Changeset 248192 in webkit


Ignore:
Timestamp:
Aug 2, 2019 5:31:31 PM (5 years ago)
Author:
mark.lam@apple.com
Message:

[ARM64E] Harden the diversity of the DOMJIT::Signature::unsafeFunction pointer.
​https://bugs.webkit.org/show_bug.cgi?id=200292
<rdar://problem/53706881>

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Previously, DOMJIT::Signature::functionWithoutTypeCheck was signed as a C function
pointer. We can do better by signing it like a vtbl function pointer.

No new tests needed. The DOMJIT mechanism is covered by existing tests.

I also manually confirmed that DOMJIT::Signature::functionWithoutTypeCheck is signed
exactly as expected by reading its bits out of memory (not letting Clang have a
chance to resign it into a C function pointer) and comparing it against manually
signed bits with the expected diversifier.

  • assembler/MacroAssemblerCodeRef.h:

(JSC::CFunctionPtr::CFunctionPtr):
(JSC::CFunctionPtr::get const):
(JSC::CFunctionPtr::address const):
(JSC::CFunctionPtr::operator bool const):
(JSC::CFunctionPtr::operator! const):
(JSC::CFunctionPtr::operator== const):
(JSC::CFunctionPtr::operator!= const):

  • Introduce a CFunctionPtr abstraction that is used to hold pointers to C functions. It can instantiated in 4 ways:
  1. The default constructor.
  2. A constructor that takes a nullptr_t.

These 2 forms will instantiate a CFunctionPtr with a nullptr.

  1. A constructor that takes the name of a function.
  2. A constructor that takes a function pointer.

Form 3 already knows that we're initializing with a real function, and
that Clang will give it to use signed as a C function pointer. So, it
doesn't do any assertions. This form is useful for initializing CFunctionPtrs
embedded in const data structures.

Form 4 is an explicit constructor that takes an arbitrary function
pointer, but does not know if that pointer is already signed as a C function
pointer. Hence, this form will do a RELEASE_ASSERT that the given function
pointer is actually signed as a C function pointer.

Once instantiated, we are guaranteed that a C function pointer is either null
or contains a signed C function pointer.

  • domjit/DOMJITSignature.h:

(JSC::DOMJIT::Signature::Signature):

  • Sign functionWithoutTypeCheck as WTF_VTBL_FUNCPTR_PTRAUTH(DOMJITFunctionPtrTag).
  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCallDOM):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):

  • Use the new CFunctionPtr to document that the retrieved signature->functionWithoutTypeCheck is signed as a C function pointer.
  • runtime/ClassInfo.h:
  • Update MethodTable to sign its function pointers using the new WTF_VTBL_FUNCPTR_PTRAUTH_STR to be consistent. No longer need to roll its own PTRAUTH macro.
  • runtime/JSCPtrTag.h:
  • Add DOMJITFunctionPtrTag.
  • tools/JSDollarVM.cpp:
  • Update to work with the new DOMJIT::Signature constructor.

Source/WebCore:

  • bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

  • Update to work with the new DOMJIT::Signature constructor.
  • bindings/scripts/test/JS/JSTestDOMJIT.cpp:
  • Re-base test results.

Source/WTF:

  • wtf/PtrTag.h:
  • Introducing WTF_VTBL_FUNCPTR_PTRAUTH and WTF_VTBL_FUNCPTR_PTRAUTH_STR macros for defining vtbl function pointer style pointer signing modifier.
Location:
trunk/Source
Files:
13 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r248187 r248192  
     12019-08-02  Mark Lam  <mark.lam@apple.com>
     2
     3        [ARM64E] Harden the diversity of the DOMJIT::Signature::unsafeFunction pointer.
     4        https://bugs.webkit.org/show_bug.cgi?id=200292
     5        <rdar://problem/53706881>
     6
     7        Reviewed by Geoffrey Garen.
     8
     9        Previously, DOMJIT::Signature::functionWithoutTypeCheck was signed as a C function
     10        pointer.  We can do better by signing it like a vtbl function pointer.
     11
     12        No new tests needed.  The DOMJIT mechanism is covered by existing tests.
     13
     14        I also manually confirmed that DOMJIT::Signature::functionWithoutTypeCheck is signed
     15        exactly as expected by reading its bits out of memory (not letting Clang have a
     16        chance to resign it into a C function pointer) and comparing it against manually
     17        signed bits with the expected diversifier.
     18
     19        * assembler/MacroAssemblerCodeRef.h:
     20        (JSC::CFunctionPtr::CFunctionPtr):
     21        (JSC::CFunctionPtr::get const):
     22        (JSC::CFunctionPtr::address const):
     23        (JSC::CFunctionPtr::operator bool const):
     24        (JSC::CFunctionPtr::operator! const):
     25        (JSC::CFunctionPtr::operator== const):
     26        (JSC::CFunctionPtr::operator!= const):
     27
     28        - Introduce a CFunctionPtr abstraction that is used to hold pointers to C functions.
     29          It can instantiated in 4 ways:
     30
     31          1. The default constructor.
     32          2. A constructor that takes a nullptr_t.
     33
     34             These 2 forms will instantiate a CFunctionPtr with a nullptr.
     35
     36          3. A constructor that takes the name of a function.
     37          4. A constructor that takes a function pointer.
     38
     39              Form 3 already knows that we're initializing with a real function, and
     40              that Clang will give it to use signed as a C function pointer.  So, it
     41              doesn't do any assertions.  This form is useful for initializing CFunctionPtrs
     42              embedded in const data structures.
     43
     44              Form 4 is an explicit constructor that takes an arbitrary function
     45              pointer, but does not know if that pointer is already signed as a C function
     46              pointer.  Hence, this form will do a RELEASE_ASSERT that the given function
     47              pointer is actually signed as a C function pointer.
     48
     49          Once instantiated, we are guaranteed that a C function pointer is either null
     50          or contains a signed C function pointer.
     51
     52        * domjit/DOMJITSignature.h:
     53        (JSC::DOMJIT::Signature::Signature):
     54        - Sign functionWithoutTypeCheck as WTF_VTBL_FUNCPTR_PTRAUTH(DOMJITFunctionPtrTag).
     55
     56        * dfg/DFGSpeculativeJIT.cpp:
     57        (JSC::DFG::SpeculativeJIT::compileCallDOM):
     58        * ftl/FTLLowerDFGToB3.cpp:
     59        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
     60        - Use the new CFunctionPtr to document that the retrieved signature->functionWithoutTypeCheck
     61          is signed as a C function pointer.
     62
     63        * runtime/ClassInfo.h:
     64        - Update MethodTable to sign its function pointers using the new WTF_VTBL_FUNCPTR_PTRAUTH_STR
     65          to be consistent.  No longer need to roll its own PTRAUTH macro.
     66
     67        * runtime/JSCPtrTag.h:
     68        - Add DOMJITFunctionPtrTag.
     69
     70        * tools/JSDollarVM.cpp:
     71        - Update to work with the new DOMJIT::Signature constructor.
     72
    1732019-08-02  Yusuke Suzuki  <ysuzuki@apple.com>
    274

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h

    r243886 r248192  
    5959enum OpcodeID : unsigned;
    6060
     61// CFunctionPtr can only be used to hold C/C++ functions.
     62class CFunctionPtr {
     63public:
     64    using Ptr = void(*)();
     65
     66    CFunctionPtr() { }
     67    CFunctionPtr(std::nullptr_t) { }
     68
     69    template<typename ReturnType, typename... Arguments>
     70    constexpr CFunctionPtr(ReturnType(&ptr)(Arguments...))
     71        : m_ptr(reinterpret_cast<Ptr>(&ptr))
     72    { }
     73
     74    template<typename ReturnType, typename... Arguments>
     75    explicit CFunctionPtr(ReturnType(*ptr)(Arguments...))
     76        : m_ptr(reinterpret_cast<Ptr>(ptr))
     77    {
     78        assertIsCFunctionPtr(m_ptr);
     79    }
     80
     81    // MSVC doesn't seem to treat functions with different calling conventions as
     82    // different types; these methods are already defined for fastcall, below.
     83#if CALLING_CONVENTION_IS_STDCALL && !OS(WINDOWS)
     84    template<typename ReturnType, typename... Arguments>
     85    constexpr CFunctionPtr(ReturnType(CDECL &ptr)(Arguments...))
     86        : m_ptr(reinterpret_cast<Ptr>(&ptr))
     87    { }
     88
     89    template<typename ReturnType, typename... Arguments>
     90    explicit CFunctionPtr(ReturnType(CDECL *ptr)(Arguments...))
     91        : m_ptr(reinterpret_cast<Ptr>(ptr))
     92    {
     93        assertIsCFunctionPtr(m_ptr);
     94    }
     95
     96#endif // CALLING_CONVENTION_IS_STDCALL && !OS(WINDOWS)
     97
     98#if COMPILER_SUPPORTS(FASTCALL_CALLING_CONVENTION)
     99    template<typename ReturnType, typename... Arguments>
     100    constexpr CFunctionPtr(ReturnType(FASTCALL &ptr)(Arguments...))
     101        : m_ptr(reinterpret_cast<Ptr>(&ptr))
     102    { }
     103
     104    template<typename ReturnType, typename... Arguments>
     105    explicit CFunctionPtr(ReturnType(FASTCALL *ptr)(Arguments...))
     106        : m_ptr(reinterpret_cast<Ptr>(ptr))
     107    {
     108        assertIsCFunctionPtr(m_ptr);
     109    }
     110#endif // COMPILER_SUPPORTS(FASTCALL_CALLING_CONVENTION)
     111
     112    constexpr Ptr get() const { return m_ptr; }
     113    void* address() const { return reinterpret_cast<void*>(m_ptr); }
     114
     115    explicit operator bool() const { return !!m_ptr; }
     116    bool operator!() const { return !m_ptr; }
     117
     118    bool operator==(const CFunctionPtr& other) const { return m_ptr == other.m_ptr; }
     119    bool operator!=(const CFunctionPtr& other) const { return m_ptr != other.m_ptr; }
     120
     121private:
     122    Ptr m_ptr { nullptr };
     123};
     124
     125
    61126// FunctionPtr:
    62127//

