Changeset 225659 in webkit


Ignore:
Timestamp:
Dec 7, 2017 5:22:06 PM (6 years ago)
Author:
mark.lam@apple.com
Message:

Apply poisoning to some native code pointers.
​https://bugs.webkit.org/show_bug.cgi?id=180541
<rdar://problem/35916875>

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Renamed g_classInfoPoison to g_globalDataPoison.
Renamed g_masmPoison to g_jitCodePoison.
Introduced g_nativeCodePoison.
Applied g_nativeCodePoison to poisoning some native code pointers.

Introduced non-random Int32 poison values (in JSCPoison.h) for use with pointers
to malloc allocated data structures (where needed).

  • API/JSCallbackFunction.h:

(JSC::JSCallbackFunction::functionCallback):

(JSC::nativeForGenerator):

  • llint/LowLevelInterpreter64.asm:
  • runtime/CustomGetterSetter.h:

(JSC::CustomGetterSetter::getter const):
(JSC::CustomGetterSetter::setter const):

  • runtime/InternalFunction.cpp:

(JSC::InternalFunction::getCallData):
(JSC::InternalFunction::getConstructData):

  • runtime/InternalFunction.h:

(JSC::InternalFunction::nativeFunctionFor):

  • runtime/JSCPoison.h: Added.
  • runtime/JSCPoisonedPtr.cpp:

(JSC::initializePoison):

  • runtime/JSCPoisonedPtr.h:
  • runtime/Lookup.h:
  • runtime/NativeExecutable.cpp:

(JSC::NativeExecutable::hashFor const):

  • runtime/NativeExecutable.h:
  • runtime/Structure.cpp:

(JSC::StructureTransitionTable::setSingleTransition):

  • runtime/StructureTransitionTable.h:

(JSC::StructureTransitionTable::StructureTransitionTable):
(JSC::StructureTransitionTable::isUsingSingleSlot const):
(JSC::StructureTransitionTable::map const):
(JSC::StructureTransitionTable::weakImpl const):
(JSC::StructureTransitionTable::setMap):

Source/WTF:

Ensure that the resultant poisoned bits still looks like a pointer in that its
bottom bits are 0, just like the alignment bits of a pointer. This allows the
client to use the bottom bits of the poisoned bits as flag bits just like the
client was previously able to do with pointer values.

Note: we only ensure that the bottom alignment bits of the generated poison
value is 0. We're not masking out the poisoned bits. This means that the bottom
bits of the poisoned bits will only be null if the original pointer is aligned.
Hence, if the client applies the poison to an unaligned pointer, we do not lose
any information on the low bits.

Also removed 2 wrong assertions in PoisonedImpl's constructors. We were
asserting that Poisoned will never be used with a null value, but that's invalid.
We do want to allow a null value so that we don't have to constantly do null
checks in the clients. This was uncovered by some layout tests.

  • wtf/Poisoned.cpp:

(WTF::makePoison):

  • wtf/Poisoned.h:

(WTF::PoisonedImpl::PoisonedImpl):

Location:
trunk/Source
Files:
1 added
21 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/API/JSCallbackFunction.h

    r224487 r225659  
    11/*
    2  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    5252    void finishCreation(VM&, const String& name);
    5353
    54     JSObjectCallAsFunctionCallback functionCallback() { return m_callback; }
     54    JSObjectCallAsFunctionCallback functionCallback() { return m_callback.unpoisoned(); }
    5555
    56     JSObjectCallAsFunctionCallback m_callback;
     56    Poisoned<g_nativeCodePoison, JSObjectCallAsFunctionCallback> m_callback;
    5757};
    5858

  • trunk/Source/JavaScriptCore/ChangeLog

    r225654 r225659  
     12017-12-07  Mark Lam  <mark.lam@apple.com>
     2
     3        Apply poisoning to some native code pointers.
     4        https://bugs.webkit.org/show_bug.cgi?id=180541
     5        <rdar://problem/35916875>
     6
     7        Reviewed by Filip Pizlo.
     8
     9        Renamed g_classInfoPoison to g_globalDataPoison.
     10        Renamed g_masmPoison to g_jitCodePoison.
     11        Introduced g_nativeCodePoison.
     12        Applied g_nativeCodePoison to poisoning some native code pointers.
     13
     14        Introduced non-random Int32 poison values (in JSCPoison.h) for use with pointers
     15        to malloc allocated data structures (where needed).
     16
     17        * API/JSCallbackFunction.h:
     18        (JSC::JSCallbackFunction::functionCallback):
     19        * JavaScriptCore.xcodeproj/project.pbxproj:
     20        * jit/ThunkGenerators.cpp:
     21        (JSC::nativeForGenerator):
     22        * llint/LowLevelInterpreter64.asm:
     23        * runtime/CustomGetterSetter.h:
     24        (JSC::CustomGetterSetter::getter const):
     25        (JSC::CustomGetterSetter::setter const):
     26        * runtime/InternalFunction.cpp:
     27        (JSC::InternalFunction::getCallData):
     28        (JSC::InternalFunction::getConstructData):
     29        * runtime/InternalFunction.h:
     30        (JSC::InternalFunction::nativeFunctionFor):
     31        * runtime/JSCPoison.h: Added.
     32        * runtime/JSCPoisonedPtr.cpp:
     33        (JSC::initializePoison):
     34        * runtime/JSCPoisonedPtr.h:
     35        * runtime/Lookup.h:
     36        * runtime/NativeExecutable.cpp:
     37        (JSC::NativeExecutable::hashFor const):
     38        * runtime/NativeExecutable.h:
     39        * runtime/Structure.cpp:
     40        (JSC::StructureTransitionTable::setSingleTransition):
     41        * runtime/StructureTransitionTable.h:
     42        (JSC::StructureTransitionTable::StructureTransitionTable):
     43        (JSC::StructureTransitionTable::isUsingSingleSlot const):
     44        (JSC::StructureTransitionTable::map const):
     45        (JSC::StructureTransitionTable::weakImpl const):
     46        (JSC::StructureTransitionTable::setMap):
     47
    1482017-12-07  Joseph Pecoraro  <pecoraro@apple.com>
    249

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r225632 r225659  
    17221722                FE2A87601F02381600EB31B2 /* MinimumReservedZoneSize.h in Headers */ = {isa = PBXBuildFile; fileRef = FE2A875F1F02381600EB31B2 /* MinimumReservedZoneSize.h */; };
    17231723                FE2B0B691FD227E00075DA5F /* JSCPoisonedPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = FE2B0B671FD0D2960075DA5F /* JSCPoisonedPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
     1724                FE2B0B731FD9EF700075DA5F /* JSCPoison.h in Headers */ = {isa = PBXBuildFile; fileRef = FE2B0B701FD8C4630075DA5F /* JSCPoison.h */; settings = {ATTRIBUTES = (Private, ); }; };
    17241725                FE3022D31E3D73A500BAC493 /* SigillCrashAnalyzer.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3022D11E3D739600BAC493 /* SigillCrashAnalyzer.h */; settings = {ATTRIBUTES = (Private, ); }; };
    17251726                FE3022D71E42857300BAC493 /* VMInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3022D51E42856700BAC493 /* VMInspector.h */; };
    … …  
    46014602                FE2B0B671FD0D2960075DA5F /* JSCPoisonedPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCPoisonedPtr.h; sourceTree = "<group>"; };
    46024603                FE2B0B681FD0D2970075DA5F /* JSCPoisonedPtr.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCPoisonedPtr.cpp; sourceTree = "<group>"; };
     4604                FE2B0B701FD8C4630075DA5F /* JSCPoison.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCPoison.h; sourceTree = "<group>"; };
    46034605                FE2E6A7A1D6EA5FE0060F896 /* ThrowScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ThrowScope.cpp; sourceTree = "<group>"; };
    46044606                FE3022D01E3D739600BAC493 /* SigillCrashAnalyzer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SigillCrashAnalyzer.cpp; sourceTree = "<group>"; };
    … …  
    65446546                                14ABB36E099C076400E2A24F /* JSCJSValue.h */,
    65456547                                865A30F0135007E100CDB49E /* JSCJSValueInlines.h */,
     6548                                FE2B0B701FD8C4630075DA5F /* JSCPoison.h */,
    65466549                                FE2B0B681FD0D2970075DA5F /* JSCPoisonedPtr.cpp */,
    65476550                                FE2B0B671FD0D2960075DA5F /* JSCPoisonedPtr.h */,
    … …  
    81028105                                0F33FCFB1C1625BE00323F67 /* B3CFG.h in Headers */,
    81038106                                0FEC85061BDACDAC0080FF74 /* B3CheckSpecial.h in Headers */,
     8107                                FE2B0B731FD9EF700075DA5F /* JSCPoison.h in Headers */,
    81048108                                0FEC85081BDACDAC0080FF74 /* B3CheckValue.h in Headers */,
    81058109                                0FEC850A1BDACDAC0080FF74 /* B3Common.h in Headers */,

