Changeset 220165 in webkit for trunk/Source/JavaScriptCore/runtime/JSArray.cpp

Timestamp:

Aug 2, 2017, 6:32:07 PM (8 years ago)

Author:

[email protected]

Message:

All C++ accesses to JSObject::m_butterfly should do caging
​https://bugs.webkit.org/show_bug.cgi?id=175039

Reviewed by Keith Miller.

Source/JavaScriptCore:

Makes JSObject::m_butterfly a AuxiliaryBarrier<CagedPtr<Butterfly>> and adopts the CagedPtr<> API.
This ensures that you can't cause C++ code to access a butterfly that has been rewired to point
outside the gigacage.

• runtime/JSArray.cpp:

(JSC::JSArray::setLength):
(JSC::JSArray::pop):
(JSC::JSArray::push):
(JSC::JSArray::shiftCountWithAnyIndexingType):
(JSC::JSArray::unshiftCountWithAnyIndexingType):
(JSC::JSArray::fillArgList):
(JSC::JSArray::copyToArguments):

• runtime/JSObject.cpp:

(JSC::JSObject::heapSnapshot):
(JSC::JSObject::createInitialIndexedStorage):
(JSC::JSObject::createArrayStorage):
(JSC::JSObject::convertUndecidedToInt32):
(JSC::JSObject::convertUndecidedToDouble):
(JSC::JSObject::convertUndecidedToContiguous):
(JSC::JSObject::convertInt32ToDouble):
(JSC::JSObject::convertInt32ToArrayStorage):
(JSC::JSObject::convertDoubleToContiguous):
(JSC::JSObject::convertDoubleToArrayStorage):
(JSC::JSObject::convertContiguousToArrayStorage):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
(JSC::JSObject::ensureLengthSlow):
(JSC::JSObject::allocateMoreOutOfLineStorage):

• runtime/JSObject.h:

(JSC::JSObject::canGetIndexQuickly):
(JSC::JSObject::getIndexQuickly):
(JSC::JSObject::tryGetIndexQuickly const):
(JSC::JSObject::canSetIndexQuickly):
(JSC::JSObject::setIndexQuickly):
(JSC::JSObject::initializeIndex):
(JSC::JSObject::initializeIndexWithoutBarrier):
(JSC::JSObject::butterfly const):
(JSC::JSObject::butterfly):

Source/WTF:

Adds a smart pointer class that does various kinds of caging for you.

• WTF.xcodeproj/project.pbxproj:
• wtf/CMakeLists.txt:
• wtf/CagedPtr.h: Added.

(WTF::CagedPtr::CagedPtr):
(WTF::CagedPtr::get const):
(WTF::CagedPtr::getMayBeNull const):
(WTF::CagedPtr::operator== const):
(WTF::CagedPtr::operator!= const):
(WTF::CagedPtr::operator bool const):
(WTF::CagedPtr::operator* const):
(WTF::CagedPtr::operator-> const):

File:

• trunk/Source/JavaScriptCore/runtime/JSArray.cpp (modified) (9 diffs)

trunk/Source/JavaScriptCore/runtime/JSArray.cpp

@@ -551 +551 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    Butterfly* butterfly = m_butterfly.get();
+    Butterfly* butterfly = m_butterfly.get().getMayBeNull();
     switch (indexingType()) {
     case ArrayClass:
@@ -621 +621 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    Butterfly* butterfly = m_butterfly.get();
+    Butterfly* butterfly = m_butterfly.get().getMayBeNull();
     
     switch (indexingType()) {
@@ -723 +723 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    Butterfly* butterfly = m_butterfly.get();
+    Butterfly* butterfly = m_butterfly.get().getMayBeNull();
     
     switch (indexingType()) {
@@ -1016 +1016 @@
     RELEASE_ASSERT(count > 0);
 
-    Butterfly* butterfly = m_butterfly.get();
+    Butterfly* butterfly = m_butterfly.get().getMayBeNull();
     
     switch (indexingType()) {
@@ -1172 +1172 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    Butterfly* butterfly = m_butterfly.get();
+    Butterfly* butterfly = m_butterfly.get().getMayBeNull();
     
     switch (indexingType()) {
@@ -1195 +1195 @@
             return false;
         }
-        butterfly = m_butterfly.get();
+        butterfly = m_butterfly.get().getMayBeNull();
 
         // We have to check for holes before we start moving things around so that we don't get halfway 
@@ -1239 +1239 @@
             return false;
         }
-        butterfly = m_butterfly.get();
+        butterfly = m_butterfly.get().getMayBeNull();
         
         // We have to check for holes before we start moving things around so that we don't get halfway 
@@ -1282 +1282 @@
     WriteBarrier<Unknown>* vector;
 
-    Butterfly* butterfly = m_butterfly.get();
+    Butterfly* butterfly = m_butterfly.get().getMayBeNull();
     
     switch (indexingType()) {
@@ -1355 +1355 @@
     ASSERT(length == this->length());
 
-    Butterfly* butterfly = m_butterfly.get();
+    Butterfly* butterfly = m_butterfly.get().getMayBeNull();
     switch (indexingType()) {
     case ArrayClass: