Changeset 221439 in webkit


Ignore:
Timestamp:
Aug 31, 2017 1:46:58 PM (7 years ago)
Author:
fpizlo@apple.com
Message:

All of the different ArrayBuffer::data's should be CagedPtr<>
​https://bugs.webkit.org/show_bug.cgi?id=175515

Reviewed by Michael Saboff.

Source/JavaScriptCore:

This straightforwardly implements what the title says.

  • runtime/ArrayBuffer.cpp:

(JSC::SharedArrayBufferContents::~SharedArrayBufferContents):
(JSC::ArrayBufferContents::destroy):
(JSC::ArrayBufferContents::tryAllocate):
(JSC::ArrayBufferContents::makeShared):
(JSC::ArrayBufferContents::copyTo):
(JSC::ArrayBuffer::createFromBytes):
(JSC::ArrayBuffer::transferTo):

  • runtime/ArrayBuffer.h:

(JSC::SharedArrayBufferContents::data const):
(JSC::ArrayBufferContents::data const):
(JSC::ArrayBuffer::data):
(JSC::ArrayBuffer::data const):

  • runtime/ArrayBufferView.h:

(JSC::ArrayBufferView::baseAddress const):

  • runtime/CagedBarrierPtr.h: Added a specialization so that CagedBarrierPtr<Gigacage::Foo, void> is valid.
  • runtime/DataView.h:

(JSC::DataView::get):
(JSC::DataView::set):

  • runtime/JSArrayBufferView.cpp:

(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):

  • runtime/JSArrayBufferView.h:

(JSC::JSArrayBufferView::ConstructionContext::vector const):
(JSC::JSArrayBufferView::vector const):

  • runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):

Source/WTF:

Added a specialization so that CagedPtr<void> is valid.

  • wtf/CagedPtr.h:
Location:
trunk
Files:
12 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/stress/dont-reserve-huge-capacity-lexer.js

    r219065 r221439  
    1 //@ skip if ($architecture != "x86-64") or $memoryLimited
     1//@ if ($architecture != "x86-64") or $memoryLimited then skip else runDefault end
    22
    33var fe="f";                                                                         

  • trunk/Source/JavaScriptCore/ChangeLog

    r221422 r221439  
     12017-08-31  Filip Pizlo  <fpizlo@apple.com>
     2
     3        All of the different ArrayBuffer::data's should be CagedPtr<>
     4        https://bugs.webkit.org/show_bug.cgi?id=175515
     5
     6        Reviewed by Michael Saboff.
     7       
     8        This straightforwardly implements what the title says.
     9
     10        * runtime/ArrayBuffer.cpp:
     11        (JSC::SharedArrayBufferContents::~SharedArrayBufferContents):
     12        (JSC::ArrayBufferContents::destroy):
     13        (JSC::ArrayBufferContents::tryAllocate):
     14        (JSC::ArrayBufferContents::makeShared):
     15        (JSC::ArrayBufferContents::copyTo):
     16        (JSC::ArrayBuffer::createFromBytes):
     17        (JSC::ArrayBuffer::transferTo):
     18        * runtime/ArrayBuffer.h:
     19        (JSC::SharedArrayBufferContents::data const):
     20        (JSC::ArrayBufferContents::data const):
     21        (JSC::ArrayBuffer::data):
     22        (JSC::ArrayBuffer::data const):
     23        * runtime/ArrayBufferView.h:
     24        (JSC::ArrayBufferView::baseAddress const):
     25        * runtime/CagedBarrierPtr.h: Added a specialization so that CagedBarrierPtr<Gigacage::Foo, void> is valid.
     26        * runtime/DataView.h:
     27        (JSC::DataView::get):
     28        (JSC::DataView::set):
     29        * runtime/JSArrayBufferView.cpp:
     30        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
     31        * runtime/JSArrayBufferView.h:
     32        (JSC::JSArrayBufferView::ConstructionContext::vector const):
     33        (JSC::JSArrayBufferView::vector const):
     34        * runtime/JSGenericTypedArrayViewInlines.h:
     35        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
     36
    1372017-08-22  Filip Pizlo  <fpizlo@apple.com>
    238

