Changeset 241280 in webkit


Ignore:
Timestamp:
Feb 11, 2019, 2:44:17 PM (6 years ago)
Author:
mark.lam@apple.com
Message:

Randomize insertion of deallocated StructureIDs into the StructureIDTable's free list.
https://bugs.webkit.org/show_bug.cgi?id=194512
<rdar://problem/47975465>

Reviewed by Yusuke Suzuki.

  • runtime/StructureIDTable.cpp:

(JSC::StructureIDTable::StructureIDTable):
(JSC::StructureIDTable::allocateID):
(JSC::StructureIDTable::deallocateID):

  • runtime/StructureIDTable.h:
Location:
trunk/Source/JavaScriptCore
Files:
3 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/JavaScriptCore/ChangeLog

    r241267 r241280  
     12019-02-11  Mark Lam  <mark.lam@apple.com>
     2
     3        Randomize insertion of deallocated StructureIDs into the StructureIDTable's free list.
     4        https://bugs.webkit.org/show_bug.cgi?id=194512
     5        <rdar://problem/47975465>
     6
     7        Reviewed by Yusuke Suzuki.
     8
     9        * runtime/StructureIDTable.cpp:
     10        (JSC::StructureIDTable::StructureIDTable):
     11        (JSC::StructureIDTable::allocateID):
     12        (JSC::StructureIDTable::deallocateID):
     13        * runtime/StructureIDTable.h:
     14
    1152019-02-10  Mark Lam  <mark.lam@apple.com>
    216
  • trunk/Source/JavaScriptCore/runtime/StructureIDTable.cpp

    r229309 r241280  
    11/*
    2  * Copyright (C) 2013 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
     
    3333
    3434StructureIDTable::StructureIDTable()
    35     : m_firstFreeOffset(0)
    36     , m_table(makeUniqueArray<StructureOrOffset>(s_initialSize))
     35    : m_table(makeUniqueArray<StructureOrOffset>(s_initialSize))
    3736    , m_size(0)
    3837    , m_capacity(s_initialSize)
     
    9796    StructureID result = m_firstFreeOffset;
    9897    m_firstFreeOffset = table()[m_firstFreeOffset].offset;
     98    if (!m_firstFreeOffset)
     99        m_lastFreeOffset = 0;
     100
    99101    table()[result].structure = structure;
    100102    ASSERT(!isNuked(result));
     
    111113    ASSERT(structureID != s_unusedID);
    112114    RELEASE_ASSERT(table()[structureID].structure == structure);
    113     table()[structureID].offset = m_firstFreeOffset;
    114     m_firstFreeOffset = structureID;
     115
     116    if (!m_firstFreeOffset) {
     117        table()[structureID].offset = 0;
     118        m_firstFreeOffset = structureID;
     119        m_lastFreeOffset = structureID;
     120        return;
     121    }
     122
     123    bool insertAtHead = m_weakRandom.getUint32() & 1;
     124    if (insertAtHead) {
     125        table()[structureID].offset = m_firstFreeOffset;
     126        m_firstFreeOffset = structureID;
     127    } else {
     128        table()[structureID].offset = 0;
     129        table()[m_lastFreeOffset].offset = structureID;
     130        m_lastFreeOffset = structureID;
     131    }
    115132#else
    116133    UNUSED_PARAM(structure);
  • trunk/Source/JavaScriptCore/runtime/StructureIDTable.h

    r241234 r241280  
    11/*
    2  * Copyright (C) 2013 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
     
    2929#include <wtf/UniqueArray.h>
    3030#include <wtf/Vector.h>
     31#include <wtf/WeakRandom.h>
    3132
    3233namespace JSC {
     
    111112    Vector<UniqueArray<StructureOrOffset>> m_oldTables;
    112113
    113     uint32_t m_firstFreeOffset;
     114    uint32_t m_firstFreeOffset { 0 };
     115    uint32_t m_lastFreeOffset { 0 };
    114116    UniqueArray<StructureOrOffset> m_table;
    115117
    116118    size_t m_size;
    117119    size_t m_capacity;
     120
     121    WeakRandom m_weakRandom;
    118122
    119123#if USE(JSVALUE64)
Note: See TracChangeset for help on using the changeset viewer.