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r248105 r248192  
    94159415
    94169416    flushRegisters();
    9417     DOMJIT::FunctionWithoutTypeCheck function = signature->functionWithoutTypeCheck;
    9418     assertIsTaggedWith(function, CFunctionPtrTag);
     9417
     9418    auto function = CFunctionPtr(signature->functionWithoutTypeCheck);
    94199419    unsigned argumentCountIncludingThis = signature->argumentCount + 1;
    94209420    switch (argumentCountIncludingThis) {
    94219421    case 1:
    9422         callOperation(reinterpret_cast<J_JITOperation_EP>(function), extractResult(resultRegs), regs[0]);
     9422        callOperation(reinterpret_cast<J_JITOperation_EP>(function.get()), extractResult(resultRegs), regs[0]);
    94239423        break;
    94249424    case 2:
    9425         callOperation(reinterpret_cast<J_JITOperation_EPP>(function), extractResult(resultRegs), regs[0], regs[1]);
     9425        callOperation(reinterpret_cast<J_JITOperation_EPP>(function.get()), extractResult(resultRegs), regs[0], regs[1]);
    94269426        break;
    94279427    case 3:
    9428         callOperation(reinterpret_cast<J_JITOperation_EPPP>(function), extractResult(resultRegs), regs[0], regs[1], regs[2]);
     9428        callOperation(reinterpret_cast<J_JITOperation_EPPP>(function.get()), extractResult(resultRegs), regs[0], regs[1], regs[2]);
    94299429        break;
    94309430    default:

  • trunk/Source/JavaScriptCore/domjit/DOMJITSignature.h

    r248105 r248192  
    3838#define JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS_INCLUDING_THIS (1 + JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS)
    3939
    40 using FunctionWithoutTypeCheck = void (*)();
     40using FunctionPtr = void (*WTF_VTBL_FUNCPTR_PTRAUTH(DOMJITFunctionPtrTag))();
    4141
    4242class Signature {
    4343public:
    4444    template<typename... Arguments>
    45     constexpr Signature(FunctionWithoutTypeCheck functionWithoutTypeCheck, const ClassInfo* classInfo, Effect effect, SpeculatedType result, Arguments... arguments)
    46         : functionWithoutTypeCheck(functionWithoutTypeCheck)
     45    constexpr Signature(CFunctionPtr functionWithoutTypeCheck, const ClassInfo* classInfo, Effect effect, SpeculatedType result, Arguments... arguments)
     46        : functionWithoutTypeCheck(functionWithoutTypeCheck.get())
    4747        , classInfo(classInfo)
    4848        , result(result)
    … …  
    5353    }
    5454
    55     FunctionWithoutTypeCheck functionWithoutTypeCheck;
     55    const FunctionPtr functionWithoutTypeCheck;
    5656    const ClassInfo* const classInfo;
    5757    const SpeculatedType result;

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r248178 r248192  
    1258112581        unsigned argumentCountIncludingThis = signature->argumentCount + 1;
    1258212582        LValue result;
    12583         DOMJIT::FunctionWithoutTypeCheck function = signature->functionWithoutTypeCheck;
    12584         assertIsTaggedWith(function, CFunctionPtrTag);
     12583        auto function = CFunctionPtr(signature->functionWithoutTypeCheck);
    1258512584        switch (argumentCountIncludingThis) {
    1258612585        case 1:
    12587             result = vmCall(Int64, m_out.operation(reinterpret_cast<J_JITOperation_EP>(function)), m_callFrame, operands[0]);
     12586            result = vmCall(Int64, m_out.operation(reinterpret_cast<J_JITOperation_EP>(function.get())), m_callFrame, operands[0]);
    1258812587            break;
    1258912588        case 2:
    12590             result = vmCall(Int64, m_out.operation(reinterpret_cast<J_JITOperation_EPP>(function)), m_callFrame, operands[0], operands[1]);
     12589            result = vmCall(Int64, m_out.operation(reinterpret_cast<J_JITOperation_EPP>(function.get())), m_callFrame, operands[0], operands[1]);
    1259112590            break;
    1259212591        case 3:
    12593             result = vmCall(Int64, m_out.operation(reinterpret_cast<J_JITOperation_EPPP>(function)), m_callFrame, operands[0], operands[1], operands[2]);
     12592            result = vmCall(Int64, m_out.operation(reinterpret_cast<J_JITOperation_EPPP>(function.get())), m_callFrame, operands[0], operands[1], operands[2]);
    1259412593            break;
    1259512594        default:

  • trunk/Source/JavaScriptCore/runtime/ClassInfo.h

    r243254 r248192  
    2626#include "ConstructData.h"
    2727#include "JSCast.h"
    28 
    29 #if CPU(ARM64E)
    30 #include <ptrauth.h>
    31 #endif
     28#include <wtf/PtrTag.h>
    3229
    3330namespace WTF {
    … …  
    4239struct HashTable;
    4340
    44 #if CPU(ARM64E)
    45 #define WTF_METHOD_TABLE_ENTRY(method) \
    46     __ptrauth(ptrauth_key_process_independent_code, true, ptrauth_string_discriminator("MethodTable." #method)) method
    47 #else
    48 #define WTF_METHOD_TABLE_ENTRY(method) method
    49 #endif
     41#define METHOD_TABLE_ENTRY(method) \
     42    WTF_VTBL_FUNCPTR_PTRAUTH_STR("MethodTable." #method) method
    5043
    5144struct MethodTable {
    5245    using DestroyFunctionPtr = void (*)(JSCell*);
    53     DestroyFunctionPtr WTF_METHOD_TABLE_ENTRY(destroy);
     46    DestroyFunctionPtr METHOD_TABLE_ENTRY(destroy);
    5447
    5548    using VisitChildrenFunctionPtr = void (*)(JSCell*, SlotVisitor&);
    56     VisitChildrenFunctionPtr WTF_METHOD_TABLE_ENTRY(visitChildren);
     49    VisitChildrenFunctionPtr METHOD_TABLE_ENTRY(visitChildren);
    5750
    5851    using GetCallDataFunctionPtr = CallType (*)(JSCell*, CallData&);
    59     GetCallDataFunctionPtr WTF_METHOD_TABLE_ENTRY(getCallData);
     52    GetCallDataFunctionPtr METHOD_TABLE_ENTRY(getCallData);
    6053
    6154    using GetConstructDataFunctionPtr = ConstructType (*)(JSCell*, ConstructData&);
    62     GetConstructDataFunctionPtr WTF_METHOD_TABLE_ENTRY(getConstructData);
     55    GetConstructDataFunctionPtr METHOD_TABLE_ENTRY(getConstructData);
    6356
    6457    using PutFunctionPtr = bool (*)(JSCell*, ExecState*, PropertyName propertyName, JSValue, PutPropertySlot&);
    65     PutFunctionPtr WTF_METHOD_TABLE_ENTRY(put);
     58    PutFunctionPtr METHOD_TABLE_ENTRY(put);
    6659
    6760    using PutByIndexFunctionPtr = bool (*)(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
    68     PutByIndexFunctionPtr WTF_METHOD_TABLE_ENTRY(putByIndex);
     61    PutByIndexFunctionPtr METHOD_TABLE_ENTRY(putByIndex);
    6962
    7063    using DeletePropertyFunctionPtr = bool (*)(JSCell*, ExecState*, PropertyName);
    71     DeletePropertyFunctionPtr WTF_METHOD_TABLE_ENTRY(deleteProperty);
     64    DeletePropertyFunctionPtr METHOD_TABLE_ENTRY(deleteProperty);
    7265
    7366    using DeletePropertyByIndexFunctionPtr = bool (*)(JSCell*, ExecState*, unsigned);
    74     DeletePropertyByIndexFunctionPtr WTF_METHOD_TABLE_ENTRY(deletePropertyByIndex);
     67    DeletePropertyByIndexFunctionPtr METHOD_TABLE_ENTRY(deletePropertyByIndex);
    7568
    7669    using GetOwnPropertySlotFunctionPtr = bool (*)(JSObject*, ExecState*, PropertyName, PropertySlot&);
    77     GetOwnPropertySlotFunctionPtr WTF_METHOD_TABLE_ENTRY(getOwnPropertySlot);
     70    GetOwnPropertySlotFunctionPtr METHOD_TABLE_ENTRY(getOwnPropertySlot);
    7871
    7972    using GetOwnPropertySlotByIndexFunctionPtr = bool (*)(JSObject*, ExecState*, unsigned, PropertySlot&);
    80     GetOwnPropertySlotByIndexFunctionPtr WTF_METHOD_TABLE_ENTRY(getOwnPropertySlotByIndex);
     73    GetOwnPropertySlotByIndexFunctionPtr METHOD_TABLE_ENTRY(getOwnPropertySlotByIndex);
    8174
    8275    using ToThisFunctionPtr = JSValue (*)(JSCell*, ExecState*, ECMAMode);
    83     ToThisFunctionPtr WTF_METHOD_TABLE_ENTRY(toThis);
     76    ToThisFunctionPtr METHOD_TABLE_ENTRY(toThis);
    8477
    8578    using DefaultValueFunctionPtr = JSValue (*)(const JSObject*, ExecState*, PreferredPrimitiveType);
    86     DefaultValueFunctionPtr WTF_METHOD_TABLE_ENTRY(defaultValue);
     79    DefaultValueFunctionPtr METHOD_TABLE_ENTRY(defaultValue);
    8780
    8881    using GetOwnPropertyNamesFunctionPtr = void (*)(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
    89     GetOwnPropertyNamesFunctionPtr WTF_METHOD_TABLE_ENTRY(getOwnPropertyNames);
     82    GetOwnPropertyNamesFunctionPtr METHOD_TABLE_ENTRY(getOwnPropertyNames);
    9083
    9184    using GetOwnNonIndexPropertyNamesFunctionPtr = void (*)(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
