    3333class JSGlobalObject;
     34class ThreadLocalCache;
    3435class VM;
    3536
    … …  
    4849    JSGlobalObject* m_globalObject;
    4950    Vector<std::function<void ()>> m_didPopListeners;
     51    RefPtr<ThreadLocalCache> m_previousTLC;
    5052};
    5153

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/ChangeLog

    r228624 r228632  
     12018-02-05  Filip Pizlo  <fpizlo@apple.com>
     2
     3        Global objects should be able to use TLCs to allocate from different blocks from each other
     4        https://bugs.webkit.org/show_bug.cgi?id=182227
     5
     6        Reviewed by Daniel Bates and Chris Dumez.
     7
     8        No new tests because no change in behavior.
     9       
     10        Adopt JSC TLC API to put distance between objects from different security origins. WebCore has
     11        a subclass of ThreadLocalCache that supports hash-consing based on the relevant origin data
     12        using the existing SecurityOriginHash. It's Document's job to initiate this, but all of the
     13        logic is in WebCore::OriginThreadLocalCache.
     14       
     15        Workers don't opt into this. They just get the VM's default TLC all the time.
     16
     17        * ForwardingHeaders/heap/ThreadLocalCache.h: Added.
     18        * Sources.txt:
     19        * WebCore.xcodeproj/project.pbxproj:
     20        * bindings/js/JSDOMGlobalObject.cpp:
     21        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
     22        * bindings/js/JSDOMGlobalObject.h:
     23        * bindings/js/JSDOMWindowBase.cpp:
     24        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
     25        * dom/Document.cpp:
     26        (WebCore::Document::initSecurityContext):
     27        (WebCore::Document::threadLocalCache):
     28        * dom/Document.h:
     29        * page/OriginThreadLocalCache.cpp: Added.
     30        (WebCore::threadLocalCacheMap):
     31        (WebCore::OriginThreadLocalCache::create):
     32        (WebCore::OriginThreadLocalCache::~OriginThreadLocalCache):
     33        (WebCore::OriginThreadLocalCache::OriginThreadLocalCache):
     34        * page/OriginThreadLocalCache.h: Added.
     35        * page/SecurityOrigin.cpp:
     36        (WebCore::SecurityOrigin::passesFileCheck const):
     37        (WebCore::SecurityOrigin::setEnforcesFilePathSeparation):
     38        (WebCore::SecurityOrigin::toString const):
     39        (WebCore::SecurityOrigin::enforceFilePathSeparation): Deleted.
     40        * page/SecurityOrigin.h:
     41        (WebCore::SecurityOrigin::enforcesFilePathSeparation const):
     42
    1432018-02-05  Don Olmstead  <don.olmstead@sony.com>
    244

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/Sources.txt

    r227849 r228632  
    13351335page/NavigatorBase.cpp
    13361336page/OriginAccessEntry.cpp
     1337page/OriginThreadLocalCache.cpp
    13371338page/Page.cpp
    13381339page/PageConfiguration.cpp

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/WebCore.xcodeproj/project.pbxproj