  • trunk/Source/JavaScriptCore/b3/B3LowerMacros.cpp

    r225632 r225659  
    508508                        GPRReg poisonScratch = params.gpScratch(1);
    509509
    510                         jit.move(CCallHelpers::TrustedImm64(g_masmPoison), poisonScratch);
     510                        jit.move(CCallHelpers::TrustedImm64(g_jitCodePoison), poisonScratch);
    511511                        jit.move(CCallHelpers::TrustedImmPtr(jumpTable), scratch);
    512512                        jit.load64(CCallHelpers::BaseIndex(scratch, index, CCallHelpers::timesPtr()), scratch);

  • trunk/Source/JavaScriptCore/b3/testb3.cpp

    r225632 r225659  
    1303413034
    1303513035            jit.move(CCallHelpers::TrustedImmPtr(jumpTable), scratch);
    13036             jit.move(CCallHelpers::TrustedImm64(g_masmPoison), poisonScratch);
     13036            jit.move(CCallHelpers::TrustedImm64(g_jitCodePoison), poisonScratch);
    1303713037            jit.load64(CCallHelpers::BaseIndex(scratch, params[0].gpr(), CCallHelpers::timesPtr()), scratch);
    1303813038            jit.xor64(poisonScratch, scratch);

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r225632 r225659  
    87078707        m_jit.loadPtr(CCallHelpers::Address(otherGPR, Structure::classInfoOffset()), otherGPR);
    87088708#if USE(JSVALUE64)
    8709         m_jit.move(CCallHelpers::TrustedImm64(g_classInfoPoison), specifiedGPR);
     8709        m_jit.move(CCallHelpers::TrustedImm64(g_globalDataPoison), specifiedGPR);
    87108710        m_jit.xor64(specifiedGPR, otherGPR);
    87118711#endif
    … …  
    97859785    UNUSED_PARAM(poisonScratch); // Placate the 32-bit build.
    97869786#if USE(JSVALUE64)
    9787     m_jit.move(TrustedImm64(g_masmPoison), poisonScratch);
     9787    m_jit.move(TrustedImm64(g_jitCodePoison), poisonScratch);
    97889788#endif
    97899789    m_jit.move(TrustedImmPtr(table.ctiOffsets.begin()), scratch);

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r225632 r225659  
    1117211172            LValue structure = loadStructure(cell);
    1117311173            LValue poisonedClassInfo = m_out.loadPtr(structure, m_heaps.Structure_classInfo);
    11174             LValue classInfo = m_out.bitXor(poisonedClassInfo, m_out.constInt64(g_classInfoPoison));
     11174            LValue classInfo = m_out.bitXor(poisonedClassInfo, m_out.constInt64(g_globalDataPoison));
    1117511175            ValueFromBlock otherAtStart = m_out.anchor(classInfo);
    1117611176            m_out.jump(loop);

  • trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp

    r225632 r225659  
    215215    // call.
    216216#if USE(JSVALUE64)
    217     jit.move(CCallHelpers::TrustedImm64(g_masmPoison), GPRInfo::regT1);
     217    jit.move(CCallHelpers::TrustedImm64(g_jitCodePoison), GPRInfo::regT1);
    218218    jit.xor64(GPRInfo::regT1, GPRInfo::regT4);
    219219#endif
    … …  
    308308    if (thunkFunctionType == ThunkFunctionType::JSFunction) {
    309309        jit.loadPtr(JSInterfaceJIT::Address(X86Registers::esi, JSFunction::offsetOfExecutable()), X86Registers::r9);
    310         jit.call(JSInterfaceJIT::Address(X86Registers::r9, executableOffsetToFunction));
     310        jit.loadPtr(JSInterfaceJIT::Address(X86Registers::r9, executableOffsetToFunction), X86Registers::r9);
    311311    } else
    312         jit.call(JSInterfaceJIT::Address(X86Registers::esi, InternalFunction::offsetOfNativeFunctionFor(kind)));
     312        jit.loadPtr(JSInterfaceJIT::Address(X86Registers::esi, InternalFunction::offsetOfNativeFunctionFor(kind)), X86Registers::r9);
     313    jit.move(JSInterfaceJIT::TrustedImm64(g_nativeCodePoison), X86Registers::esi);
     314    jit.xor64(X86Registers::esi, X86Registers::r9);
     315    jit.call(X86Registers::r9);
    313316
    314317#else
    … …  
    342345    if (thunkFunctionType == ThunkFunctionType::JSFunction) {
    343346        jit.loadPtr(JSInterfaceJIT::Address(ARM64Registers::x1, JSFunction::offsetOfExecutable()), ARM64Registers::x2);
    344         jit.call(JSInterfaceJIT::Address(ARM64Registers::x2, executableOffsetToFunction));
     347        jit.loadPtr(JSInterfaceJIT::Address(ARM64Registers::x2, executableOffsetToFunction), ARM64Registers::x2);
    345348    } else
    346         jit.call(JSInterfaceJIT::Address(ARM64Registers::x1, InternalFunction::offsetOfNativeFunctionFor(kind)));
     349        jit.loadPtr(JSInterfaceJIT::Address(ARM64Registers::x1, InternalFunction::offsetOfNativeFunctionFor(kind)), ARM64Registers::x2);
     350    jit.move(JSInterfaceJIT::TrustedImm64(g_nativeCodePoison), ARM64Registers::x1);
     351    jit.xor64(ARM64Registers::x1, ARM64Registers::x2);
     352    jit.call(ARM64Registers::x2);
     353
    347354#elif CPU(ARM) || CPU(MIPS)
    348355#if CPU(MIPS)
    … …  
    11641171   
    11651172#if USE(JSVALUE64)
    1166     jit.move(CCallHelpers::TrustedImm64(g_masmPoison), GPRInfo::regT1);
     1173    jit.move(CCallHelpers::TrustedImm64(g_jitCodePoison), GPRInfo::regT1);
    11671174    jit.xor64(GPRInfo::regT1, GPRInfo::regT0);
    11681175#endif

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r225632 r225659  
    19511951        callTargetFunction(LLIntCallLinkInfo::machineCodeTarget[t1])
    19521952    else
    1953         loadp _g_masmPoison, t2
     1953        loadp _g_jitCodePoison, t2
    19541954        xorp LLIntCallLinkInfo::machineCodeTarget[t1], t2
    19551955        prepareCall(t2, t1, t3, t4)
    … …  
    20812081        if X86_64_WIN
    20822082            subp 32, sp
    2083         end
    2084         call executableOffsetToFunction[t1]
    2085         if X86_64_WIN
     2083            call executableOffsetToFunction[t1]
    20862084            addp 32, sp
     2085        else
     2086            loadp _g_nativeCodePoison, t2
     2087            xorp executableOffsetToFunction[t1], t2
     2088            call t2
    20872089        end
    20882090    end
    … …  
    21202122        if X86_64_WIN
    21212123            subp 32, sp
    2122         end
    2123         call offsetOfFunction[t1]
    2124         if X86_64_WIN
     2124            call offsetOfFunction[t1]
    21252125            addp 32, sp
     2126        else
     2127            loadp _g_nativeCodePoison, t2
     2128            xorp offsetOfFunction[t1], t2
     2129            call t2
    21262130        end
    21272131    end