    92     GetOwnNonIndexPropertyNamesFunctionPtr WTF_METHOD_TABLE_ENTRY(getOwnNonIndexPropertyNames);
     85    GetOwnNonIndexPropertyNamesFunctionPtr METHOD_TABLE_ENTRY(getOwnNonIndexPropertyNames);
    9386
    9487    using GetPropertyNamesFunctionPtr = void (*)(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
    95     GetPropertyNamesFunctionPtr WTF_METHOD_TABLE_ENTRY(getPropertyNames);
     88    GetPropertyNamesFunctionPtr METHOD_TABLE_ENTRY(getPropertyNames);
    9689
    9790    using GetEnumerableLengthFunctionPtr = uint32_t (*)(ExecState*, JSObject*);
    98     GetEnumerableLengthFunctionPtr WTF_METHOD_TABLE_ENTRY(getEnumerableLength);
    99 
    100     GetPropertyNamesFunctionPtr WTF_METHOD_TABLE_ENTRY(getStructurePropertyNames);
    101     GetPropertyNamesFunctionPtr WTF_METHOD_TABLE_ENTRY(getGenericPropertyNames);
     91    GetEnumerableLengthFunctionPtr METHOD_TABLE_ENTRY(getEnumerableLength);
     92
     93    GetPropertyNamesFunctionPtr METHOD_TABLE_ENTRY(getStructurePropertyNames);
     94    GetPropertyNamesFunctionPtr METHOD_TABLE_ENTRY(getGenericPropertyNames);
    10295
    10396    using ClassNameFunctionPtr = String (*)(const JSObject*, VM&);
    104     ClassNameFunctionPtr WTF_METHOD_TABLE_ENTRY(className);
     97    ClassNameFunctionPtr METHOD_TABLE_ENTRY(className);
    10598
    10699    using ToStringNameFunctionPtr = String (*)(const JSObject*, ExecState*);
    107     ToStringNameFunctionPtr WTF_METHOD_TABLE_ENTRY(toStringName);
     100    ToStringNameFunctionPtr METHOD_TABLE_ENTRY(toStringName);
    108101
    109102    using CustomHasInstanceFunctionPtr = bool (*)(JSObject*, ExecState*, JSValue);
    110     CustomHasInstanceFunctionPtr WTF_METHOD_TABLE_ENTRY(customHasInstance);
     103    CustomHasInstanceFunctionPtr METHOD_TABLE_ENTRY(customHasInstance);
    111104
    112105    using DefineOwnPropertyFunctionPtr = bool (*)(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool);
    113     DefineOwnPropertyFunctionPtr WTF_METHOD_TABLE_ENTRY(defineOwnProperty);
     106    DefineOwnPropertyFunctionPtr METHOD_TABLE_ENTRY(defineOwnProperty);
    114107
    115108    using PreventExtensionsFunctionPtr = bool (*)(JSObject*, ExecState*);
    116     PreventExtensionsFunctionPtr WTF_METHOD_TABLE_ENTRY(preventExtensions);
     109    PreventExtensionsFunctionPtr METHOD_TABLE_ENTRY(preventExtensions);
    117110
    118111    using IsExtensibleFunctionPtr = bool (*)(JSObject*, ExecState*);
    119     IsExtensibleFunctionPtr WTF_METHOD_TABLE_ENTRY(isExtensible);
     112    IsExtensibleFunctionPtr METHOD_TABLE_ENTRY(isExtensible);
    120113
    121114    using SetPrototypeFunctionPtr = bool (*)(JSObject*, ExecState*, JSValue, bool shouldThrowIfCantSet);
    122     SetPrototypeFunctionPtr WTF_METHOD_TABLE_ENTRY(setPrototype);
     115    SetPrototypeFunctionPtr METHOD_TABLE_ENTRY(setPrototype);
    123116
    124117    using GetPrototypeFunctionPtr = JSValue (*)(JSObject*, ExecState*);
    125     GetPrototypeFunctionPtr WTF_METHOD_TABLE_ENTRY(getPrototype);
     118    GetPrototypeFunctionPtr METHOD_TABLE_ENTRY(getPrototype);
    126119
    127120    using DumpToStreamFunctionPtr = void (*)(const JSCell*, PrintStream&);
    128     DumpToStreamFunctionPtr WTF_METHOD_TABLE_ENTRY(dumpToStream);
     121    DumpToStreamFunctionPtr METHOD_TABLE_ENTRY(dumpToStream);
    129122
    130123    using HeapSnapshotFunctionPtr = void (*)(JSCell*, HeapSnapshotBuilder&);
    131     HeapSnapshotFunctionPtr WTF_METHOD_TABLE_ENTRY(heapSnapshot);
     124    HeapSnapshotFunctionPtr METHOD_TABLE_ENTRY(heapSnapshot);
    132125
    133126    using EstimatedSizeFunctionPtr = size_t (*)(JSCell*, VM&);
    134     EstimatedSizeFunctionPtr WTF_METHOD_TABLE_ENTRY(estimatedSize);
     127    EstimatedSizeFunctionPtr METHOD_TABLE_ENTRY(estimatedSize);
    135128
    136129    using VisitOutputConstraintsPtr = void (*)(JSCell*, SlotVisitor&);
    137     VisitOutputConstraintsPtr WTF_METHOD_TABLE_ENTRY(visitOutputConstraints);
     130    VisitOutputConstraintsPtr METHOD_TABLE_ENTRY(visitOutputConstraints);
    138131};
    139132

