Changeset 241280 in webkit
- Timestamp:
- Feb 11, 2019, 2:44:17 PM (6 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r241267 r241280 1 2019-02-11 Mark Lam <mark.lam@apple.com> 2 3 Randomize insertion of deallocated StructureIDs into the StructureIDTable's free list. 4 https://bugs.webkit.org/show_bug.cgi?id=194512 5 <rdar://problem/47975465> 6 7 Reviewed by Yusuke Suzuki. 8 9 * runtime/StructureIDTable.cpp: 10 (JSC::StructureIDTable::StructureIDTable): 11 (JSC::StructureIDTable::allocateID): 12 (JSC::StructureIDTable::deallocateID): 13 * runtime/StructureIDTable.h: 14 1 15 2019-02-10 Mark Lam <mark.lam@apple.com> 2 16 -
trunk/Source/JavaScriptCore/runtime/StructureIDTable.cpp
r229309 r241280 1 1 /* 2 * Copyright (C) 2013 Apple Inc. All rights reserved.2 * Copyright (C) 2013-2019 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 33 33 34 34 StructureIDTable::StructureIDTable() 35 : m_firstFreeOffset(0) 36 , m_table(makeUniqueArray<StructureOrOffset>(s_initialSize)) 35 : m_table(makeUniqueArray<StructureOrOffset>(s_initialSize)) 37 36 , m_size(0) 38 37 , m_capacity(s_initialSize) … … 97 96 StructureID result = m_firstFreeOffset; 98 97 m_firstFreeOffset = table()[m_firstFreeOffset].offset; 98 if (!m_firstFreeOffset) 99 m_lastFreeOffset = 0; 100 99 101 table()[result].structure = structure; 100 102 ASSERT(!isNuked(result)); … … 111 113 ASSERT(structureID != s_unusedID); 112 114 RELEASE_ASSERT(table()[structureID].structure == structure); 113 table()[structureID].offset = m_firstFreeOffset; 114 m_firstFreeOffset = structureID; 115 116 if (!m_firstFreeOffset) { 117 table()[structureID].offset = 0; 118 m_firstFreeOffset = structureID; 119 m_lastFreeOffset = structureID; 120 return; 121 } 122 123 bool insertAtHead = m_weakRandom.getUint32() & 1; 124 if (insertAtHead) { 125 table()[structureID].offset = m_firstFreeOffset; 126 m_firstFreeOffset = structureID; 127 } else { 128 table()[structureID].offset = 0; 129 table()[m_lastFreeOffset].offset = structureID; 130 m_lastFreeOffset = structureID; 131 } 115 132 #else 116 133 UNUSED_PARAM(structure); -
trunk/Source/JavaScriptCore/runtime/StructureIDTable.h
r241234 r241280 1 1 /* 2 * Copyright (C) 2013 Apple Inc. All rights reserved.2 * Copyright (C) 2013-2019 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 29 29 #include <wtf/UniqueArray.h> 30 30 #include <wtf/Vector.h> 31 #include <wtf/WeakRandom.h> 31 32 32 33 namespace JSC { … … 111 112 Vector<UniqueArray<StructureOrOffset>> m_oldTables; 112 113 113 uint32_t m_firstFreeOffset; 114 uint32_t m_firstFreeOffset { 0 }; 115 uint32_t m_lastFreeOffset { 0 }; 114 116 UniqueArray<StructureOrOffset> m_table; 115 117 116 118 size_t m_size; 117 119 size_t m_capacity; 120 121 WeakRandom m_weakRandom; 118 122 119 123 #if USE(JSVALUE64)
Note:
See TracChangeset
for help on using the changeset viewer.