Changeset 238997 in webkit

Timestamp:

Dec 7, 2018 5:12:57 PM (5 years ago)

Author:

Tadeu Zagallo

Message:

Align the metadata table on all platforms
​https://bugs.webkit.org/show_bug.cgi?id=192050
<rdar://problem/46312674>

Reviewed by Mark Lam.

Although certain platforms don't require the metadata to be aligned,
values were being concurrently read and written to ValueProfiles,
which caused crashes since these operations are not atomic on unaligned
addresses.

• bytecode/Opcode.cpp:

(JSC::metadataAlignment):

• bytecode/Opcode.h:
• bytecode/UnlinkedMetadataTableInlines.h:

(JSC::UnlinkedMetadataTable::finalize):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/Opcode.cpp (modified) (3 diffs)
• bytecode/Opcode.h (modified) (1 diff)
• bytecode/UnlinkedMetadataTableInlines.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-12-07  Tadeu Zagallo  <tzagallo@apple.com>
+
+        Align the metadata table on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=192050
+        <rdar://problem/46312674>
+
+        Reviewed by Mark Lam.
+
+        Although certain platforms don't require the metadata to be aligned,
+        values were being concurrently read and written to ValueProfiles,
+        which caused crashes since these operations are not atomic on unaligned
+        addresses.
+
+        * bytecode/Opcode.cpp:
+        (JSC::metadataAlignment):
+        * bytecode/Opcode.h:
+        * bytecode/UnlinkedMetadataTableInlines.h:
+        (JSC::UnlinkedMetadataTable::finalize):
+
 2018-12-05  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/bytecode/Opcode.cpp

@@ -194 +194 @@
 };
 
-#if CPU(NEEDS_ALIGNED_ACCESS)
 static unsigned metadataAlignments[] = {
 
@@ -202 +201 @@
 
 };
-#endif
 
 unsigned metadataSize(OpcodeID opcodeID)
@@ -209 +207 @@
 }
 
-#if CPU(NEEDS_ALIGNED_ACCESS)
 unsigned metadataAlignment(OpcodeID opcodeID)
 {
     return metadataAlignments[opcodeID];
 }
-#endif
 
 } // namespace JSC

trunk/Source/JavaScriptCore/bytecode/Opcode.h

@@ -252 +252 @@
 
 unsigned metadataSize(OpcodeID);
-#if CPU(NEEDS_ALIGNED_ACCESS)
 unsigned metadataAlignment(OpcodeID);
-#endif
 
 } // namespace JSC

trunk/Source/JavaScriptCore/bytecode/UnlinkedMetadataTableInlines.h

@@ -91 +91 @@
 
         if (numberOfEntries > 0) {
-#if CPU(NEEDS_ALIGNED_ACCESS)
             offset = roundUpToMultipleOf(metadataAlignment(static_cast<OpcodeID>(i)), offset);
-#endif
             buffer()[i] = offset;
             offset += numberOfEntries * metadataSize(static_cast<OpcodeID>(i));