  • trunk/Source/JavaScriptCore/runtime/CustomGetterSetter.h

    r219981 r225659  
    11/*
    2  * Copyright (C) 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2626#pragma once
    2727
     28#include "JSCPoisonedPtr.h"
    2829#include "JSCell.h"
    2930#include "PropertySlot.h"
    … …  
    4849    }
    4950
    50     CustomGetterSetter::CustomGetter getter() const { return m_getter; }
    51     CustomGetterSetter::CustomSetter setter() const { return m_setter; }
     51    CustomGetterSetter::CustomGetter getter() const { return m_getter.unpoisoned(); }
     52    CustomGetterSetter::CustomSetter setter() const { return m_setter.unpoisoned(); }
    5253
    5354    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
    … …  
    6768
    6869private:
    69     CustomGetter m_getter;
    70     CustomSetter m_setter;
     70    template<typename T>
     71    using PoisonedAccessor = Poisoned<g_nativeCodePoison, T>;
     72
     73    PoisonedAccessor<CustomGetter> m_getter;
     74    PoisonedAccessor<CustomSetter> m_setter;
    7175};
    7276

  • trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp

    r224487 r225659  
    8989    auto* function = jsCast<InternalFunction*>(cell);
    9090    ASSERT(function->m_functionForCall);
    91     callData.native.function = function->m_functionForCall;
     91    callData.native.function = function->m_functionForCall.unpoisoned();
    9292    return CallType::Host;
    9393}
    … …  
    9898    if (function->m_functionForConstruct == callHostFunctionAsConstructor)
    9999        return ConstructType::None;
    100     constructData.native.function = function->m_functionForConstruct;
     100    constructData.native.function = function->m_functionForConstruct.unpoisoned();
    101101    return ConstructType::Host;
    102102}

  • trunk/Source/JavaScriptCore/runtime/InternalFunction.h

    r224487 r225659  
    11/*
    22 *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
    3  *  Copyright (C) 2003, 2006, 2007, 2008, 2016 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
    44 *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
    55 *  Copyright (C) 2007 Maks Orlovich
    … …  
    2525
    2626#include "CodeSpecializationKind.h"
     27#include "JSCPoisonedPtr.h"
    2728#include "JSDestructibleObject.h"
    2829
    … …  
    5657    {
    5758        if (kind == CodeForCall)
    58             return m_functionForCall;
     59            return m_functionForCall.unpoisoned();
    5960        ASSERT(kind == CodeForConstruct);
    60         return m_functionForConstruct;
     61        return m_functionForConstruct.unpoisoned();
    6162    }
    6263
    … …  
    7071
    7172protected:
     73    using PoisonedNativeFunction = Poisoned<g_nativeCodePoison, NativeFunction>;
     74
    7275    JS_EXPORT_PRIVATE InternalFunction(VM&, Structure*, NativeFunction functionForCall, NativeFunction functionForConstruct);
    7376
    … …  
    8083    JS_EXPORT_PRIVATE static CallType getCallData(JSCell*, CallData&);
    8184
    82     NativeFunction m_functionForCall;
    83     NativeFunction m_functionForConstruct;
     85    PoisonedNativeFunction m_functionForCall;
     86    PoisonedNativeFunction m_functionForConstruct;
    8487    WriteBarrier<JSString> m_originalName;
    8588};

  • trunk/Source/JavaScriptCore/runtime/JSCPoisonedPtr.cpp

    r225632 r225659  
    2929namespace JSC {
    3030
    31 uintptr_t g_classInfoPoison;
    32 uintptr_t g_masmPoison;
     31uintptr_t g_globalDataPoison;
     32uintptr_t g_jitCodePoison;
     33uintptr_t g_nativeCodePoison;
    3334
    3435void initializePoison()
    … …  
    3637    static std::once_flag initializeOnceFlag;
    3738    std::call_once(initializeOnceFlag, [] {
    38         g_classInfoPoison = makePoison();
    39         g_masmPoison = makePoison();
     39        g_globalDataPoison = makePoison();
     40        g_jitCodePoison = makePoison();
     41        g_nativeCodePoison = makePoison();
    4042    });
    4143}

