Changeset 168729 in webkit


Ignore:
Timestamp:
May 13, 2014 1:57:07 PM (10 years ago)
Author:
commit-queue@webkit.org
Message:

[Win] Enum type with value zero is compatible with void*, potential cause of crashes.
​https://bugs.webkit.org/show_bug.cgi?id=132772

Patch by ​peavo@outlook.com <​peavo@outlook.com> on 2014-05-13
Reviewed by Geoffrey Garen.

Using the MSVC compiler, an instance of an enum type with value zero, is compatible with void* (see bug 132683 for a code example).
This has caused crashes on Windows on two occasions (bug 132683, and bug 121001).
This patch tries to prevent these type of crashes by using a type with explicit constructors instead of void*.
The void* parameter in the loadDouble and storeDouble methods are replaced with TrustedImmPtr.

  • assembler/MacroAssemblerARM.h:

(JSC::MacroAssemblerARM::loadDouble):
(JSC::MacroAssemblerARM::storeDouble):

  • assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::loadDouble):
(JSC::MacroAssemblerARM64::storeDouble):

  • assembler/MacroAssemblerARMv7.h:

(JSC::MacroAssemblerARMv7::loadDouble):
(JSC::MacroAssemblerARMv7::storeDouble):

  • assembler/MacroAssemblerMIPS.h:

(JSC::MacroAssemblerMIPS::loadDouble):
(JSC::MacroAssemblerMIPS::storeDouble):

  • assembler/MacroAssemblerSH4.h:

(JSC::MacroAssemblerSH4::loadDouble):
(JSC::MacroAssemblerSH4::storeDouble):

  • assembler/MacroAssemblerX86.h:

(JSC::MacroAssemblerX86::storeDouble):

  • assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::absDouble):
(JSC::MacroAssemblerX86Common::negateDouble):
(JSC::MacroAssemblerX86Common::loadDouble):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::silentFill):
(JSC::DFG::compileClampDoubleToByte):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::compile):

  • jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::purifyNaN):

  • jit/JITInlines.h:

(JSC::JIT::emitLoadDouble):

  • jit/JITPropertyAccess.cpp:

(JSC::JIT::emitFloatTypedArrayGetByVal):

  • jit/ThunkGenerators.cpp:

(JSC::floorThunkGenerator):
(JSC::roundThunkGenerator):
(JSC::powThunkGenerator):

Location:
trunk/Source/JavaScriptCore
Files:
14 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r168649 r168729  
     12014-05-13  peavo@outlook.com  <peavo@outlook.com>
     2
     3        [Win] Enum type with value zero is compatible with void*, potential cause of crashes.
     4        https://bugs.webkit.org/show_bug.cgi?id=132772
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        Using the MSVC compiler, an instance of an enum type with value zero, is compatible with void* (see bug 132683 for a code example).
     9        This has caused crashes on Windows on two occasions (bug 132683, and bug 121001).
     10        This patch tries to prevent these type of crashes by using a type with explicit constructors instead of void*.
     11        The void* parameter in the loadDouble and storeDouble methods are replaced with TrustedImmPtr.
     12
     13        * assembler/MacroAssemblerARM.h:
     14        (JSC::MacroAssemblerARM::loadDouble):
     15        (JSC::MacroAssemblerARM::storeDouble):
     16        * assembler/MacroAssemblerARM64.h:
     17        (JSC::MacroAssemblerARM64::loadDouble):
     18        (JSC::MacroAssemblerARM64::storeDouble):
     19        * assembler/MacroAssemblerARMv7.h:
     20        (JSC::MacroAssemblerARMv7::loadDouble):
     21        (JSC::MacroAssemblerARMv7::storeDouble):
     22        * assembler/MacroAssemblerMIPS.h:
     23        (JSC::MacroAssemblerMIPS::loadDouble):
     24        (JSC::MacroAssemblerMIPS::storeDouble):
     25        * assembler/MacroAssemblerSH4.h:
     26        (JSC::MacroAssemblerSH4::loadDouble):
     27        (JSC::MacroAssemblerSH4::storeDouble):
     28        * assembler/MacroAssemblerX86.h:
     29        (JSC::MacroAssemblerX86::storeDouble):
     30        * assembler/MacroAssemblerX86Common.h:
     31        (JSC::MacroAssemblerX86Common::absDouble):
     32        (JSC::MacroAssemblerX86Common::negateDouble):
     33        (JSC::MacroAssemblerX86Common::loadDouble):
     34        * dfg/DFGSpeculativeJIT.cpp:
     35        (JSC::DFG::SpeculativeJIT::silentFill):
     36        (JSC::DFG::compileClampDoubleToByte):
     37        * dfg/DFGSpeculativeJIT32_64.cpp:
     38        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
     39        (JSC::DFG::SpeculativeJIT::compile):
     40        * jit/AssemblyHelpers.cpp:
     41        (JSC::AssemblyHelpers::purifyNaN):
     42        * jit/JITInlines.h:
     43        (JSC::JIT::emitLoadDouble):
     44        * jit/JITPropertyAccess.cpp:
     45        (JSC::JIT::emitFloatTypedArrayGetByVal):
     46        * jit/ThunkGenerators.cpp:
     47        (JSC::floorThunkGenerator):
     48        (JSC::roundThunkGenerator):
     49        (JSC::powThunkGenerator):
     50
    1512014-05-12  Commit Queue  <commit-queue@webkit.org>
    252

