Changeset 225697 in webkit for trunk/Source/JavaScriptCore

Timestamp:

Dec 8, 2017, 1:38:02 PM (7 years ago)

Author:

[email protected]

Message:

Need to unpoison native function pointers for CLoop.
​https://bugs.webkit.org/show_bug.cgi?id=180601
<rdar://problem/35942028>

Reviewed by JF Bastien.

• llint/LowLevelInterpreter64.asm:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• llint/LowLevelInterpreter64.asm (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-12-08  Mark Lam  <[email protected]>
+
+        Need to unpoison native function pointers for CLoop.
+        https://bugs.webkit.org/show_bug.cgi?id=180601
+        <rdar://problem/35942028>
+
+        Reviewed by JF Bastien.
+
+        * llint/LowLevelInterpreter64.asm:
+
 2017-12-08  Michael Saboff  <[email protected]>
 

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

@@ -2077 +2077 @@
     checkStackPointerAlignment(t3, 0xdead0001)
     if C_LOOP
-        cloopCallNative executableOffsetToFunction[t1]
+        loadp _g_nativeCodePoison, t2
+        xorp executableOffsetToFunction[t1], t2
+        cloopCallNative t2
     else
         if X86_64_WIN
@@ -2118 +2120 @@
     checkStackPointerAlignment(t3, 0xdead0001)
     if C_LOOP
-        cloopCallNative offsetOfFunction[t1]
+        loadp _g_nativeCodePoison, t2
+        xorp offsetOfFunction[t1], t2
+        cloopCallNative t2
     else
         if X86_64_WIN