⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 271279 in webkit


Ignore:
Timestamp:
Jan 7, 2021, 5:36:47 PM (6 years ago)
Author:
mark.lam@apple.com
Message:

Work around Clang bug in builtin_return_address().
​https://bugs.webkit.org/show_bug.cgi?id=220432
rdar://71648468

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

Clang's builtin_return_address() currently sometimes returns a PAC signed pointer
and sometimes not. This patch works around that by always ensuring that the pointer
is not signed.

Also changed the ReturnAddressPtr to store a signed pointer.

  • assembler/MacroAssemblerCodeRef.h:

(JSC::ReturnAddressPtr::ReturnAddressPtr):
(JSC::ReturnAddressPtr::untaggedValue const):
(JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):

  • interpreter/AbstractPC.h:

(JSC::AbstractPC::AbstractPC):

  • interpreter/CallFrame.h:
  • jit/JIT.cpp:

(JSC::ctiPatchCallByReturnAddress):

  • jit/JITOpcodes.cpp:

(JSC::JIT::privateCompileHasIndexedProperty):

  • jit/JITOpcodes32_64.cpp:

(JSC::JIT::privateCompileHasIndexedProperty):

  • jit/JITOperations.cpp:

(JSC::JSC_DEFINE_JIT_OPERATION):
(JSC::unprofiledMul): Deleted.
(JSC::profiledMul): Deleted.
(JSC::unprofiledSub): Deleted.
(JSC::profiledSub): Deleted.

  • jit/JITPropertyAccess.cpp:

(JSC::JIT::privateCompilePutByVal):
(JSC::JIT::privateCompilePutPrivateNameWithCachedId):
(JSC::JIT::privateCompilePutByValWithCachedId):

  • runtime/JSCPtrTag.h:

Source/WebKit:

  • PluginProcess/mac/PluginProcessShim.mm:

(WebKit::shimCFStringCompare):

  • We go direct to ptrauth.h instead of using the WTF PtrTag abstraction because this file appears to be going out of its way to avoid importing config.h. Because of this, importing PtrTag.h results in a lot of build error complications. Rather than jump thru many hoops to make importing PtrTag.h work and because all we really want is only to use ptrauth_strip(), importing ptrauth.h is simpler.
Location:
trunk/Source
Files:
12 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r271269 r271279  
     12021-01-07  Mark Lam  <mark.lam@apple.com>
     2
     3        Work around Clang bug in __builtin_return_address().
     4        https://bugs.webkit.org/show_bug.cgi?id=220432
     5        rdar://71648468
     6
     7        Reviewed by Yusuke Suzuki.
     8
     9        Clang's __builtin_return_address() currently sometimes returns a PAC signed pointer
     10        and sometimes not.  This patch works around that by always ensuring that the pointer
     11        is not signed.
     12
     13        Also changed the ReturnAddressPtr to store a signed pointer.
     14
     15        * assembler/MacroAssemblerCodeRef.h:
     16        (JSC::ReturnAddressPtr::ReturnAddressPtr):
     17        (JSC::ReturnAddressPtr::untaggedValue const):
     18        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
     19        * interpreter/AbstractPC.h:
     20        (JSC::AbstractPC::AbstractPC):
     21        * interpreter/CallFrame.h:
     22        * jit/JIT.cpp:
     23        (JSC::ctiPatchCallByReturnAddress):
     24        * jit/JITOpcodes.cpp:
     25        (JSC::JIT::privateCompileHasIndexedProperty):
     26        * jit/JITOpcodes32_64.cpp:
     27        (JSC::JIT::privateCompileHasIndexedProperty):
     28        * jit/JITOperations.cpp:
     29        (JSC::JSC_DEFINE_JIT_OPERATION):
     30        (JSC::unprofiledMul): Deleted.
     31        (JSC::profiledMul): Deleted.
     32        (JSC::unprofiledSub): Deleted.
     33        (JSC::profiledSub): Deleted.
     34        * jit/JITPropertyAccess.cpp:
     35        (JSC::JIT::privateCompilePutByVal):
     36        (JSC::JIT::privateCompilePutPrivateNameWithCachedId):
     37        (JSC::JIT::privateCompilePutByValWithCachedId):
     38        * runtime/JSCPtrTag.h:
     39
    1402021-01-07  Alexey Shvayka  <shvaikalesh@gmail.com>
    241

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h

    r268247 r271279  
    11/*
    2  * Copyright (C) 2009-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2009-2021 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    235235    ReturnAddressPtr() { }
    236236
    237     explicit ReturnAddressPtr(const void* value)
    238         : m_value(value)
    239     {
     237    explicit ReturnAddressPtr(const void* returnAddress)
     238    {
     239#if CPU(ARM64E)
     240        assertIsNotTagged(returnAddress);
     241        returnAddress = retagCodePtr<NoPtrTag, ReturnAddressPtrTag>(returnAddress);
     242#endif
     243        m_value = returnAddress;
    240244        ASSERT_VALID_CODE_POINTER(m_value);
    241245    }
    … …  
    246250    }
    247251   
     252    const void* untaggedValue() const
     253    {
     254        return untagCodePtr<ReturnAddressPtrTag>(m_value);
     255    }
     256
    248257    void dump(PrintStream& out) const
    249258    {
    … …  
    298307
    299308    explicit MacroAssemblerCodePtr(ReturnAddressPtr ra)
    300         : m_value(tagCodePtr<tag>(ra.value()))
    301     {
    302         assertIsNotTagged(ra.value());
    303         ASSERT(ra.value());
     309        : m_value(retagCodePtr<ReturnAddressPtrTag, tag>(ra.value()))
     310    {
     311        ASSERT(ra.untaggedValue());
    304312        ASSERT_VALID_CODE_POINTER(m_value);
    305313    }

  • trunk/Source/JavaScriptCore/interpreter/AbstractPC.h

    r251425 r271279  
    11/*
    2  * Copyright (C) 2012 Apple Inc. All rights reserved.
     2 * Copyright (C) 2012-2021 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4848        , m_mode(JIT)
    4949    {
     50        assertIsTaggedWith<ReturnAddressPtrTag>(m_pointer);
    5051    }
    5152   

  • trunk/Source/JavaScriptCore/interpreter/CallFrame.h

    r269252 r271279  
    22 *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
    33 *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
    4  *  Copyright (C) 2003-2019 Apple Inc. All rights reserved.
     4 *  Copyright (C) 2003-2021 Apple Inc. All rights reserved.
    55 *
    66 *  This library is free software; you can redistribute it and/or
    … …  
    319319
    320320#if USE(BUILTIN_FRAME_ADDRESS)
     321// FIXME (see rdar://72897291): Work around a Clang bug where __builtin_return_address()
     322// sometimes gives us a signed pointer, and sometimes does not.
    321323#define DECLARE_CALL_FRAME(vm) \
    322324    ({ \

  • trunk/Source/JavaScriptCore/jit/JIT.cpp

    r270874 r271279  
    11/*
    2  * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008-2021 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    6464{
    6565    MacroAssembler::repatchCall(
    66         CodeLocationCall<NoPtrTag>(MacroAssemblerCodePtr<NoPtrTag>(returnAddress)),
     66        CodeLocationCall<ReturnAddressPtrTag>(MacroAssemblerCodePtr<ReturnAddressPtrTag>(returnAddress)),
    6767        newCalleeFunction.retagged<OperationPtrTag>());
    6868}

  • trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

    r270874 r271279  
    11/*
    2  * Copyright (C) 2009-2020 Apple Inc. All rights reserved.
     2 * Copyright (C) 2009-2021 Apple Inc. All rights reserved.
    33 * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
    44 *
    … …  
    14291429    byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
    14301430        m_codeBlock, patchBuffer, JITStubRoutinePtrTag,
    1431         "Baseline has_indexed_property stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.value());
     1431        "Baseline has_indexed_property stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.untaggedValue());
    14321432   
    14331433    MacroAssembler::repatchJump(byValInfo->badTypeJump, CodeLocationLabel<JITStubRoutinePtrTag>(byValInfo->stubRoutine->code().code()));
    1434     MacroAssembler::repatchCall(CodeLocationCall<NoPtrTag>(MacroAssemblerCodePtr<NoPtrTag>(returnAddress)), FunctionPtr<OperationPtrTag>(operationHasIndexedPropertyGeneric));
     1434    MacroAssembler::repatchCall(CodeLocationCall<ReturnAddressPtrTag>(MacroAssemblerCodePtr<ReturnAddressPtrTag>(returnAddress)), FunctionPtr<OperationPtrTag>(operationHasIndexedPropertyGeneric));
    14351435}
    14361436

  • trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

    r270874 r271279  
    11/*
    2  * Copyright (C) 2009-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2009-2021 Apple Inc. All rights reserved.
    33 * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
    44 *
    … …  
    11881188    byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
    11891189        m_codeBlock, patchBuffer, JITStubRoutinePtrTag,
    1190         "Baseline has_indexed_property stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.value());
     1190        "Baseline has_indexed_property stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.untaggedValue());
    11911191   
    11921192    MacroAssembler::repatchJump(byValInfo->badTypeJump, CodeLocationLabel<JITStubRoutinePtrTag>(byValInfo->stubRoutine->code().code()));
    1193     MacroAssembler::repatchCall(CodeLocationCall<NoPtrTag>(MacroAssemblerCodePtr<NoPtrTag>(returnAddress)), FunctionPtr<OperationPtrTag>(operationHasIndexedPropertyGeneric));
     1193    MacroAssembler::repatchCall(CodeLocationCall<ReturnAddressPtrTag>(MacroAssemblerCodePtr<ReturnAddressPtrTag>(returnAddress)), FunctionPtr<OperationPtrTag>(operationHasIndexedPropertyGeneric));
    11941194}
    11951195