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM.h

    r168649 r168729  
    11221122    }
    11231123
    1124     void loadDouble(const void* address, FPRegisterID dest)
    1125     {
    1126         move(TrustedImm32(reinterpret_cast<ARMWord>(address)), ARMRegisters::S0);
     1124    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
     1125    {
     1126        move(TrustedImm32(reinterpret_cast<ARMWord>(address.m_value)), ARMRegisters::S0);
    11271127        m_assembler.doubleDtrUp(ARMAssembler::LoadDouble, dest, ARMRegisters::S0, 0);
    11281128    }
    … …  
    11431143    }
    11441144
    1145     void storeDouble(FPRegisterID src, const void* address)
    1146     {
    1147         move(TrustedImm32(reinterpret_cast<ARMWord>(address)), ARMRegisters::S0);
     1145    void storeDouble(FPRegisterID src, TrustedImmPtr address)
     1146    {
     1147        move(TrustedImm32(reinterpret_cast<ARMWord>(address.m_value)), ARMRegisters::S0);
    11481148        m_assembler.dataTransferFloat(ARMAssembler::StoreDouble, src, ARMRegisters::S0, 0);
    11491149    }
    … …  
    11731173    void addDouble(AbsoluteAddress address, FPRegisterID dest)
    11741174    {
    1175         loadDouble(address.m_ptr, ARMRegisters::SD0);
     1175        loadDouble(TrustedImmPtr(address.m_ptr), ARMRegisters::SD0);
    11761176        addDouble(ARMRegisters::SD0, dest);
    11771177    }

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h

    r168649 r168729  
    11571157    void addDouble(AbsoluteAddress address, FPRegisterID dest)
    11581158    {
    1159         loadDouble(address.m_ptr, fpTempRegister);
     1159        loadDouble(TrustedImmPtr(address.m_ptr), fpTempRegister);
    11601160        addDouble(fpTempRegister, dest);
    11611161    }
    … …  
    13111311    }
    13121312   
    1313     void loadDouble(const void* address, FPRegisterID dest)
    1314     {
    1315         moveToCachedReg(TrustedImmPtr(address), m_cachedMemoryTempRegister);
     1313    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
     1314    {
     1315        moveToCachedReg(address, m_cachedMemoryTempRegister);
    13161316        m_assembler.ldr<64>(dest, memoryTempRegister, ARM64Registers::zr);
    13171317    }
    … …  
    13791379    }
    13801380
    1381     void storeDouble(FPRegisterID src, const void* address)
    1382     {
    1383         moveToCachedReg(TrustedImmPtr(address), m_cachedMemoryTempRegister);
     1381    void storeDouble(FPRegisterID src, TrustedImmPtr address)
     1382    {
     1383        moveToCachedReg(address, m_cachedMemoryTempRegister);
    13841384        m_assembler.str<64>(src, memoryTempRegister, ARM64Registers::zr);
    13851385    }