  • trunk/Source/JavaScriptCore/runtime/JSCPoisonedPtr.h

    r225632 r225659  
    3030namespace JSC {
    3131
    32 extern "C" JS_EXPORTDATA uintptr_t g_classInfoPoison;
    33 extern "C" JS_EXPORTDATA uintptr_t g_masmPoison;
     32extern "C" JS_EXPORTDATA uintptr_t g_globalDataPoison;
     33extern "C" JS_EXPORTDATA uintptr_t g_jitCodePoison;
     34extern "C" JS_EXPORTDATA uintptr_t g_nativeCodePoison;
    3435
    3536struct ClassInfo;
    3637
    37 using PoisonedClassInfoPtr = Poisoned<g_classInfoPoison, const ClassInfo*>;
    38 using PoisonedMasmPtr = Poisoned<g_masmPoison, void*>;
     38using PoisonedClassInfoPtr = Poisoned<g_globalDataPoison, const ClassInfo*>;
     39using PoisonedMasmPtr = Poisoned<g_jitCodePoison, void*>;
    3940
    4041void initializePoison();

  • trunk/Source/JavaScriptCore/runtime/NativeExecutable.cpp

    r217108 r225659  
    11/*
    2  * Copyright (C) 2009, 2010, 2013, 2015-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2009-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    8080{
    8181    if (kind == CodeForCall)
    82         return CodeBlockHash(static_cast<unsigned>(bitwise_cast<size_t>(m_function)));
    83    
     82        return CodeBlockHash(m_function.bits());
     83
    8484    RELEASE_ASSERT(kind == CodeForConstruct);
    85     return CodeBlockHash(static_cast<unsigned>(bitwise_cast<size_t>(m_constructor)));
     85    return CodeBlockHash(m_constructor.bits());
    8686}
    8787

  • trunk/Source/JavaScriptCore/runtime/NativeExecutable.h

    r225314 r225659  
    2727
    2828#include "ExecutableBase.h"
     29#include "JSCPoisonedPtr.h"
    2930
    3031namespace JSC {
    … …  
    5253    CodeBlockHash hashFor(CodeSpecializationKind) const;
    5354
    54     NativeFunction function() { return m_function; }
    55     NativeFunction constructor() { return m_constructor; }
     55    NativeFunction function() { return m_function.unpoisoned(); }
     56    NativeFunction constructor() { return m_constructor.unpoisoned(); }
    5657       
    5758    NativeFunction nativeFunctionFor(CodeSpecializationKind kind)
    … …  
    9091private:
    9192    friend class ExecutableBase;
     93    using PoisonedNativeFunction = Poisoned<g_nativeCodePoison, NativeFunction>;
    9294
    9395    NativeExecutable(VM&, NativeFunction function, NativeFunction constructor, Intrinsic, const DOMJIT::Signature*);
    9496
    95     NativeFunction m_function;
    96     NativeFunction m_constructor;
     97    PoisonedNativeFunction m_function;
     98    PoisonedNativeFunction m_constructor;
    9799    const DOMJIT::Signature* m_signature;
    98100

  • trunk/Source/JavaScriptCore/runtime/Structure.cpp

    r225524 r225659  
    8787        WeakSet::deallocate(impl);
    8888    WeakImpl* impl = WeakSet::allocate(structure, &singleSlotTransitionWeakOwner(), this);
    89     m_data = reinterpret_cast<intptr_t>(impl) | UsingSingleSlotFlag;
     89    m_data = PoisonedWeakImplPtr(impl).bits() | UsingSingleSlotFlag;
    9090}
    9191