  • trunk/Source/JavaScriptCore/jit/JITOperations.cpp

    r271186 r271279  
    11/*
    2  * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    8787#define OUR_RETURN_ADDRESS _ReturnAddress()
    8888#else
    89 #define OUR_RETURN_ADDRESS __builtin_return_address(0)
     89// FIXME (see rdar://72897291): Work around a Clang bug where __builtin_return_address()
     90// sometimes gives us a signed pointer, and sometimes does not.
     91#define OUR_RETURN_ADDRESS removeCodePtrTag(__builtin_return_address(0))
    9092#endif
    9193
    … …  
    29482950#if COMPILER(GCC_COMPATIBLE)
    29492951    void* returnPC = __builtin_return_address(0);
     2952    // FIXME (see rdar://72897291): Work around a Clang bug where __builtin_return_address()
     2953    // sometimes gives us a signed pointer, and sometimes does not.
     2954    returnPC = removeCodePtrTag(returnPC);
    29502955    doExceptionFuzzing(globalObject, scope, "JITOperations", returnPC);
    29512956#endif // COMPILER(GCC_COMPATIBLE)
    … …  
    29612966#if COMPILER(GCC_COMPATIBLE)
    29622967    void* returnPC = __builtin_return_address(0);
     2968    // FIXME (see rdar://72897291): Work around a Clang bug where __builtin_return_address()
     2969    // sometimes gives us a signed pointer, and sometimes does not.
     2970    returnPC = removeCodePtrTag(returnPC);
    29632971    doExceptionFuzzing(callFrame->lexicalGlobalObject(vm), scope, "JITOperations", returnPC);
    29642972#endif // COMPILER(GCC_COMPATIBLE)

  • trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

    r270711 r271279  
    11/*
    2  * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008-2021 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    15141514        byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
    15151515            m_codeBlock, patchBuffer, JITStubRoutinePtrTag,
    1516             "Baseline put_by_val stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.value());
     1516            "Baseline put_by_val stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.untaggedValue());
    15171517       
    15181518    } else {
    15191519        byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
    15201520            m_codeBlock, patchBuffer, JITStubRoutinePtrTag,
    1521             "Baseline put_by_val_direct stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.value());
     1521            "Baseline put_by_val_direct stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.untaggedValue());
    15221522    }
    15231523    MacroAssembler::repatchJump(byValInfo->badTypeJump, CodeLocationLabel<JITStubRoutinePtrTag>(byValInfo->stubRoutine->code().code()));
    1524     MacroAssembler::repatchCall(CodeLocationCall<NoPtrTag>(MacroAssemblerCodePtr<NoPtrTag>(returnAddress)), FunctionPtr<OperationPtrTag>(isDirect ? operationDirectPutByValGeneric : operationPutByValGeneric));
     1524    MacroAssembler::repatchCall(CodeLocationCall<ReturnAddressPtrTag>(MacroAssemblerCodePtr<ReturnAddressPtrTag>(returnAddress)), FunctionPtr<OperationPtrTag>(isDirect ? operationDirectPutByValGeneric : operationPutByValGeneric));
    15251525}
    15261526// This function is only consumed from another translation unit (JITOperations.cpp),
    … …  
    15581558    byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
    15591559        m_codeBlock, patchBuffer, JITStubRoutinePtrTag,
    1560         "Baseline put_private_name with cached property name '%s' stub for %s, return point %p", propertyName.uid()->utf8().data(), toCString(*m_codeBlock).data(), returnAddress.value());
     1560        "Baseline put_private_name with cached property name '%s' stub for %s, return point %p", propertyName.uid()->utf8().data(), toCString(*m_codeBlock).data(), returnAddress.untaggedValue());
    15611561    byValInfo->stubInfo = gen.stubInfo();
    15621562
    15631563    MacroAssembler::repatchJump(byValInfo->notIndexJump, CodeLocationLabel<JITStubRoutinePtrTag>(byValInfo->stubRoutine->code().code()));
    1564     MacroAssembler::repatchCall(CodeLocationCall<NoPtrTag>(MacroAssemblerCodePtr<NoPtrTag>(returnAddress)), FunctionPtr<OperationPtrTag>(operationPutPrivateNameGeneric));
     1564    MacroAssembler::repatchCall(CodeLocationCall<ReturnAddressPtrTag>(MacroAssemblerCodePtr<ReturnAddressPtrTag>(returnAddress)), FunctionPtr<OperationPtrTag>(operationPutPrivateNameGeneric));
    15651565}
    15661566
    … …  
    15961596    byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
    15971597        m_codeBlock, patchBuffer, JITStubRoutinePtrTag,
    1598         "Baseline put_by_val%s with cached property name '%s' stub for %s, return point %p", (putKind == PutKind::Direct) ? "_direct" : "", propertyName.uid()->utf8().data(), toCString(*m_codeBlock).data(), returnAddress.value());
     1598        "Baseline put_by_val%s with cached property name '%s' stub for %s, return point %p", (putKind == PutKind::Direct) ? "_direct" : "", propertyName.uid()->utf8().data(), toCString(*m_codeBlock).data(), returnAddress.untaggedValue());
    15991599    byValInfo->stubInfo = gen.stubInfo();
    16001600
    16011601    MacroAssembler::repatchJump(byValInfo->notIndexJump, CodeLocationLabel<JITStubRoutinePtrTag>(byValInfo->stubRoutine->code().code()));
    1602     MacroAssembler::repatchCall(CodeLocationCall<NoPtrTag>(MacroAssemblerCodePtr<NoPtrTag>(returnAddress)), FunctionPtr<OperationPtrTag>(putKind == PutKind::Direct ? operationDirectPutByValGeneric : operationPutByValGeneric));
     1602    MacroAssembler::repatchCall(CodeLocationCall<ReturnAddressPtrTag>(MacroAssemblerCodePtr<ReturnAddressPtrTag>(returnAddress)), FunctionPtr<OperationPtrTag>(putKind == PutKind::Direct ? operationDirectPutByValGeneric : operationPutByValGeneric));
    16031603}
    16041604// This function is only consumed from another translation unit (JITOperations.cpp),