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h

    r168649 r168729  
    876876    }
    877877
    878     void loadDouble(const void* address, FPRegisterID dest)
    879     {
    880         move(TrustedImmPtr(address), addressTempRegister);
     878    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
     879    {
     880        move(address, addressTempRegister);
    881881        m_assembler.vldr(dest, addressTempRegister, 0);
    882882    }
    … …  
    912912    }
    913913
    914     void storeDouble(FPRegisterID src, const void* address)
    915     {
    916         move(TrustedImmPtr(address), addressTempRegister);
     914    void storeDouble(FPRegisterID src, TrustedImmPtr address)
     915    {
     916        move(address, addressTempRegister);
    917917        storeDouble(src, addressTempRegister);
    918918    }
    … …  
    952952    void addDouble(AbsoluteAddress address, FPRegisterID dest)
    953953    {
    954         loadDouble(address.m_ptr, fpTempRegister);
     954        loadDouble(TrustedImmPtr(address.m_ptr), fpTempRegister);
    955955        m_assembler.vadd(dest, dest, fpTempRegister);
    956956    }

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h

    r168649 r168729  
    22692269    }
    22702270
    2271     void loadDouble(const void* address, FPRegisterID dest)
     2271    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
    22722272    {
    22732273#if WTF_MIPS_ISA(1)
    … …  
    22772277            lwc1        dest+1, 4(addrTemp)
    22782278         */
    2279         move(TrustedImmPtr(address), addrTempRegister);
     2279        move(address, addrTempRegister);
    22802280        m_assembler.lwc1(dest, addrTempRegister, 0);
    22812281        m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, 4);
    … …  
    22852285            ldc1        dest, 0(addrTemp)
    22862286        */
    2287         move(TrustedImmPtr(address), addrTempRegister);
     2287        move(address, addrTempRegister);
    22882288        m_assembler.ldc1(dest, addrTempRegister, 0);
    22892289#endif
    … …  
    24072407    }
    24082408
    2409     void storeDouble(FPRegisterID src, const void* address)
     2409    void storeDouble(FPRegisterID src, TrustedImmPtr address)
    24102410    {
    24112411#if WTF_MIPS_ISA(1)
    2412         move(TrustedImmPtr(address), addrTempRegister);
     2412        move(address, addrTempRegister);
    24132413        m_assembler.swc1(src, addrTempRegister, 0);
    24142414        m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, 4);
    24152415#else
    2416         move(TrustedImmPtr(address), addrTempRegister);
     2416        move(address, addrTempRegister);
    24172417        m_assembler.sdc1(src, addrTempRegister, 0);
    24182418#endif
    … …  
    24502450    void addDouble(AbsoluteAddress address, FPRegisterID dest)
    24512451    {
    2452         loadDouble(address.m_ptr, fpTempRegister);
     2452        loadDouble(TrustedImmPtr(address.m_ptr), fpTempRegister);
    24532453        m_assembler.addd(dest, dest, fpTempRegister);
    24542454    }

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h

    r168649 r168729  
    11561156    }
    11571157
    1158     void loadDouble(const void* address, FPRegisterID dest)
    1159     {
    1160         RegisterID scr = claimScratch();
    1161         move(TrustedImmPtr(address), scr);
     1158    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
     1159    {
     1160        RegisterID scr = claimScratch();
     1161        move(address, scr);
    11621162        m_assembler.fmovsReadrminc(scr, (FPRegisterID)(dest + 1));
    11631163        m_assembler.fmovsReadrm(scr, dest);
    … …  
    12051205    }
    12061206
    1207     void storeDouble(FPRegisterID src, const void* address)
    1208     {
    1209         RegisterID scr = claimScratch();
    1210         m_assembler.loadConstant(reinterpret_cast<uint32_t>(const_cast<void*>(address)) + 8, scr);
     1207    void storeDouble(FPRegisterID src, TrustedImmPtr address)
     1208    {
     1209        RegisterID scr = claimScratch();
     1210        m_assembler.loadConstant(reinterpret_cast<uint32_t>(const_cast<void*>(address.m_value)) + 8, scr);
    12111211        m_assembler.fmovsWriterndec(src, scr);
    12121212        m_assembler.fmovsWriterndec((FPRegisterID)(src + 1), scr);
    … …  
    12211221    void addDouble(AbsoluteAddress address, FPRegisterID dest)
    12221222    {
    1223         loadDouble(address.m_ptr, fscratch);
     1223        loadDouble(TrustedImmPtr(address.m_ptr), fscratch);
    12241224        addDouble(fscratch, dest);
    12251225    }