    r227849 r228632  
    343343                0F580FA31496939100FB5BD8 /* WebTiledBackingLayer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F580FA11496939100FB5BD8 /* WebTiledBackingLayer.h */; };
    344344                0F580FAF149800D400FB5BD8 /* AnimationUtilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F580FAE149800D400FB5BD8 /* AnimationUtilities.h */; settings = {ATTRIBUTES = (Private, ); }; };
     345                0F5B408A20212F770080F913 /* OriginThreadLocalCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5B408820212F730080F913 /* OriginThreadLocalCache.h */; };
    345346                0F5B7A5510F65D7A00376302 /* RenderEmbeddedObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5B7A5310F65D7A00376302 /* RenderEmbeddedObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
    346347                0F5E200618E771FC003EC3E5 /* PlatformCAAnimationCocoa.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5E200518E771FC003EC3E5 /* PlatformCAAnimationCocoa.h */; settings = {ATTRIBUTES = (Private, ); }; };
    … …  
    54975498                0F580FA21496939100FB5BD8 /* WebTiledBackingLayer.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebTiledBackingLayer.mm; sourceTree = "<group>"; };
    54985499                0F580FAE149800D400FB5BD8 /* AnimationUtilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AnimationUtilities.h; sourceTree = "<group>"; };
     5500                0F5B408820212F730080F913 /* OriginThreadLocalCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OriginThreadLocalCache.h; sourceTree = "<group>"; };
     5501                0F5B408920212F730080F913 /* OriginThreadLocalCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginThreadLocalCache.cpp; sourceTree = "<group>"; };
    54995502                0F5B7A5210F65D7A00376302 /* RenderEmbeddedObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderEmbeddedObject.cpp; sourceTree = "<group>"; };
    55005503                0F5B7A5310F65D7A00376302 /* RenderEmbeddedObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderEmbeddedObject.h; sourceTree = "<group>"; };
    … …  
    99379940                8AF4E55911DC5A63000ED3DE /* PerformanceTiming.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PerformanceTiming.h; sourceTree = "<group>"; };
    99389941                8AF4E55A11DC5A63000ED3DE /* PerformanceTiming.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PerformanceTiming.idl; sourceTree = "<group>"; };
     9942                8BD37A67201BB39C0011734A /* ReadableStreamChunk.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ReadableStreamChunk.h; sourceTree = "<group>"; };
    99399943                8E33CD93201A29C100E39093 /* GapLength.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GapLength.cpp; sourceTree = "<group>"; };
    9940                 8BD37A67201BB39C0011734A /* ReadableStreamChunk.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ReadableStreamChunk.h; sourceTree = "<group>"; };
    99419944                8E4C96D81AD4483500365A50 /* JSFetchResponse.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFetchResponse.cpp; sourceTree = "<group>"; };
    99429945                8E4C96D91AD4483500365A50 /* JSFetchResponse.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFetchResponse.h; sourceTree = "<group>"; };
    … …  
    1883018833                                00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */,
    1883118834                                00146289103CD1DE000B20DB /* OriginAccessEntry.h */,
     18835                                0F5B408920212F730080F913 /* OriginThreadLocalCache.cpp */,
     18836                                0F5B408820212F730080F913 /* OriginThreadLocalCache.h */,
    1883218837                                65FEA86809833ADE00BED4AB /* Page.cpp */,
    1883318838                                65A21467097A329100B9050A /* Page.h */,
    … …  
    2826728272                                5E2C436C1BCF071E0001E2BC /* JSRTCTrackEvent.h in Headers */,
    2826828273                                BCEC01C30C274DDD009F4EC9 /* JSScreen.h in Headers */,
     28274                                0F5B408A20212F770080F913 /* OriginThreadLocalCache.h in Headers */,
    2826928275                                FDA15ECE12B03F61003A583A /* JSScriptProcessorNode.h in Headers */,
    2827028276                                834476EF1DA5BC5E002B6ED2 /* JSScrollToOptions.h in Headers */,

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp

    r225599 r228632  
    11/*
    2  * Copyright (C) 2008-2017 Apple Inc. All Rights Reserved.
     2 * Copyright (C) 2008-2018 Apple Inc. All Rights Reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    5757const ClassInfo JSDOMGlobalObject::s_info = { "DOMGlobalObject", &JSGlobalObject::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSDOMGlobalObject) };
    5858
    59 JSDOMGlobalObject::JSDOMGlobalObject(VM& vm, Structure* structure, Ref<DOMWrapperWorld>&& world, const GlobalObjectMethodTable* globalObjectMethodTable)
    60     : JSGlobalObject(vm, structure, globalObjectMethodTable)
     59JSDOMGlobalObject::JSDOMGlobalObject(VM& vm, Structure* structure, Ref<DOMWrapperWorld>&& world, const GlobalObjectMethodTable* globalObjectMethodTable, RefPtr<JSC::ThreadLocalCache>&& threadLocalCache)
     60    : JSGlobalObject(vm, structure, globalObjectMethodTable, WTFMove(threadLocalCache))
    6161    , m_currentEvent(0)
    6262    , m_world(WTFMove(world))

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/bindings/js/JSDOMGlobalObject.h

    r225577 r228632  
    3131#include <heap/HeapInlines.h>
    3232#include <heap/LockDuringMarking.h>
     33#include <heap/ThreadLocalCache.h>
    3334#include <runtime/JSGlobalObject.h>
    3435#include <runtime/StructureInlines.h>
    … …  
    5152    struct JSDOMGlobalObjectData;
    5253
    53     JSDOMGlobalObject(JSC::VM&, JSC::Structure*, Ref<DOMWrapperWorld>&&, const JSC::GlobalObjectMethodTable* = 0);
     54    JSDOMGlobalObject(JSC::VM&, JSC::Structure*, Ref<DOMWrapperWorld>&&, const JSC::GlobalObjectMethodTable* = nullptr, RefPtr<JSC::ThreadLocalCache>&& = nullptr);
    5455    static void destroy(JSC::JSCell*);
    5556    void finishCreation(JSC::VM&);

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/bindings/js/JSDOMWindowBase.cpp

    r225577 r228632  
    8080
    8181JSDOMWindowBase::JSDOMWindowBase(VM& vm, Structure* structure, RefPtr<DOMWindow>&& window, JSDOMWindowProxy* proxy)
    82     : JSDOMGlobalObject(vm, structure, proxy->world(), &s_globalObjectMethodTable)
     82    : JSDOMGlobalObject(vm, structure, proxy->world(), &s_globalObjectMethodTable, window ? &window->document()->threadLocalCache() : nullptr)
    8383    , m_windowCloseWatchpoints((window && window->frame()) ? IsWatched : IsInvalidated)
    8484    , m_wrapped(WTFMove(window))