  • trunk/Source/JavaScriptCore/runtime/JSCPtrTag.h

    r270981 r271279  
    11/*
    2  * Copyright (C) 2018-2020 Apple Inc. All rights reserved.
     2 * Copyright (C) 2018-2021 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    6060    v(JITProbePCPtrTag, PtrTagCalleeType::Native, PtrTagCallerType::Native) \
    6161    v(JITProbeStackInitializationFunctionPtrTag, PtrTagCalleeType::Native, PtrTagCallerType::Native) \
     62    v(ReturnAddressPtrTag, PtrTagCalleeType::Native, PtrTagCallerType::Native) \
    6263    /* Callee:JIT Caller:Native */ \
    6364    v(NativeToJITGatePtrTag, PtrTagCalleeType::JIT, PtrTagCallerType::Native) \

  • trunk/Source/WebKit/ChangeLog

    r271273 r271279  
     12021-01-07  Mark Lam  <mark.lam@apple.com>
     2
     3        Work around Clang bug in __builtin_return_address().
     4        https://bugs.webkit.org/show_bug.cgi?id=220432
     5        rdar://71648468
     6
     7        Reviewed by Yusuke Suzuki.
     8
     9        * PluginProcess/mac/PluginProcessShim.mm:
     10        (WebKit::shimCFStringCompare):
     11        - We go direct to ptrauth.h instead of using the WTF PtrTag abstraction because
     12          this file appears to be going out of its way to avoid importing config.h.
     13          Because of this, importing PtrTag.h results in a lot of build error complications.
     14          Rather than jump thru many hoops to make importing PtrTag.h work and because all
     15          we really want is only to use ptrauth_strip(), importing ptrauth.h is simpler.
     16
    1172021-01-07  Peng Liu  <peng.liu6@apple.com>
    218

  • trunk/Source/WebKit/PluginProcess/mac/PluginProcessShim.mm

    r242325 r271279  
    11/*
    2  * Copyright (C) 2010 Apple Inc. All rights reserved.
     2 * Copyright (C) 2010-2021 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4141#import <wtf/spi/darwin/SandboxSPI.h>
    4242
     43#if CPU(ARM64E)
     44#import <ptrauth.h>
     45#endif
     46
    4347namespace WebKit {
    4448
    … …  
    240244    if (pluginProcessShimCallbacks.stringCompare) {
    241245        CFComparisonResult result;
    242         if (pluginProcessShimCallbacks.stringCompare(a, b, options, __builtin_return_address(0), result))
     246        // FIXME (see rdar://72897291): Work around a Clang bug where __builtin_return_address()
     247        // sometimes gives us a signed pointer, and sometimes does not.
     248        void* returnAddress = __builtin_return_address(0);
     249#if CPU(ARM64E)
     250        returnAddress = ptrauth_strip(returnAddress, ptrauth_key_process_dependent_code);
     251#endif
     252        if (pluginProcessShimCallbacks.stringCompare(a, b, options, returnAddress, result))
    243253            return result;
    244254    }
Note: See TracChangeset for help on using the changeset viewer.