  • trunk/Source/JavaScriptCore/runtime/ArrayBuffer.cpp

    r220601 r221439  
    4242SharedArrayBufferContents::~SharedArrayBufferContents()
    4343{
    44     m_destructor(m_data);
     44    m_destructor(m_data.getMayBeNull());
    4545}
    4646
    … …  
    8282void ArrayBufferContents::destroy()
    8383{
    84     m_destructor(m_data);
     84    m_destructor(m_data.getMayBeNull());
    8585}
    8686
    … …  
    114114   
    115115    if (policy == ZeroInitialize)
    116         memset(m_data, 0, size);
     116        memset(m_data.get(), 0, size);
    117117
    118118    m_sizeInBytes = numElements * elementByteSize;
    … …  
    122122void ArrayBufferContents::makeShared()
    123123{
    124     m_shared = adoptRef(new SharedArrayBufferContents(m_data, WTFMove(m_destructor)));
     124    m_shared = adoptRef(new SharedArrayBufferContents(m_data.getMayBeNull(), WTFMove(m_destructor)));
    125125    m_destructor = [] (void*) { };
    126126}
    … …  
    142142    if (!other.m_data)
    143143        return;
    144     memcpy(other.m_data, m_data, m_sizeInBytes);
     144    memcpy(other.m_data.get(), m_data.get(), m_sizeInBytes);
    145145    other.m_sizeInBytes = m_sizeInBytes;
    146146}
    … …  
    199199Ref<ArrayBuffer> ArrayBuffer::createFromBytes(const void* data, unsigned byteLength, ArrayBufferDestructorFunction&& destructor)
    200200{
    201     if (data && byteLength && !Gigacage::isCaged(Gigacage::Primitive, data))
     201    if (data && !Gigacage::isCaged(Gigacage::Primitive, data))
    202202        Gigacage::disablePrimitiveGigacage();
    203203   
    … …  
    323323
    324324    if (!m_contents.m_data) {
    325         result.m_data = 0;
     325        result.m_data = nullptr;
    326326        return false;
    327327    }

  • trunk/Source/JavaScriptCore/runtime/ArrayBuffer.h

    r220628 r221439  
    11/*
    2  * Copyright (C) 2009, 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2009-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2929#include "GCIncomingRefCounted.h"
    3030#include "Weak.h"
     31#include <wtf/CagedPtr.h>
    3132#include <wtf/Function.h>
    3233#include <wtf/StdLibExtras.h>
    … …  
    4849    ~SharedArrayBufferContents();
    4950   
    50     void* data() const { return m_data; }
     51    void* data() const { return m_data.getMayBeNull(); }
    5152   
    5253private:
    53     // FIXME: This should be CagedPtr<>.
    54     // https://bugs.webkit.org/show_bug.cgi?id=175515
    55     void* m_data;
     54    CagedPtr<Gigacage::Primitive, void> m_data;
    5655    ArrayBufferDestructorFunction m_destructor;
    5756};
    … …  
    7170    explicit operator bool() { return !!m_data; }
    7271   
    73     void* data() const { return m_data; }
     72    void* data() const { return m_data.getMayBeNull(); }
    7473    unsigned sizeInBytes() const { return m_sizeInBytes; }
    7574   
    … …  
    9897    ArrayBufferDestructorFunction m_destructor;
    9998    RefPtr<SharedArrayBufferContents> m_shared;
    100     // FIXME: This should be CagedPtr<>.
    101     // https://bugs.webkit.org/show_bug.cgi?id=175515
    102     void* m_data;
     99    CagedPtr<Gigacage::Primitive, void> m_data;
    103100    unsigned m_sizeInBytes;
    104101};
    … …  
    186183void* ArrayBuffer::data()
    187184{
    188     return m_contents.m_data;
     185    return m_contents.m_data.getMayBeNull();
    189186}
    190187
    191188const void* ArrayBuffer::data() const
    192189{
    193     return m_contents.m_data;
     190    return m_contents.m_data.getMayBeNull();
    194191}
    195192

