Changeset 286969 in webkit

Timestamp:

Dec 13, 2021, 12:25:56 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

ExecutableAllocator: Do not store things in g_config when USE(SYSTEM_MALLOC).
​https://bugs.webkit.org/show_bug.cgi?id=232165

Patch by waddlesplash <​waddlesplash@gmail.com> on 2021-12-13
Reviewed by Yusuke Suzuki.

Following r281910 two additional slots were added
to g_config in order to store these pointers for use in bmalloc and Gigacage. However, when
USE(SYSTEM_MALLOC) is enabled, there are no slots reserved for Gigacage, and so this collided
with g_wtfConfig and overwrote data there instead.

This should fix crashes seen on Haiku, which enables USE(SYSTEM_MALLOC).

• jit/ExecutableAllocator.cpp:

(JSC::initializeJITPageReservation):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• jit/ExecutableAllocator.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-12-13  waddlesplash  <waddlesplash@gmail.com>
+
+        ExecutableAllocator: Do not store things in g_config when USE(SYSTEM_MALLOC).
+        https://bugs.webkit.org/show_bug.cgi?id=232165
+
+        Reviewed by Yusuke Suzuki.
+
+        Following r281910 two additional slots were added
+        to g_config in order to store these pointers for use in bmalloc and Gigacage. However, when
+        USE(SYSTEM_MALLOC) is enabled, there are no slots reserved for Gigacage, and so this collided
+        with g_wtfConfig and overwrote data there instead.
+
+        This should fix crashes seen on Haiku, which enables USE(SYSTEM_MALLOC).
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::initializeJITPageReservation):
+
 2021-12-13  Elliott Williams  <emw@apple.com>
 

trunk/Source/JavaScriptCore/jit/ExecutableAllocator.cpp

@@ -404 +404 @@
         g_jscConfig.endExecutableMemory = tagCodePtr<ExecutableMemoryPtrTag>(reservationEnd);
 
-#if ENABLE(UNIFIED_AND_FREEZABLE_CONFIG_RECORD)
+#if !USE(SYSTEM_MALLOC) && ENABLE(UNIFIED_AND_FREEZABLE_CONFIG_RECORD)
         WebConfig::g_config[0] = bitwise_cast<uintptr_t>(reservation.base);
         WebConfig::g_config[1] = bitwise_cast<uintptr_t>(reservationEnd);