Changeset 229842 in webkit for trunk/Source/JavaScriptCore/runtime/ScopedArguments.cpp

Timestamp:

Mar 21, 2018, 7:15:44 PM (7 years ago)

Author:

[email protected]

Message:

ScopedArguments should do poisoning and index masking
​https://bugs.webkit.org/show_bug.cgi?id=183863

Reviewed by Mark Lam.

JSTests:

Adds another stress test of scoped arguments.

• stress/scoped-arguments-test.js: Added.

(foo):

Source/JavaScriptCore:

This outlines the ScopedArguments overflow storage and adds poisoning.

• bytecode/AccessCase.cpp:

(JSC::AccessCase::generateWithGuard):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):

• ftl/FTLAbstractHeapRepository.h:
• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emitScopedArgumentsGetByVal):

• runtime/JSCPoison.h:
• runtime/ScopedArguments.cpp:

(JSC::ScopedArguments::ScopedArguments):
(JSC::ScopedArguments::createUninitialized):
(JSC::ScopedArguments::visitChildren):

• runtime/ScopedArguments.h:

File:

• trunk/Source/JavaScriptCore/runtime/ScopedArguments.cpp (modified) (7 diffs)

trunk/Source/JavaScriptCore/runtime/ScopedArguments.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2018 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -36 +36 @@
 const ClassInfo ScopedArguments::s_info = { "Arguments", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(ScopedArguments) };
 
-ScopedArguments::ScopedArguments(VM& vm, Structure* structure, unsigned totalLength)
+ScopedArguments::ScopedArguments(VM& vm, Structure* structure, WriteBarrier<Unknown>* storage)
     : GenericArguments(vm, structure)
-    , m_overrodeThings(false)
-    , m_totalLength(totalLength)
+    , m_storage(vm, this, storage)
 {
+    ASSERT(!storageHeader(storage).overrodeThings);
 }
 
@@ -58 +58 @@
     else
         overflowLength = 0;
+    
+    void* rawStoragePtr = vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(
+        vm, storageSize(overflowLength), nullptr, AllocationFailureMode::Assert);
+    WriteBarrier<Unknown>* storage = static_cast<WriteBarrier<Unknown>*>(rawStoragePtr) + 1;
+    storageHeader(storage).overrodeThings = false;
+    storageHeader(storage).totalLength = totalLength;
+    
     ScopedArguments* result = new (
         NotNull,
-        allocateCell<ScopedArguments>(vm.heap, allocationSize(overflowLength)))
-        ScopedArguments(vm, structure, totalLength);
+        allocateCell<ScopedArguments>(vm.heap))
+        ScopedArguments(vm, structure, storage);
     result->finishCreation(vm, callee, table, scope);
     return result;
@@ -108 +115 @@
     visitor.append(thisObject->m_scope);
     
-    if (thisObject->m_totalLength > thisObject->m_table->length()) {
+    visitor.markAuxiliary(&thisObject->storageHeader());
+    
+    if (thisObject->storageHeader().totalLength > thisObject->m_table->length()) {
         visitor.appendValues(
-            thisObject->overflowStorage(), thisObject->m_totalLength - thisObject->m_table->length());
+            thisObject->overflowStorage(), thisObject->storageHeader().totalLength - thisObject->m_table->length());
     }
 
@@ -123 +132 @@
 void ScopedArguments::overrideThings(VM& vm)
 {
-    RELEASE_ASSERT(!m_overrodeThings);
+    RELEASE_ASSERT(!storageHeader().overrodeThings);
     
     putDirect(vm, vm.propertyNames->length, jsNumber(m_table->length()), static_cast<unsigned>(PropertyAttribute::DontEnum));
@@ -129 +138 @@
     putDirect(vm, vm.propertyNames->iteratorSymbol, globalObject()->arrayProtoValuesFunction(), static_cast<unsigned>(PropertyAttribute::DontEnum));
     
-    m_overrodeThings = true;
+    storageHeader().overrodeThings = true;
 }
 
 void ScopedArguments::overrideThingsIfNecessary(VM& vm)
 {
-    if (!m_overrodeThings)
+    if (!storageHeader().overrodeThings)
         overrideThings(vm);
 }
@@ -140 +149 @@
 void ScopedArguments::unmapArgument(VM& vm, uint32_t i)
 {
-    ASSERT_WITH_SECURITY_IMPLICATION(i < m_totalLength);
+    ASSERT_WITH_SECURITY_IMPLICATION(i < storageHeader().totalLength);
     unsigned namedLength = m_table->length();
     if (i < namedLength)