Changeset 177284 in webkit for trunk/Source/JavaScriptCore/ftl

Timestamp:

Dec 15, 2014, 10:04:58 AM (10 years ago)

Author:

[email protected]

Message:

Make sure range based iteration of Vector<> still receives bounds checking
​https://bugs.webkit.org/show_bug.cgi?id=138821

Reviewed by Mark Lam.

Source/JavaScriptCore:

Update code to deal with slightly changed iterator semantics.

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::visitChildren):

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitComplexPopScopes):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::emitSwitchIntJump):

• ftl/FTLAbbreviations.h:

(JSC::FTL::mdNode):
(JSC::FTL::buildCall):

• llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

• parser/Parser.h:

(JSC::Scope::Scope):

• runtime/JSArray.cpp:

(JSC::JSArray::setLengthWithArrayStorage):
(JSC::JSArray::sortCompactedVector):

• tools/ProfileTreeNode.h:

(JSC::ProfileTreeNode::dumpInternal):

• yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::matchCharacterClass):

Source/WebCore:

Update to deal with different iterator type.

• bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneDeserializer::deserializeString):

• editing/TextIterator.cpp:

(WebCore::SearchBuffer::isBadMatch):

• page/mac/ServicesOverlayController.mm:

(WebCore::ServicesOverlayController::buildSelectionHighlight):

• platform/graphics/SegmentedFontData.cpp:

(WebCore::SegmentedFontData::fontDataForCharacter):
(WebCore::SegmentedFontData::containsCharacter):
(WebCore::SegmentedFontData::isLoading):

• platform/graphics/WOFFFileFormat.cpp:

(WebCore::convertWOFFToSfnt):

• platform/graphics/cairo/GradientCairo.cpp:

(WebCore::Gradient::platformGradient):

• platform/image-decoders/gif/GIFImageDecoder.cpp:

(WebCore::GIFImageDecoder::clearFrameBufferCache):

• rendering/RenderBox.cpp:

(WebCore::RenderBox::paintFillLayers):

• rendering/style/GridResolvedPosition.cpp:

(WebCore::firstNamedGridLineBeforePosition):
(WebCore::GridResolvedPosition::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):

• svg/SVGFontElement.cpp:

(WebCore::kerningForPairOfStringsAndGlyphs):

• svg/SVGPathByteStream.h:

(WebCore::SVGPathByteStream::append):

• xml/XPathNodeSet.h:

(WebCore::XPath::NodeSet::begin):
(WebCore::XPath::NodeSet::end):

Source/WTF:

Add a new IndexedIterator struct to WTF that wraps a
Vector type and index to provide pointer like semantics
while still performing runtime bounds checking, even in
release builds. We store a simple index into the vector
which means that this iterator allows vector resizing
during iteration. If the vector is resized such that the
iterator is out of bounds, then any attempt to dereference
the iterator will crash safely.

For the purpose of retaining semantically equivalent
behaviour, the iterator can be moved to m_index == size()
as that is the standard "end" terminator for these types.
Attempting to dereference at that point will still crash
rather than perform an unsafe memory operation.

By necessity there are many overrides for operator + and - as
we otherwise hit many different type promotion ambiguities when
performing arithmetic with iterators. These ambiguities are also
different for 32- vs. 64-bit, so duplicating the functions
and then forwarding to the core implementations that performed
the bounds checking and mutation seemed like the right call.

• WTF.vcxproj/WTF.vcxproj:
• WTF.vcxproj/WTF.vcxproj.filters:
• WTF.xcodeproj/project.pbxproj:
• wtf/IndexedIterator.h: Added.

(WTF::IndexedIterator::IndexedIterator):
(WTF::IndexedIterator::operator->):
(WTF::IndexedIterator::operator*):
(WTF::IndexedIterator::get):
(WTF::IndexedIterator::operator++):
(WTF::IndexedIterator::operator--):
(WTF::IndexedIterator::operator UnspecifiedBoolType):
(WTF::IndexedIterator::operator-):
(WTF::IndexedIterator::operator=):
(WTF::IndexedIterator::operator==):
(WTF::IndexedIterator::operator!=):
(WTF::IndexedIterator::operator<):
(WTF::IndexedIterator::operator<=):
(WTF::IndexedIterator::operator>):
(WTF::IndexedIterator::operator>=):
(WTF::IndexedIterator::operator const_iterator):
(WTF::IndexedIterator::unsafeGet):
(WTF::getPtr):
(WTF::operator-):
(WTF::operator==):
(WTF::operator!=):
(WTF::operator<=):
(WTF::operator>=):
(WTF::operator<):
(WTF::operator>):
(WTF::IndexedIteratorSelector::makeIterator):
(WTF::IndexedIteratorSelector::makeConstIterator):

• wtf/RefCountedArray.h:

(WTF::RefCountedArray::RefCountedArray):

• wtf/Vector.h:

(WTF::Vector::Vector):
(WTF::Vector::begin):
(WTF::Vector::end):
(WTF::OverflowHandler>::Vector):
(WTF::=):
(WTF::OverflowHandler>::fill):
(WTF::OverflowHandler>::expandCapacity):
(WTF::OverflowHandler>::tryExpandCapacity):
(WTF::OverflowHandler>::resize):
(WTF::OverflowHandler>::shrink):
(WTF::OverflowHandler>::grow):
(WTF::OverflowHandler>::reserveCapacity):
(WTF::OverflowHandler>::tryReserveCapacity):
(WTF::OverflowHandler>::shrinkCapacity):
(WTF::OverflowHandler>::append):
(WTF::OverflowHandler>::tryAppend):
(WTF::OverflowHandler>::appendSlowCase):
(WTF::OverflowHandler>::uncheckedAppend):
(WTF::OverflowHandler>::appendVector):
(WTF::OverflowHandler>::insert):
(WTF::OverflowHandler>::insertVector):
(WTF::OverflowHandler>::remove):

File:

• trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h

@@ -121 +121 @@
 static inline LValue mdNode(LContext context, LValue* args, unsigned numArgs) { return llvm->MDNodeInContext(context, args, numArgs); }
 template<typename VectorType>
-static inline LValue mdNode(LContext context, const VectorType& vector) { return mdNode(context, const_cast<LValue*>(vector.begin()), vector.size()); }
+static inline LValue mdNode(LContext context, const VectorType& vector) { return mdNode(context, const_cast<LValue*>(vector.data()), vector.size()); }
 static inline LValue mdNode(LContext context) { return mdNode(context, 0, 0); }
 static inline LValue mdNode(LContext context, LValue arg1) { return mdNode(context, &arg1, 1); }
@@ -289 +289 @@
 inline LValue buildCall(LBuilder builder, LValue function, const VectorType& vector)
 {
-    return buildCall(builder, function, vector.begin(), vector.size());
+    return buildCall(builder, function, vector.data(), vector.size());
 }
 static inline LValue buildCall(LBuilder builder, LValue function)