  • trunk/Source/JavaScriptCore/runtime/JSCPtrTag.h

    r247799 r248192  
    3737    v(BytecodePtrTag) \
    3838    v(CopyFunctionPtrTag) \
     39    v(DOMJITFunctionPtrTag) \
    3940    v(DisassemblyPtrTag) \
    4041    v(ExceptionHandlerPtrTag) \

  • trunk/Source/JavaScriptCore/tools/JSDollarVM.cpp

    r248187 r248192  
    828828};
    829829
    830 static const DOMJIT::Signature DOMJITFunctionObjectSignature((DOMJIT::FunctionWithoutTypeCheck)DOMJITFunctionObject::functionWithoutTypeCheck, DOMJITFunctionObject::info(), DOMJIT::Effect::forRead(DOMJIT::HeapRange::top()), SpecInt32Only);
     830static const DOMJIT::Signature DOMJITFunctionObjectSignature(DOMJITFunctionObject::functionWithoutTypeCheck, DOMJITFunctionObject::info(), DOMJIT::Effect::forRead(DOMJIT::HeapRange::top()), SpecInt32Only);
    831831
    832832void DOMJITFunctionObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
    … …  
    882882};
    883883
    884 static const DOMJIT::Signature DOMJITCheckSubClassObjectSignature((DOMJIT::FunctionWithoutTypeCheck)DOMJITCheckSubClassObject::functionWithoutTypeCheck, DOMJITCheckSubClassObject::info(), DOMJIT::Effect::forRead(DOMJIT::HeapRange::top()), SpecInt32Only);
     884static const DOMJIT::Signature DOMJITCheckSubClassObjectSignature(DOMJITCheckSubClassObject::functionWithoutTypeCheck, DOMJITCheckSubClassObject::info(), DOMJIT::Effect::forRead(DOMJIT::HeapRange::top()), SpecInt32Only);
    885885
    886886void DOMJITCheckSubClassObject::finishCreation(VM& vm, JSGlobalObject* globalObject)