  • trunk/Source/JavaScriptCore/runtime/ArrayBufferView.h

    r220628 r221439  
    11/*
    2  * Copyright (C) 2009, 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2009-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    7373        if (isNeutered())
    7474            return 0;
    75         return m_baseAddress;
     75        return m_baseAddress.getMayBeNull();
    7676    }
    7777
    … …  
    148148
    149149    // This is the address of the ArrayBuffer's storage, plus the byte offset.
    150     // FIXME: This should be CagedPtr<>.
    151     // https://bugs.webkit.org/show_bug.cgi?id=175515
    152     void* m_baseAddress;
     150    CagedPtr<Gigacage::Primitive, void> m_baseAddress;
    153151
    154152    unsigned m_byteOffset : 31;

  • trunk/Source/JavaScriptCore/runtime/CagedBarrierPtr.h

    r220352 r221439  
    8989};
    9090
     91template<Gigacage::Kind passedKind>
     92class CagedBarrierPtr<passedKind, void> {
     93public:
     94    static constexpr Gigacage::Kind kind = passedKind;
     95    typedef void Type;
     96   
     97    CagedBarrierPtr() { }
     98   
     99    template<typename U>
     100    CagedBarrierPtr(VM& vm, JSCell* cell, U&& value)
     101    {
     102        m_barrier.set(vm, cell, std::forward<U>(value));
     103    }
     104   
     105    void clear() { m_barrier.clear(); }
     106   
     107    template<typename U>
     108    void set(VM& vm, JSCell* cell, U&& value)
     109    {
     110        m_barrier.set(vm, cell, std::forward<U>(value));
     111    }
     112   
     113    void* get() const { return m_barrier.get().get(); }
     114    void* getMayBeNull() const { return m_barrier.get().getMayBeNull(); }
     115   
     116    bool operator==(const CagedBarrierPtr& other) const
     117    {
     118        return getMayBeNull() == other.getMayBeNull();
     119    }
     120   
     121    bool operator!=(const CagedBarrierPtr& other) const
     122    {
     123        return !(*this == other);
     124    }
     125   
     126    explicit operator bool() const
     127    {
     128        return *this != CagedBarrierPtr();
     129    }
     130   
     131    template<typename U>
     132    void setWithoutBarrier(U&& value) { m_barrier.setWithoutBarrier(std::forward<U>(value)); }
     133   
     134private:
     135    AuxiliaryBarrier<CagedPtr<kind, void>> m_barrier;
     136};
     137
    91138} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/DataView.h

    r212535 r221439  
    11/*
    2  * Copyright (C) 2013 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    6363            ASSERT_WITH_SECURITY_IMPLICATION(offset + sizeof(T) <= byteLength());
    6464        return flipBytesIfLittleEndian(
    65             *reinterpret_cast<T*>(static_cast<uint8_t*>(m_baseAddress) + offset),
     65            *reinterpret_cast<T*>(static_cast<uint8_t*>(m_baseAddress.get()) + offset),
    6666            littleEndian);
    6767    }
    … …  
    8787        } else
    8888            ASSERT_WITH_SECURITY_IMPLICATION(offset + sizeof(T) <= byteLength());
    89         *reinterpret_cast<T*>(static_cast<uint8_t*>(m_baseAddress) + offset) =
     89        *reinterpret_cast<T*>(static_cast<uint8_t*>(m_baseAddress.get()) + offset) =
    9090            flipBytesIfLittleEndian(value, littleEndian);
    9191    }

  • trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp

    r220352 r221439  
    7878
    7979        if (mode == ZeroFill) {
    80             uint64_t* asWords = static_cast<uint64_t*>(m_vector);
     80            uint64_t* asWords = static_cast<uint64_t*>(m_vector.get());
    8181            for (unsigned i = size / sizeof(uint64_t); i--;)
    8282                asWords[i] = 0;
    … …  
    9595        return;
    9696    if (mode == ZeroFill)
    97         memset(m_vector, 0, size);
     97        memset(m_vector.get(), 0, size);
    9898   
    9999    vm.heap.reportExtraMemoryAllocated(static_cast<size_t>(length) * elementSize);

  • trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h

    r220628 r221439  
    134134       
    135135        Structure* structure() const { return m_structure; }
    136         void* vector() const { return m_vector; }
     136        void* vector() const { return m_vector.getMayBeNull(); }
    137137        uint32_t length() const { return m_length; }
    138138        TypedArrayMode mode() const { return m_mode; }
    … …  
    141141    private:
    142142        Structure* m_structure;
    143         // FIXME: This should be CagedPtr<>.
    144         // https://bugs.webkit.org/show_bug.cgi?id=175515
    145         void* m_vector;
     143        CagedPtr<Gigacage::Primitive, void> m_vector;
    146144        uint32_t m_length;
    147145        TypedArrayMode m_mode;
    … …  
    170168    void neuter();
    171169   
    172     void* vector() const { return m_vector.get(); }
     170    void* vector() const { return m_vector.getMayBeNull(); }
    173171   
    174172    unsigned byteOffset();
    … …  
    193191    static String toStringName(const JSObject*, ExecState*);
    194192
    195     // FIXME: This should be CagedBarrierPtr<>.
    196     // https://bugs.webkit.org/show_bug.cgi?id=175515
    197     AuxiliaryBarrier<void*> m_vector;
     193    CagedBarrierPtr<Gigacage::Primitive, void> m_vector;
    198194    uint32_t m_length;
    199195    TypedArrayMode m_mode;

  • trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h

    r220377 r221439  
    518518    switch (thisObject->m_mode) {
    519519    case FastTypedArray: {
    520         if (void* vector = thisObject->m_vector.get())
     520        if (void* vector = thisObject->m_vector.getMayBeNull())
    521521            visitor.markAuxiliary(vector);
    522522        break;

  • trunk/Source/WTF/ChangeLog

    r221425 r221439  
     12017-08-31  Filip Pizlo  <fpizlo@apple.com>
     2
     3        All of the different ArrayBuffer::data's should be CagedPtr<>
     4        https://bugs.webkit.org/show_bug.cgi?id=175515
     5
     6        Reviewed by Michael Saboff.
     7       
     8        Added a specialization so that CagedPtr<void> is valid.
     9
     10        * wtf/CagedPtr.h:
     11
    1122017-08-31  Per Arne Vollan  <pvollan@apple.com>
    213

  • trunk/Source/WTF/wtf/CagedPtr.h

    r220712 r221439  
    7878};
    7979
     80template<Gigacage::Kind passedKind>
     81class CagedPtr<passedKind, void> {
     82public:
     83    static constexpr Gigacage::Kind kind = passedKind;
     84   
     85    CagedPtr(void* ptr = nullptr)
     86        : m_ptr(ptr)
     87    {
     88    }
     89   
     90    void* get() const
     91    {
     92        ASSERT(m_ptr);
     93        return Gigacage::caged(kind, m_ptr);
     94    }
     95   
     96    void* getMayBeNull() const
     97    {
     98        if (!m_ptr)
     99            return nullptr;
     100        return get();
     101    }
     102   
     103    bool operator==(const CagedPtr& other) const
     104    {
     105        return getMayBeNull() == other.getMayBeNull();
     106    }
     107   
     108    bool operator!=(const CagedPtr& other) const
     109    {
     110        return !(*this == other);
     111    }
     112   
     113    explicit operator bool() const
     114    {
     115        return *this != CagedPtr();
     116    }
     117   
     118protected:
     119    void* m_ptr;
     120};
     121
    80122} // namespace WTF
    81123
Note: See TracChangeset for help on using the changeset viewer.