Changeset 246021 in webkit

Timestamp:

Jun 2, 2019, 5:25:15 AM (7 years ago)

Author:

Tadeu Zagallo

Message:

CachedMetadataTable::decode leaks empty tables
​https://bugs.webkit.org/show_bug.cgi?id=198465
<rdar://problem/51307673>

Reviewed by Yusuke Suzuki.

CachedMetadataTable::decode creates the metadata and never calls finalize on it.
This leaks the underlying UnlinkedMetadataTable buffer when m_hasMetadata is false,
since the buffer would be freed in finalize instead of in the destructor.

• bytecode/UnlinkedMetadataTable.h:

(JSC::UnlinkedMetadataTable::empty):

• bytecode/UnlinkedMetadataTableInlines.h:

(JSC::UnlinkedMetadataTable::UnlinkedMetadataTable):

• runtime/CachedTypes.cpp:

(JSC::CachedMetadataTable::decode const):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/UnlinkedMetadataTable.h (modified) (1 diff)
• bytecode/UnlinkedMetadataTableInlines.h (modified) (1 diff)
• runtime/CachedTypes.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-06-02  Tadeu Zagallo  <tzagallo@apple.com>
+
+        CachedMetadataTable::decode leaks empty tables
+        https://bugs.webkit.org/show_bug.cgi?id=198465
+        <rdar://problem/51307673>
+
+        Reviewed by Yusuke Suzuki.
+
+        CachedMetadataTable::decode creates the metadata and never calls finalize on it.
+        This leaks the underlying UnlinkedMetadataTable buffer when m_hasMetadata is false,
+        since the buffer would be freed in finalize instead of in the destructor.
+
+        * bytecode/UnlinkedMetadataTable.h:
+        (JSC::UnlinkedMetadataTable::empty):
+        * bytecode/UnlinkedMetadataTableInlines.h:
+        (JSC::UnlinkedMetadataTable::UnlinkedMetadataTable):
+        * runtime/CachedTypes.cpp:
+        (JSC::CachedMetadataTable::decode const):
+
 2019-05-31  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.h

@@ -62 +62 @@
 
 private:
+    enum EmptyTag { Empty };
+
     UnlinkedMetadataTable();
     UnlinkedMetadataTable(bool is32Bit);
+    UnlinkedMetadataTable(EmptyTag);
 
     static Ref<UnlinkedMetadataTable> create(bool is32Bit)
     {
         return adoptRef(*new UnlinkedMetadataTable(is32Bit));
+    }
+
+    static Ref<UnlinkedMetadataTable> empty()
+    {
+        return adoptRef(*new UnlinkedMetadataTable(Empty));
     }
 

trunk/Source/JavaScriptCore/bytecode/UnlinkedMetadataTableInlines.h

@@ -47 +47 @@
     , m_is32Bit(is32Bit)
     , m_rawBuffer(static_cast<uint8_t*>(fastZeroedMalloc(sizeof(LinkingData) + (is32Bit ? s_offset16TableSize + s_offset32TableSize : s_offset16TableSize))))
+{
+}
+
+ALWAYS_INLINE UnlinkedMetadataTable::UnlinkedMetadataTable(EmptyTag)
+    : m_hasMetadata(false)
+    , m_isFinalized(true)
+    , m_isLinked(false)
+    , m_is32Bit(false)
+    , m_rawBuffer(nullptr)
 {
 }

trunk/Source/JavaScriptCore/runtime/CachedTypes.cpp

@@ -1361 +1361 @@
     Ref<UnlinkedMetadataTable> decode(Decoder&) const
     {
+        if (!m_hasMetadata)
+            return UnlinkedMetadataTable::empty();
+
         Ref<UnlinkedMetadataTable> metadataTable = UnlinkedMetadataTable::create(m_is32Bit);
         metadataTable->m_isFinalized = true;