Changeset 268170 in webkit


Ignore:
Timestamp:
Oct 7, 2020, 9:18:58 PM (5 years ago)
Author:
[email protected]
Message:

[JSC] Restrict more ptr-tagging and avoid using OperationPtrTag for JIT code
​https://bugs.webkit.org/show_bug.cgi?id=217460

Reviewed by Saam Barati.

Source/JavaScriptCore:

This patch makes tagging / untagging pointer functions solid by using PtrTag in template parameter.
Later, we will introduce compile time behavior change for different kind of PtrTag so that we can insert OperationPtrTag validation
when tagging a function with OperationPtrTag.

We also found that FTL is tagging JIT code with OperationPtrTag wrongly. We should tag it with JITThunkPtrTag.

  • assembler/AbstractMacroAssembler.h:

(JSC::AbstractMacroAssembler::getLinkerAddress):

  • assembler/AssemblerBuffer.h:

(JSC::ARM64EHash::update):
(JSC::ARM64EHash::finalHash const):

  • assembler/JITOperationList.cpp:

(JSC::addPointers):

  • assembler/MacroAssemblerARM64.cpp:

(JSC::MacroAssembler::probe):

  • assembler/MacroAssemblerCodeRef.h:

(JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
(JSC::MacroAssemblerCodePtr::createFromExecutableAddress):

  • assembler/testmasm.cpp:

(JSC::testProbeModifiesProgramCounter):

  • b3/air/testair.cpp:
  • ftl/FTLOutput.h:

(JSC::FTL::Output::callWithoutSideEffects):
(JSC::FTL::Output::operation):

  • ftl/FTLSlowPathCall.cpp:

(JSC::FTL::SlowPathCallContext::makeCall):

  • jit/JITCode.cpp:

(JSC::JITCodeWithCodeRef::executableAddressAtOffset):

  • jit/JITExceptions.cpp:

(JSC::genericUnwind):

  • jit/JITOperations.cpp:
  • jit/Repatch.cpp:

(JSC::readPutICCallTarget):
(JSC::ftlThunkAwareRepatchCall):
(JSC::tryCacheGetBy):
(JSC::tryCachePutByID):

  • llint/LLIntData.cpp:

(JSC::LLInt::initialize):

  • llint/LLIntPCRanges.h:

(JSC::LLInt::isLLIntPC):

  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::setUpCall):

  • llint/LLIntThunks.cpp:

(JSC::LLInt::generateThunkWithJumpTo):

  • runtime/MachineContext.h:

(JSC::MachineContext::instructionPointer):

  • runtime/NativeExecutable.cpp:

(JSC::NativeExecutable::finishCreation):

  • runtime/PutPropertySlot.h:

(JSC::PutPropertySlot::setCustomValue):
(JSC::PutPropertySlot::setCustomAccessor):
(JSC::PutPropertySlot::customSetter const):

  • wasm/WasmAirIRGenerator.cpp:

(JSC::Wasm::AirIRGenerator::emitCCall):

  • wasm/WasmSlowPaths.cpp:

Source/WTF:

  • wtf/PlatformRegisters.cpp:

(WTF::threadStateLRInternal):
(WTF::threadStatePCInternal):

  • wtf/PtrTag.h:

(WTF::tagCFunctionPtr):
(WTF::tagCFunction):
(WTF::untagCFunctionPtr):
(WTF::tagInt):
(WTF::isTaggedWith):
(WTF::assertIsTaggedWith):
(WTF::assertIsNullOrTaggedWith):