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/dom/Document.cpp

    r227858 r228632  
    44 *           (C) 2001 Dirk Mueller (mueller@kde.org)
    55 *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
    6  * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
     6 * Copyright (C) 2004-2018 Apple Inc. All rights reserved.
    77 * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
    88 * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
    … …  
    127127#include "NavigationScheduler.h"
    128128#include "NestingLevelIncrementer.h"
    129 
    130129#include "NodeIterator.h"
    131130#include "NodeRareData.h"
    132131#include "NodeWithIndex.h"
    133132#include "OriginAccessEntry.h"
     133#include "OriginThreadLocalCache.h"
    134134#include "OverflowEvent.h"
    135135#include "PageConsoleClient.h"
    … …  
    219219#include <inspector/ConsoleMessage.h>
    220220#include <inspector/ScriptCallStack.h>
     221#include <runtime/VM.h>
    221222#include <wtf/CurrentTime.h>
    222223#include <wtf/Language.h>
    … …  
    55495550            // FIXME 81578: The naming of this is confusing. Files with restricted access to other local files
    55505551            // still can have other privileges that can be remembered, thereby not making them unique origins.
    5551             securityOrigin().enforceFilePathSeparation();
     5552            securityOrigin().setEnforcesFilePathSeparation();
    55525553        }
    55535554    }
    … …  
    77417742#endif
    77427743
     7744JSC::ThreadLocalCache& Document::threadLocalCache()
     7745{
     7746    if (!m_threadLocalCache) {
     7747        SecurityOrigin& origin = securityOrigin();
     7748        if (origin.isUnique() || (origin.isLocal() && origin.enforcesFilePathSeparation()))
     7749            m_threadLocalCache = JSC::ThreadLocalCache::create(commonVM().heap);
     7750        else
     7751            m_threadLocalCache = OriginThreadLocalCache::create(origin);
     7752    }
     7753    return *m_threadLocalCache;
     7754}
     7755
    77437756} // namespace WebCore

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/dom/Document.h

    r227759 r228632  
    5252#include "ViewportArguments.h"
    5353#include "VisibilityState.h"
     54#include <heap/ThreadLocalCache.h>
    5455#include <pal/SessionID.h>
    5556#include <wtf/Deque.h>
    … …  
    14121413#endif
    14131414
     1415    JSC::ThreadLocalCache& threadLocalCache();
     1416
    14141417protected:
    14151418    enum ConstructionFlags { Synthesized = 1, NonRenderedPlaceholder = 1 << 1 };
    … …  
    18961899
    18971900    HashSet<ApplicationStateChangeListener*> m_applicationStateChangeListeners;
     1901   
     1902    RefPtr<JSC::ThreadLocalCache> m_threadLocalCache;
    18981903};
    18991904

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/page/OriginThreadLocalCache.cpp

    r228631 r228632  
    11/*
    2  * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2424 */
    2525
    26 #pragma once
     26#include "config.h"
     27#include "OriginThreadLocalCache.h"
    2728
    28 #include <functional>
    29 #include <wtf/Vector.h>
     29#include "CommonVM.h"
     30#include "SecurityOriginHash.h"
     31#include <wtf/HashMap.h>
     32#include <wtf/NeverDestroyed.h>
    3033
    31 namespace JSC {
     34namespace WebCore {
    3235
    33 class JSGlobalObject;
    34 class VM;
     36typedef HashMap<RefPtr<SecurityOrigin>, OriginThreadLocalCache*> ThreadLocalCacheMap;
    3537
    36 class VMEntryScope {
    37 public:
    38     JS_EXPORT_PRIVATE VMEntryScope(VM&, JSGlobalObject*);
    39     JS_EXPORT_PRIVATE ~VMEntryScope();
     38static ThreadLocalCacheMap& threadLocalCacheMap()
     39{
     40    static NeverDestroyed<ThreadLocalCacheMap> map;
     41    return map;
     42}
    4043
    41     VM& vm() const { return m_vm; }
    42     JSGlobalObject* globalObject() const { return m_globalObject; }
     44Ref<OriginThreadLocalCache> OriginThreadLocalCache::create(SecurityOrigin& key)
     45{
     46    auto iter = threadLocalCacheMap().find(&key);
     47    if (iter != threadLocalCacheMap().end())
     48        return *iter->value;
     49   
     50    return adoptRef(*new OriginThreadLocalCache(key));
     51}
    4352
    44     void addDidPopListener(std::function<void ()>);
     53OriginThreadLocalCache::~OriginThreadLocalCache()
     54{
     55    bool result = threadLocalCacheMap().remove(m_key);
     56    RELEASE_ASSERT(result);
     57}
    4558
    46 private:
    47     VM& m_vm;
    48     JSGlobalObject* m_globalObject;
    49     Vector<std::function<void ()>> m_didPopListeners;
    50 };
     59OriginThreadLocalCache::OriginThreadLocalCache(SecurityOrigin& key)
     60    : ThreadLocalCache(commonVM().heap, JSC::uniqueSecurityOriginToken())
     61    , m_key(&key)
     62{
     63    auto result = threadLocalCacheMap().add(&key, this);
     64    RELEASE_ASSERT(result);
     65}
    5166
    52 } // namespace JSC
     67} // namespace WebCore
     68