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86.h

    r168649 r168729  
    124124    }
    125125
    126     void storeDouble(FPRegisterID src, const void* address)
     126    void storeDouble(FPRegisterID src, TrustedImmPtr address)
    127127    {
    128128        ASSERT(isSSE2Present());
    129         ASSERT(address);
    130         m_assembler.movsd_rm(src, address);
     129        ASSERT(address.m_value);
     130        m_assembler.movsd_rm(src, address.m_value);
    131131    }
    132132

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h

    r168649 r168729  
    449449        ASSERT(src != dst);
    450450        static const double negativeZeroConstant = -0.0;
    451         loadDouble(&negativeZeroConstant, dst);
     451        loadDouble(TrustedImmPtr(&negativeZeroConstant), dst);
    452452        m_assembler.andnpd_rr(src, dst);
    453453    }
    … …  
    457457        ASSERT(src != dst);
    458458        static const double negativeZeroConstant = -0.0;
    459         loadDouble(&negativeZeroConstant, dst);
     459        loadDouble(TrustedImmPtr(&negativeZeroConstant), dst);
    460460        m_assembler.xorpd_rr(src, dst);
    461461    }
    … …  
    685685    }
    686686
    687     void loadDouble(const void* address, FPRegisterID dest)
     687    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
    688688    {
    689689#if CPU(X86)
    690690        ASSERT(isSSE2Present());
    691         m_assembler.movsd_mr(address, dest);
     691        m_assembler.movsd_mr(address.m_value, dest);
    692692#else
    693         move(TrustedImmPtr(address), scratchRegister);
     693        move(address, scratchRegister);
    694694        loadDouble(scratchRegister, dest);
    695695#endif

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r168649 r168729  
    554554        break;
    555555    case SetDoubleConstant:
    556         m_jit.loadDouble(addressOfDoubleConstant(plan.node()), plan.fpr());
     556        m_jit.loadDouble(TrustedImmPtr(addressOfDoubleConstant(plan.node())), plan.fpr());
    557557        break;
    558558#endif
    … …  
    22552255    static const double byteMax = 255;
    22562256    static const double half = 0.5;
    2257     jit.loadDouble(&zero, scratch);
     2257    jit.loadDouble(MacroAssembler::TrustedImmPtr(&zero), scratch);
    22582258    MacroAssembler::Jump tooSmall = jit.branchDouble(MacroAssembler::DoubleLessThanOrEqualOrUnordered, source, scratch);
    2259     jit.loadDouble(&byteMax, scratch);
     2259    jit.loadDouble(MacroAssembler::TrustedImmPtr(&byteMax), scratch);
    22602260    MacroAssembler::Jump tooBig = jit.branchDouble(MacroAssembler::DoubleGreaterThan, source, scratch);
    22612261   
    2262     jit.loadDouble(&half, scratch);
     2262    jit.loadDouble(MacroAssembler::TrustedImmPtr(&half), scratch);
    22632263    // FIXME: This should probably just use a floating point round!
    22642264    // https://bugs.webkit.org/show_bug.cgi?id=72054

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r168649 r168729  
    837837            RELEASE_ASSERT(isNumberConstant(edge.node()));
    838838            FPRReg fpr = fprAllocate();
    839             m_jit.loadDouble(addressOfDoubleConstant(edge.node()), fpr);
     839            m_jit.loadDouble(TrustedImmPtr(addressOfDoubleConstant(edge.node())), fpr);
    840840            m_fprs.retain(fpr, virtualRegister, SpillOrderConstant);
    841841            info.fillDouble(*m_stream, fpr);
    … …  
    31273127                    m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));
    31283128               
    3129                 m_jit.storeDouble(opFPR, reinterpret_cast<char*>(buffer + operandIdx));
     3129                m_jit.storeDouble(opFPR, TrustedImmPtr(reinterpret_cast<char*>(buffer + operandIdx)));
    31303130                break;
    31313131            }

  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp

    r168649 r168729  
    5959    MacroAssembler::Jump notNaN = branchDouble(DoubleEqual, fpr, fpr);
    6060    static const double NaN = PNaN;
    61     loadDouble(&NaN, fpr);
     61    loadDouble(TrustedImmPtr(&NaN), fpr);
    6262    notNaN.link(this);
    6363}

