Changeset 239290 in webkit


Ignore:
Timestamp:
Dec 17, 2018 2:46:50 PM (5 years ago)
Author:
mark.lam@apple.com
Message:

Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
​https://bugs.webkit.org/show_bug.cgi?id=192776
<rdar://problem/46772368>

Reviewed by Keith Miller.

JSTests:

  • stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.

Source/JavaScriptCore:

  1. Add some asanUnsafe methods to the Register class.
  2. Update the probe-based OSRExit::executeOSRExit() to use these asanUnsafe methods.
  • dfg/DFGOSRExit.cpp:

(JSC::DFG::OSRExit::executeOSRExit):

  • interpreter/Register.h:

(JSC::Register::asanUnsafeUnboxedInt32 const):
(JSC::Register::asanUnsafeUnboxedInt52 const):
(JSC::Register::asanUnsafeUnboxedStrictInt52 const):
(JSC::Register::asanUnsafeUnboxedDouble const):
(JSC::Register::asanUnsafeUnboxedCell const):

Location:
trunk
Files:
1 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r239287 r239290  
     12018-12-17  Mark Lam  <mark.lam@apple.com>
     2
     3        Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
     4        https://bugs.webkit.org/show_bug.cgi?id=192776
     5        <rdar://problem/46772368>
     6
     7        Reviewed by Keith Miller.
     8
     9        * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.
     10
    1112018-12-17  Mark Lam  <mark.lam@apple.com>
    212

  • trunk/Source/JavaScriptCore/ChangeLog

    r239287 r239290  
     12018-12-17  Mark Lam  <mark.lam@apple.com>
     2
     3        Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
     4        https://bugs.webkit.org/show_bug.cgi?id=192776
     5        <rdar://problem/46772368>
     6
     7        Reviewed by Keith Miller.
     8
     9        1. Add some asanUnsafe methods to the Register class.
     10        2. Update the probe-based OSRExit::executeOSRExit() to use these asanUnsafe methods.
     11
     12        * dfg/DFGOSRExit.cpp:
     13        (JSC::DFG::OSRExit::executeOSRExit):
     14        * interpreter/Register.h:
     15        (JSC::Register::asanUnsafeUnboxedInt32 const):
     16        (JSC::Register::asanUnsafeUnboxedInt52 const):
     17        (JSC::Register::asanUnsafeUnboxedStrictInt52 const):
     18        (JSC::Register::asanUnsafeUnboxedDouble const):
     19        (JSC::Register::asanUnsafeUnboxedCell const):
     20
    1212018-12-17  Mark Lam  <mark.lam@apple.com>
    222

  • trunk/Source/JavaScriptCore/dfg/DFGOSRExit.cpp

    r238414 r239290  
    570570        switch (recovery.technique()) {
    571571        case DisplacedInJSStack:
    572             frame.setOperand(operand, exec->r(recovery.virtualRegister()).jsValue());
     572            frame.setOperand(operand, exec->r(recovery.virtualRegister()).asanUnsafeJSValue());
    573573            break;
    574574
    … …  
    592592
    593593        case CellDisplacedInJSStack:
    594             frame.setOperand(operand, JSValue(exec->r(recovery.virtualRegister()).unboxedCell()));
     594            frame.setOperand(operand, JSValue(exec->r(recovery.virtualRegister()).asanUnsafeUnboxedCell()));
    595595            break;
    596596
    … …  
    603603        case BooleanDisplacedInJSStack:
    604604#if USE(JSVALUE64)
    605             frame.setOperand(operand, exec->r(recovery.virtualRegister()).jsValue());
     605            frame.setOperand(operand, exec->r(recovery.virtualRegister()).asanUnsafeJSValue());
    606606#else
    607             frame.setOperand(operand, jsBoolean(exec->r(recovery.virtualRegister()).jsValue().payload()));
     607            frame.setOperand(operand, jsBoolean(exec->r(recovery.virtualRegister()).asanUnsafeJSValue().payload()));
    608608#endif
    609609            break;
    … …  
    614614
    615615        case Int32DisplacedInJSStack:
    616             frame.setOperand(operand, JSValue(exec->r(recovery.virtualRegister()).unboxedInt32()));
     616            frame.setOperand(operand, JSValue(exec->r(recovery.virtualRegister()).asanUnsafeUnboxedInt32()));
    617617            break;
    618618
    … …  
    623623
    624624        case Int52DisplacedInJSStack:
    625             frame.setOperand(operand, JSValue(exec->r(recovery.virtualRegister()).unboxedInt52()));
     625            frame.setOperand(operand, JSValue(exec->r(recovery.virtualRegister()).asanUnsafeUnboxedInt52()));
    626626            break;
    627627
    … …  
    631631
    632632        case StrictInt52DisplacedInJSStack:
    633             frame.setOperand(operand, JSValue(exec->r(recovery.virtualRegister()).unboxedStrictInt52()));
     633            frame.setOperand(operand, JSValue(exec->r(recovery.virtualRegister()).asanUnsafeUnboxedStrictInt52()));
    634634            break;
    635635#endif
    … …  
    640640
    641641        case DoubleDisplacedInJSStack:
    642             frame.setOperand(operand, JSValue(JSValue::EncodeAsDouble, purifyNaN(exec->r(recovery.virtualRegister()).unboxedDouble())));
     642            frame.setOperand(operand, JSValue(JSValue::EncodeAsDouble, purifyNaN(exec->r(recovery.virtualRegister()).asanUnsafeUnboxedDouble())));
    643643            break;
    644644

  • trunk/Source/JavaScriptCore/interpreter/Register.h

    r235603 r239290  
    6666        JSScope* scope() const;
    6767        int32_t unboxedInt32() const;
     68        int32_t asanUnsafeUnboxedInt32() const;
    6869        int64_t unboxedInt52() const;
     70        int64_t asanUnsafeUnboxedInt52() const;
    6971        int64_t unboxedStrictInt52() const;
     72        int64_t asanUnsafeUnboxedStrictInt52() const;
    7073        bool unboxedBoolean() const;
    7174        double unboxedDouble() const;
     75        double asanUnsafeUnboxedDouble() const;
    7276        JSCell* unboxedCell() const;
     77        JSCell* asanUnsafeUnboxedCell() const;
    7378        int32_t payload() const;
    7479        int32_t tag() const;
    … …  
    171176    }
    172177
     178    SUPPRESS_ASAN ALWAYS_INLINE int32_t Register::asanUnsafeUnboxedInt32() const
     179    {
     180        return unsafePayload();
     181    }
     182
    173183    ALWAYS_INLINE int64_t Register::unboxedInt52() const
    174184    {
    … …  
    176186    }
    177187
     188    SUPPRESS_ASAN ALWAYS_INLINE int64_t Register::asanUnsafeUnboxedInt52() const
     189    {
     190        return u.integer >> JSValue::int52ShiftAmount;
     191    }
     192
    178193    ALWAYS_INLINE int64_t Register::unboxedStrictInt52() const
    179194    {
    … …  
    181196    }
    182197
     198    SUPPRESS_ASAN ALWAYS_INLINE int64_t Register::asanUnsafeUnboxedStrictInt52() const
     199    {
     200        return u.integer;
     201    }
     202
    183203    ALWAYS_INLINE bool Register::unboxedBoolean() const
    184204    {
    … …  
    191211    }
    192212
     213    SUPPRESS_ASAN ALWAYS_INLINE double Register::asanUnsafeUnboxedDouble() const
     214    {
     215        return u.number;
     216    }
     217
    193218    ALWAYS_INLINE JSCell* Register::unboxedCell() const
    194219    {
    … …  
    200225    }
    201226
     227    SUPPRESS_ASAN ALWAYS_INLINE JSCell* Register::asanUnsafeUnboxedCell() const
     228    {
     229#if USE(JSVALUE64)
     230        return u.encodedValue.ptr;
     231#else
     232        return bitwise_cast<JSCell*>(payload());
     233#endif
     234    }
     235
    202236    ALWAYS_INLINE void* Register::pointer() const
    203237    {
Note: See TracChangeset for help on using the changeset viewer.