  • trunk/Source/WTF/ChangeLog

    r248183 r248192  
     12019-08-02  Mark Lam  <mark.lam@apple.com>
     2
     3        [ARM64E] Harden the diversity of the DOMJIT::Signature::unsafeFunction pointer.
     4        https://bugs.webkit.org/show_bug.cgi?id=200292
     5        <rdar://problem/53706881>
     6
     7        Reviewed by Geoffrey Garen.
     8
     9        * wtf/PtrTag.h:
     10        - Introducing WTF_VTBL_FUNCPTR_PTRAUTH and WTF_VTBL_FUNCPTR_PTRAUTH_STR macros for
     11          defining vtbl function pointer style pointer signing modifier.
     12
    1132019-08-02  Eric Carlson  <eric.carlson@apple.com>
    214

  • trunk/Source/WTF/wtf/PtrTag.h

    r246368 r248192  
    423423inline bool usesPointerTagging() { return true; }
    424424
     425// vtbl function pointers need to sign with ptrauth_key_process_independent_code
     426// because they reside in library code shared by multiple processes.
     427// The second argument to __ptrauth() being 1 means to use the address of the pointer
     428// for diversification as well. __ptrauth() expects a literal int for this argument.
     429#define WTF_VTBL_FUNCPTR_PTRAUTH(discriminator) WTF_VTBL_FUNCPTR_PTRAUTH_STR(#discriminator)
     430#define WTF_VTBL_FUNCPTR_PTRAUTH_STR(discriminatorStr) \
     431    __ptrauth(ptrauth_key_process_independent_code, 1, ptrauth_string_discriminator(discriminatorStr))
     432
    425433#else // not CPU(ARM64E)
    426434
    … …  
    546554
    547555inline bool usesPointerTagging() { return false; }
     556
     557#define WTF_VTBL_FUNCPTR_PTRAUTH(discriminator)
     558#define WTF_VTBL_FUNCPTR_PTRAUTH_STR(discriminatorStr)
    548559
    549560#endif // CPU(ARM64E)

  • trunk/Source/WebCore/ChangeLog

    r248190 r248192  
     12019-08-02  Mark Lam  <mark.lam@apple.com>
     2
     3        [ARM64E] Harden the diversity of the DOMJIT::Signature::unsafeFunction pointer.
     4        https://bugs.webkit.org/show_bug.cgi?id=200292
     5        <rdar://problem/53706881>
     6
     7        Reviewed by Geoffrey Garen.
     8
     9        * bindings/scripts/CodeGeneratorJS.pm:
     10        (GenerateImplementation):
     11        - Update to work with the new DOMJIT::Signature constructor.
     12
     13        * bindings/scripts/test/JS/JSTestDOMJIT.cpp:
     14        - Re-base test results.
     15
    1162019-08-02  Keith Rollin  <krollin@apple.com>
    217

  • trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm

    r248155 r248192  
    40104010            my $classInfo = "JS" . $interface->type->name . "::info()";
    40114011            my $resultType = GetResultTypeFilter($interface, $operation->type);
    4012             my $domJITSignatureHeader = "static const JSC::DOMJIT::Signature ${domJITSignatureName}((JSC::DOMJIT::FunctionWithoutTypeCheck)${nameOfFunctionWithoutTypeCheck},";
     4012            my $domJITSignatureHeader = "static const JSC::DOMJIT::Signature ${domJITSignatureName}(${nameOfFunctionWithoutTypeCheck},";
    40134013            my $domJITSignatureFooter = "$classInfo, JSC::DOMJIT::Effect::forRead(DOMJIT::AbstractHeapRepository::DOM), ${resultType}";
    40144014            foreach my $argument (@{$operation->arguments}) {

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp

    r248105 r248192  
    106106JSC::EncodedJSValue jsTestDOMJITNodeNullableAttr(JSC::ExecState*, JSC::EncodedJSValue, JSC::PropertyName);
    107107
    108 static const JSC::DOMJIT::Signature DOMJITSignatureForTestDOMJITGetAttribute((JSC::DOMJIT::FunctionWithoutTypeCheck)jsTestDOMJITPrototypeFunctionGetAttributeWithoutTypeCheck, JSTestDOMJIT::info(), JSC::DOMJIT::Effect::forRead(DOMJIT::AbstractHeapRepository::DOM), DOMJIT::IDLResultTypeFilter<IDLNullable<IDLDOMString>>::value, DOMJIT::IDLArgumentTypeFilter<IDLDOMString>::value);
    109 
    110 static const JSC::DOMJIT::Signature DOMJITSignatureForTestDOMJITItem((JSC::DOMJIT::FunctionWithoutTypeCheck)jsTestDOMJITPrototypeFunctionItemWithoutTypeCheck, JSTestDOMJIT::info(), JSC::DOMJIT::Effect::forRead(DOMJIT::AbstractHeapRepository::DOM), DOMJIT::IDLResultTypeFilter<IDLDOMString>::value, DOMJIT::IDLArgumentTypeFilter<IDLUnsignedShort>::value, DOMJIT::IDLArgumentTypeFilter<IDLUnsignedShort>::value);
    111 
    112 static const JSC::DOMJIT::Signature DOMJITSignatureForTestDOMJITHasAttribute((JSC::DOMJIT::FunctionWithoutTypeCheck)jsTestDOMJITPrototypeFunctionHasAttributeWithoutTypeCheck, JSTestDOMJIT::info(), JSC::DOMJIT::Effect::forRead(DOMJIT::AbstractHeapRepository::DOM), DOMJIT::IDLResultTypeFilter<IDLBoolean>::value);
    113 
    114 static const JSC::DOMJIT::Signature DOMJITSignatureForTestDOMJITGetElementById((JSC::DOMJIT::FunctionWithoutTypeCheck)jsTestDOMJITPrototypeFunctionGetElementByIdWithoutTypeCheck, JSTestDOMJIT::info(), JSC::DOMJIT::Effect::forRead(DOMJIT::AbstractHeapRepository::DOM), DOMJIT::IDLResultTypeFilter<IDLInterface<Element>>::value, DOMJIT::IDLArgumentTypeFilter<IDLRequiresExistingAtomStringAdaptor<IDLDOMString>>::value);
    115 
    116 static const JSC::DOMJIT::Signature DOMJITSignatureForTestDOMJITGetElementsByName((JSC::DOMJIT::FunctionWithoutTypeCheck)jsTestDOMJITPrototypeFunctionGetElementsByNameWithoutTypeCheck, JSTestDOMJIT::info(), JSC::DOMJIT::Effect::forRead(DOMJIT::AbstractHeapRepository::DOM), DOMJIT::IDLResultTypeFilter<IDLInterface<NodeList>>::value, DOMJIT::IDLArgumentTypeFilter<IDLAtomStringAdaptor<IDLDOMString>>::value);
     108static const JSC::DOMJIT::Signature DOMJITSignatureForTestDOMJITGetAttribute(jsTestDOMJITPrototypeFunctionGetAttributeWithoutTypeCheck, JSTestDOMJIT::info(), JSC::DOMJIT::Effect::forRead(DOMJIT::AbstractHeapRepository::DOM), DOMJIT::IDLResultTypeFilter<IDLNullable<IDLDOMString>>::value, DOMJIT::IDLArgumentTypeFilter<IDLDOMString>::value);
     109
     110static const JSC::DOMJIT::Signature DOMJITSignatureForTestDOMJITItem(jsTestDOMJITPrototypeFunctionItemWithoutTypeCheck, JSTestDOMJIT::info(), JSC::DOMJIT::Effect::forRead(DOMJIT::AbstractHeapRepository::DOM), DOMJIT::IDLResultTypeFilter<IDLDOMString>::value, DOMJIT::IDLArgumentTypeFilter<IDLUnsignedShort>::value, DOMJIT::IDLArgumentTypeFilter<IDLUnsignedShort>::value);
     111
     112static const JSC::DOMJIT::Signature DOMJITSignatureForTestDOMJITHasAttribute(jsTestDOMJITPrototypeFunctionHasAttributeWithoutTypeCheck, JSTestDOMJIT::info(), JSC::DOMJIT::Effect::forRead(DOMJIT::AbstractHeapRepository::DOM), DOMJIT::IDLResultTypeFilter<IDLBoolean>::value);
     113
     114static const JSC::DOMJIT::Signature DOMJITSignatureForTestDOMJITGetElementById(jsTestDOMJITPrototypeFunctionGetElementByIdWithoutTypeCheck, JSTestDOMJIT::info(), JSC::DOMJIT::Effect::forRead(DOMJIT::AbstractHeapRepository::DOM), DOMJIT::IDLResultTypeFilter<IDLInterface<Element>>::value, DOMJIT::IDLArgumentTypeFilter<IDLRequiresExistingAtomStringAdaptor<IDLDOMString>>::value);
     115
     116static const JSC::DOMJIT::Signature DOMJITSignatureForTestDOMJITGetElementsByName(jsTestDOMJITPrototypeFunctionGetElementsByNameWithoutTypeCheck, JSTestDOMJIT::info(), JSC::DOMJIT::Effect::forRead(DOMJIT::AbstractHeapRepository::DOM), DOMJIT::IDLResultTypeFilter<IDLInterface<NodeList>>::value, DOMJIT::IDLArgumentTypeFilter<IDLAtomStringAdaptor<IDLDOMString>>::value);
    117117
    118118static const JSC::DOMJIT::GetterSetter DOMJITAttributeForTestDOMJITAnyAttr {
Note: See TracChangeset for help on using the changeset viewer.