  • trunk/Source/JavaScriptCore/runtime/StructureTransitionTable.h

    r206525 r225659  
    2727
    2828#include "IndexingType.h"
     29#include "JSCPoison.h"
    2930#include "WeakGCMap.h"
    3031#include <wtf/HashFunctions.h>
    … …  
    187188private:
    188189    friend class SingleSlotTransitionWeakOwner;
     190    using PoisonedTransitionMapPtr = Int32Poisoned<TransitionMapPoison, TransitionMap*>;
     191    using PoisonedWeakImplPtr = Int32Poisoned<WeakImplPoison, WeakImpl*>;
    189192
    190193    bool isUsingSingleSlot() const
    … …  
    196199    {
    197200        ASSERT(!isUsingSingleSlot());
    198         return reinterpret_cast<TransitionMap*>(m_data);
     201        return PoisonedTransitionMapPtr(m_data).unpoisoned();
    199202    }
    200203
    … …  
    202205    {
    203206        ASSERT(isUsingSingleSlot());
    204         return reinterpret_cast<WeakImpl*>(m_data & ~UsingSingleSlotFlag);
     207        return PoisonedWeakImplPtr(m_data & ~UsingSingleSlotFlag).unpoisoned();
    205208    }
    206209
    … …  
    213216
    214217        // This implicitly clears the flag that indicates we're using a single transition
    215         m_data = reinterpret_cast<intptr_t>(map);
     218        m_data = PoisonedTransitionMapPtr(map).bits();
    216219
    217220        ASSERT(!isUsingSingleSlot());

  • trunk/Source/WTF/ChangeLog

    r225632 r225659  
     12017-12-07  Mark Lam  <mark.lam@apple.com>
     2
     3        Apply poisoning to some native code pointers.
     4        https://bugs.webkit.org/show_bug.cgi?id=180541
     5        <rdar://problem/35916875>
     6
     7        Reviewed by Filip Pizlo.
     8
     9        Ensure that the resultant poisoned bits still looks like a pointer in that its
     10        bottom bits are 0, just like the alignment bits of a pointer.  This allows the
     11        client to use the bottom bits of the poisoned bits as flag bits just like the
     12        client was previously able to do with pointer values.
     13
     14        Note: we only ensure that the bottom alignment bits of the generated poison
     15        value is 0.  We're not masking out the poisoned bits.  This means that the bottom
     16        bits of the poisoned bits will only be null if the original pointer is aligned.
     17        Hence, if the client applies the poison to an unaligned pointer, we do not lose
     18        any information on the low bits.
     19
     20        Also removed 2 wrong assertions in PoisonedImpl's constructors.  We were
     21        asserting that Poisoned will never be used with a null value, but that's invalid.
     22        We do want to allow a null value so that we don't have to constantly do null
     23        checks in the clients.  This was uncovered by some layout tests.
     24
     25        * wtf/Poisoned.cpp:
     26        (WTF::makePoison):
     27        * wtf/Poisoned.h:
     28        (WTF::PoisonedImpl::PoisonedImpl):
     29
    1302017-12-07  Mark Lam  <mark.lam@apple.com>
    231

  • trunk/Source/WTF/wtf/Poisoned.cpp

    r225632 r225659  
    4040    // used for a notmal zero check without needing to decoded first.
    4141    key |= (static_cast<uintptr_t>(0x1) << 63);
     42    // Ensure that the bottom alignment bits are still 0 so that the poisoned bits will
     43    // still preserve the properties of a pointer where these bits are expected to be 0.
     44    // This allows the poisoned bits to be used in place of the pointer by clients that
     45    // rely on this property of pointers and sets flags in the low bits.
     46    key &= ~static_cast<uintptr_t>(0x7);
    4247#else
    4348    key = 0; // Poisoning is not supported on 32-bit or non-darwin platforms yet.

  • trunk/Source/WTF/wtf/Poisoned.h

    r225632 r225659  
    4848    explicit PoisonedImpl(T ptr)
    4949        : m_poisonedBits(poison(ptr))
    50     {
    51         ASSERT(ptr && m_poisonedBits);
    52     }
     50    { }
    5351
    5452    PoisonedImpl(const PoisonedImpl&) = default;
    … …  
    5654    explicit PoisonedImpl(PoisonedBits poisonedBits)
    5755        : m_poisonedBits(poisonedBits)
    58     {
    59         ASSERT(m_poisonedBits);
    60     }
     56    { }
    6157
    6258#if ENABLE(POISON_ASSERTS)
Note: See TracChangeset for help on using the changeset viewer.