  • trunk/Source/JavaScriptCore/jit/JITInlines.h

    r168649 r168729  
    817817    if (m_codeBlock->isConstantRegisterIndex(index)) {
    818818        WriteBarrier<Unknown>& inConstantPool = m_codeBlock->constantRegister(index);
    819         loadDouble(&inConstantPool, value);
     819        loadDouble(TrustedImmPtr(&inConstantPool), value);
    820820    } else
    821821        loadDouble(addressFor(index), value);
    … …  
    10171017    if (m_codeBlock->isConstantRegisterIndex(index)) {
    10181018        WriteBarrier<Unknown>& inConstantPool = m_codeBlock->constantRegister(index);
    1019         loadDouble(&inConstantPool, value);
     1019        loadDouble(TrustedImmPtr(&inConstantPool), value);
    10201020    } else
    10211021        loadDouble(addressFor(index), value);

  • trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

    r168649 r168729  
    12411241    Jump notNaN = branchDouble(DoubleEqual, fpRegT0, fpRegT0);
    12421242    static const double NaN = PNaN;
    1243     loadDouble(&NaN, fpRegT0);
     1243    loadDouble(TrustedImmPtr(&NaN), fpRegT0);
    12441244    notNaN.link(this);
    12451245   

  • trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp

    r168649 r168729  
    741741    SpecializedThunkJIT::JumpList doubleResult;
    742742    if (jit.supportsFloatingPointTruncate()) {
    743         jit.loadDouble(&zeroConstant, SpecializedThunkJIT::fpRegT1);
     743        jit.loadDouble(MacroAssembler::TrustedImmPtr(&zeroConstant), SpecializedThunkJIT::fpRegT1);
    744744        doubleResult.append(jit.branchDouble(MacroAssembler::DoubleEqual, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1));
    745745        SpecializedThunkJIT::JumpList slowPath;
    … …  
    797797    SpecializedThunkJIT::JumpList doubleResult;
    798798    if (jit.supportsFloatingPointTruncate()) {
    799         jit.loadDouble(&zeroConstant, SpecializedThunkJIT::fpRegT1);
     799        jit.loadDouble(MacroAssembler::TrustedImmPtr(&zeroConstant), SpecializedThunkJIT::fpRegT1);
    800800        doubleResult.append(jit.branchDouble(MacroAssembler::DoubleEqual, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1));
    801801        SpecializedThunkJIT::JumpList slowPath;
    802802        // Handle the negative doubles in the slow path for now.
    803803        slowPath.append(jit.branchDouble(MacroAssembler::DoubleLessThanOrUnordered, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1));
    804         jit.loadDouble(&halfConstant, SpecializedThunkJIT::fpRegT1);
     804        jit.loadDouble(MacroAssembler::TrustedImmPtr(&halfConstant), SpecializedThunkJIT::fpRegT1);
    805805        jit.addDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1);
    806806        slowPath.append(jit.branchTruncateDoubleToInt32(SpecializedThunkJIT::fpRegT1, SpecializedThunkJIT::regT0));
    … …  
    870870        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
    871871
    872     jit.loadDouble(&oneConstant, SpecializedThunkJIT::fpRegT1);
     872    jit.loadDouble(MacroAssembler::TrustedImmPtr(&oneConstant), SpecializedThunkJIT::fpRegT1);
    873873    jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
    874874    MacroAssembler::Jump nonIntExponent;
    … …  
    898898    if (jit.supportsFloatingPointSqrt()) {
    899899        nonIntExponent.link(&jit);
    900         jit.loadDouble(&negativeHalfConstant, SpecializedThunkJIT::fpRegT3);
     900        jit.loadDouble(MacroAssembler::TrustedImmPtr(&negativeHalfConstant), SpecializedThunkJIT::fpRegT3);
    901901        jit.loadDoubleArgument(1, SpecializedThunkJIT::fpRegT2, SpecializedThunkJIT::regT0);
    902902        jit.appendFailure(jit.branchDouble(MacroAssembler::DoubleLessThanOrEqual, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1));
Note: See TracChangeset for help on using the changeset viewer.