Location:
trunk/Source
Files:
27 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r268165 r268170  
     12020-10-07  Yusuke Suzuki  <[email protected]>
     2
     3        [JSC] Restrict more ptr-tagging and avoid using OperationPtrTag for JIT code
     4        https://bugs.webkit.org/show_bug.cgi?id=217460
     5
     6        Reviewed by Saam Barati.
     7
     8        This patch makes tagging / untagging pointer functions solid by using PtrTag in template parameter.
     9        Later, we will introduce compile time behavior change for different kind of PtrTag so that we can insert OperationPtrTag validation
     10        when tagging a function with OperationPtrTag.
     11
     12        We also found that FTL is tagging JIT code with OperationPtrTag wrongly. We should tag it with JITThunkPtrTag.
     13
     14        * assembler/AbstractMacroAssembler.h:
     15        (JSC::AbstractMacroAssembler::getLinkerAddress):
     16        * assembler/AssemblerBuffer.h:
     17        (JSC::ARM64EHash::update):
     18        (JSC::ARM64EHash::finalHash const):
     19        * assembler/JITOperationList.cpp:
     20        (JSC::addPointers):
     21        * assembler/MacroAssemblerARM64.cpp:
     22        (JSC::MacroAssembler::probe):
     23        * assembler/MacroAssemblerCodeRef.h:
     24        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
     25        (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
     26        * assembler/testmasm.cpp:
     27        (JSC::testProbeModifiesProgramCounter):
     28        * b3/air/testair.cpp:
     29        * ftl/FTLOutput.h:
     30        (JSC::FTL::Output::callWithoutSideEffects):
     31        (JSC::FTL::Output::operation):
     32        * ftl/FTLSlowPathCall.cpp:
     33        (JSC::FTL::SlowPathCallContext::makeCall):
     34        * jit/JITCode.cpp:
     35        (JSC::JITCodeWithCodeRef::executableAddressAtOffset):
     36        * jit/JITExceptions.cpp:
     37        (JSC::genericUnwind):
     38        * jit/JITOperations.cpp:
     39        * jit/Repatch.cpp:
     40        (JSC::readPutICCallTarget):
     41        (JSC::ftlThunkAwareRepatchCall):
     42        (JSC::tryCacheGetBy):
     43        (JSC::tryCachePutByID):
     44        * llint/LLIntData.cpp:
     45        (JSC::LLInt::initialize):
     46        * llint/LLIntPCRanges.h:
     47        (JSC::LLInt::isLLIntPC):
     48        * llint/LLIntSlowPaths.cpp:
     49        (JSC::LLInt::setUpCall):
     50        * llint/LLIntThunks.cpp:
     51        (JSC::LLInt::generateThunkWithJumpTo):
     52        * runtime/MachineContext.h:
     53        (JSC::MachineContext::instructionPointer):
     54        * runtime/NativeExecutable.cpp:
     55        (JSC::NativeExecutable::finishCreation):
     56        * runtime/PutPropertySlot.h:
     57        (JSC::PutPropertySlot::setCustomValue):
     58        (JSC::PutPropertySlot::setCustomAccessor):
     59        (JSC::PutPropertySlot::customSetter const):
     60        * wasm/WasmAirIRGenerator.cpp:
     61        (JSC::Wasm::AirIRGenerator::emitCCall):
     62        * wasm/WasmSlowPaths.cpp:
     63
    1642020-10-07  Ross Kirsling  <[email protected]>
    265

  • trunk/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h

    r266530 r268170  
    878878    static void* getLinkerAddress(void* code, AssemblerLabel label)
    879879    {
    880         return tagCodePtr(AssemblerType::getRelocatedAddress(code, label), tag);
     880        return tagCodePtr<tag>(AssemblerType::getRelocatedAddress(code, label));
    881881    }
    882882

  • trunk/Source/JavaScriptCore/assembler/AssemblerBuffer.h

    r262402 r268170  
    188188        {
    189189            uint64_t input = value ^ m_hash;
    190             uint64_t a = static_cast<uint32_t>(tagInt(input, static_cast<PtrTag>(0)) >> 39);
    191             uint64_t b = tagInt(input, static_cast<PtrTag>(0xb7e151628aed2a6a)) >> 23;
     190            uint64_t a = static_cast<uint32_t>(tagInt<static_cast<PtrTag>(0)>(input) >> 39);
     191            uint64_t b = tagInt<static_cast<PtrTag>(0xb7e151628aed2a6a)>(input) >> 23;
    192192            m_hash = a ^ b;
    193193        }
    … …  
    195195        {
    196196            uint64_t hash = m_hash;
    197             uint64_t a = static_cast<uint32_t>(tagInt(hash, static_cast<PtrTag>(0xbf7158809cf4f3c7)) >> 39);
    198             uint64_t b = tagInt(hash, static_cast<PtrTag>(0x62e7160f38b4da56)) >> 23;
     197            uint64_t a = static_cast<uint32_t>(tagInt<static_cast<PtrTag>(0xbf7158809cf4f3c7)>(hash) >> 39);
     198            uint64_t b = tagInt<static_cast<PtrTag>(0x62e7160f38b4da56)>(hash) >> 23;
    199199            return static_cast<uint32_t>(a ^ b);
    200200        }

  • trunk/Source/JavaScriptCore/assembler/JITOperationList.cpp

    r268013 r268170  
    4949        void* codePtr = removeCodePtrTag(bitwise_cast<void*>(*current));
    5050        if (codePtr) {
    51             auto result = map.add(codePtr, tagCodePtr(codePtr, JSEntryPtrTag));
     51            auto result = map.add(codePtr, tagCodePtr<JSEntryPtrTag>(codePtr));
    5252            ASSERT(result.isNewEntry);
    5353        }
    … …  
    5656        void* codePtr = removeCodePtrTag(bitwise_cast<void*>(*current));
    5757        if (codePtr) {
    58             auto result = map.add(codePtr, tagCodePtr(codePtr, OperationPtrTag));
     58            auto result = map.add(codePtr, tagCodePtr<OperationPtrTag>(codePtr));
    5959            ASSERT(result.isNewEntry);
    6060        }

