Changeset 225437 in webkit for trunk/Source/JavaScriptCore/API/JSObjectRef.cpp

Timestamp:

Dec 1, 2017, 5:12:48 PM (8 years ago)

Author:

[email protected]

Message:

Let's scramble ClassInfo pointers in cells.
​https://bugs.webkit.org/show_bug.cgi?id=180291
<rdar://problem/35807620>

Reviewed by JF Bastien.

Source/JavaScriptCore:

• API/JSCallbackObject.h:
• API/JSObjectRef.cpp:

(classInfoPrivate):

• JavaScriptCore.xcodeproj/project.pbxproj:
• Sources.txt:
• assembler/MacroAssemblerCodeRef.cpp:

(JSC::MacroAssemblerCodePtr::initialize): Deleted.

• assembler/MacroAssemblerCodeRef.h:

(JSC::MacroAssemblerCodePtr:: const):
(JSC::MacroAssemblerCodePtr::hash const):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::checkArray):
(JSC::DFG::SpeculativeJIT::compileCheckSubClass):
(JSC::DFG::SpeculativeJIT::compileNewStringObject):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::emitAllocateDestructibleObject):

• jit/SpecializedThunkJIT.h:

(JSC::SpecializedThunkJIT::loadArgumentWithSpecificClass):

• runtime/InitializeThreading.cpp:

(JSC::initializeThreading):

• runtime/JSCScrambledPtr.cpp: Added.

(JSC::initializeScrambledPtrKeys):

• runtime/JSCScrambledPtr.h: Added.
• runtime/JSDestructibleObject.h:

(JSC::JSDestructibleObject::classInfo const):

• runtime/JSSegmentedVariableObject.h:

(JSC::JSSegmentedVariableObject::classInfo const):

• runtime/Structure.h:
• runtime/VM.h:

Source/WTF:

• wtf/ScrambledPtr.h:

(WTF::ScrambledPtr::descrambled const):
(WTF::ScrambledPtr::bits const):
(WTF::ScrambledPtr::operator==):
(WTF::ScrambledPtr::operator=):
(WTF::ScrambledPtr::scramble):
(WTF::ScrambledPtr::descramble):
(WTF::ScrambledPtr:: const): Deleted.
(WTF::ScrambledPtr::scrambledBits const): Deleted.

File:

• trunk/Source/JavaScriptCore/API/JSObjectRef.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/API/JSObjectRef.cpp

@@ -432 +432 @@
         return jsObject->classInfo(vm);
 
-    return vm.currentlyDestructingCallbackObjectClassInfo;
+    return vm.currentlyDestructingCallbackObjectClassInfo.descrambled();
 }