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/page/OriginThreadLocalCache.h

    r228631 r228632  
    11/*
    2  * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2626#pragma once
    2727
    28 #include <functional>
    29 #include <wtf/Vector.h>
     28#include "SecurityOrigin.h"
     29#include <heap/ThreadLocalCache.h>
    3030
    31 namespace JSC {
     31namespace WebCore {
    3232
    33 class JSGlobalObject;
    34 class VM;
    35 
    36 class VMEntryScope {
     33class OriginThreadLocalCache final : public JSC::ThreadLocalCache {
    3734public:
    38     JS_EXPORT_PRIVATE VMEntryScope(VM&, JSGlobalObject*);
    39     JS_EXPORT_PRIVATE ~VMEntryScope();
    40 
    41     VM& vm() const { return m_vm; }
    42     JSGlobalObject* globalObject() const { return m_globalObject; }
    43 
    44     void addDidPopListener(std::function<void ()>);
     35    static Ref<OriginThreadLocalCache> create(SecurityOrigin&);
     36   
     37    ~OriginThreadLocalCache() override;
    4538
    4639private:
    47     VM& m_vm;
    48     JSGlobalObject* m_globalObject;
    49     Vector<std::function<void ()>> m_didPopListeners;
     40    explicit OriginThreadLocalCache(SecurityOrigin&);
     41   
     42    RefPtr<SecurityOrigin> m_key;
    5043};
    5144
    52 } // namespace JSC
     45} // namespace WebCore
     46

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/page/SecurityOrigin.cpp

    r225117 r228632  
    181181    , m_canLoadLocalResources { other->m_canLoadLocalResources }
    182182    , m_storageBlockingPolicy { other->m_storageBlockingPolicy }
    183     , m_enforceFilePathSeparation { other->m_enforceFilePathSeparation }
     183    , m_enforcesFilePathSeparation { other->m_enforcesFilePathSeparation }
    184184    , m_needsStorageAccessFromFileURLsQuirk { other->m_needsStorageAccessFromFileURLsQuirk }
    185185    , m_isPotentiallyTrustworthy { other->m_isPotentiallyTrustworthy }
    … …  
    284284    ASSERT(isLocal() && other.isLocal());
    285285
    286     return !m_enforceFilePathSeparation && !other.m_enforceFilePathSeparation;
     286    return !m_enforcesFilePathSeparation && !other.m_enforcesFilePathSeparation;
    287287}
    288288
    … …  
    454454}
    455455
    456 void SecurityOrigin::enforceFilePathSeparation()
     456void SecurityOrigin::setEnforcesFilePathSeparation()
    457457{
    458458    ASSERT(isLocal());
    459     m_enforceFilePathSeparation = true;
     459    m_enforcesFilePathSeparation = true;
    460460}
    461461
    … …  
    469469    if (isUnique())
    470470        return ASCIILiteral("null");
    471     if (m_protocol == "file" && m_enforceFilePathSeparation)
     471    if (m_protocol == "file" && m_enforcesFilePathSeparation)
    472472        return ASCIILiteral("null");
    473473    return toRawString();

  • releases/WebKitGTK/webkit-2.20/Source/WebCore/page/SecurityOrigin.h

    r224025 r228632  
    11/*
    2  * Copyright (C) 2007-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    166166    // FIXME 81578: The naming of this is confusing. Files with restricted access to other local files
    167167    // still can have other privileges that can be remembered, thereby not making them unique.
    168     void enforceFilePathSeparation();
     168    void setEnforcesFilePathSeparation();
     169    bool enforcesFilePathSeparation() const { return m_enforcesFilePathSeparation; }
    169170
    170171    // Convert this SecurityOrigin into a string. The string
    … …  
    230231    bool m_canLoadLocalResources { false };
    231232    StorageBlockingPolicy m_storageBlockingPolicy { AllowAllStorage };
    232     bool m_enforceFilePathSeparation { false };
     233    bool m_enforcesFilePathSeparation { false };
    233234    bool m_needsStorageAccessFromFileURLsQuirk { false };
    234235    bool m_isPotentiallyTrustworthy { false };
Note: See TracChangeset for help on using the changeset viewer.