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64.cpp

    r267938 r268170  
    546546    move(TrustedImmPtr(tagCFunction<JITProbeExecutorPtrTag>(Probe::executeProbe)), x28);
    547547#if CPU(ARM64E)
    548     ASSERT(isTaggedWith(function, JITProbePtrTag));
     548    assertIsTaggedWith<JITProbePtrTag>(function);
    549549#endif
    550550    move(TrustedImmPtr(reinterpret_cast<void*>(function)), x24);

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h

    r265142 r268170  
    279279#endif
    280280    {
    281         assertIsTaggedWith(value, tag);
     281        assertIsTaggedWith<tag>(value);
    282282        ASSERT(value);
    283283#if CPU(ARM_THUMB2)
    … …  
    291291        ASSERT(value);
    292292        ASSERT_VALID_CODE_POINTER(value);
    293         assertIsTaggedWith(value, tag);
     293        assertIsTaggedWith<tag>(value);
    294294        MacroAssemblerCodePtr result;
    295295        result.m_value = value;

  • trunk/Source/JavaScriptCore/assembler/testmasm.cpp

    r265186 r268170  
    21242124        jit.probe([&] (Probe::Context& context) {
    21252125            probeCallCount++;
    2126             context.cpu.pc() = untagCodePtr(continuation.code().executableAddress(), JSEntryPtrTag);
     2126            context.cpu.pc() = untagCodePtr<JSEntryPtrTag>(continuation.code().executableAddress());
    21272127        });
    21282128

  • trunk/Source/JavaScriptCore/b3/air/testair.cpp

    r263635 r268170  
    100100T invoke(const B3::Compilation& code, Arguments... arguments)
    101101{
    102     void* executableAddress = untagCFunctionPtr(code.code().executableAddress(), B3CompilationPtrTag);
     102    void* executableAddress = untagCFunctionPtr<B3CompilationPtrTag>(code.code().executableAddress());
    103103    T (*function)(Arguments...) = bitwise_cast<T(*)(Arguments...)>(executableAddress);
    104104    return function(arguments...);

  • trunk/Source/JavaScriptCore/ftl/FTLOutput.h

    r267783 r268170  
    396396        static_assert(!std::is_same<Function, LValue>::value);
    397397        return m_block->appendNew<B3::CCallValue>(m_proc, type, origin(), B3::Effects::none(),
    398             constIntPtr(tagCFunctionPtr<void*>(function, OperationPtrTag)), arg1, args...);
     398            constIntPtr(tagCFunctionPtr<void*, OperationPtrTag>(function)), arg1, args...);
    399399    }
    400400
    … …  
    402402    // https://bugs.webkit.org/show_bug.cgi?id=184324
    403403    template<typename FunctionType>
    404     LValue operation(FunctionType function) { return constIntPtr(tagCFunctionPtr<void*>(function, OperationPtrTag)); }
     404    LValue operation(FunctionType function) { return constIntPtr(tagCFunctionPtr<void*, OperationPtrTag>(function)); }
    405405
    406406    void jump(LBasicBlock);

  • trunk/Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp

    r262920 r268170  
    121121{
    122122    SlowPathCallKey key = keyWithTarget(callTarget);
    123     SlowPathCall result = SlowPathCall(m_jit.call(OperationPtrTag), key);
     123    SlowPathCall result = SlowPathCall(m_jit.call(JITThunkPtrTag), key);
    124124
    125125    m_jit.addLinkTask(
    … …  
    128128                vm.ftlThunks->getSlowPathCallThunk(vm, result.key());
    129129
    130             linkBuffer.link(result.call(), CodeLocationLabel<OperationPtrTag>(thunk.retaggedCode<OperationPtrTag>()));
     130            linkBuffer.link(result.call(), CodeLocationLabel<JITThunkPtrTag>(thunk.code()));
    131131        });
    132132   

  • trunk/Source/JavaScriptCore/jit/JITCode.cpp

    r261755 r268170  
    117117{
    118118    RELEASE_ASSERT(m_ref);
    119     assertIsTaggedWith(m_ref.code().executableAddress(), JSEntryPtrTag);
     119    assertIsTaggedWith<JSEntryPtrTag>(m_ref.code().executableAddress());
    120120    if (!offset)
    121121        return m_ref.code().executableAddress();

  • trunk/Source/JavaScriptCore/jit/JITExceptions.cpp

    r268077 r268170  
    8383    ASSERT(bitwise_cast<uintptr_t>(callFrame) < bitwise_cast<uintptr_t>(vm.topEntryFrame));
    8484
    85     assertIsTaggedWith(catchRoutine, ExceptionHandlerPtrTag);
     85    assertIsTaggedWith<ExceptionHandlerPtrTag>(catchRoutine);
    8686    vm.callFrameForCatch = callFrame;
    8787    vm.targetMachinePCForThrow = catchRoutine;

  • trunk/Source/JavaScriptCore/jit/JITOperations.cpp

    r267846 r268170  
    26242624    }
    26252625
    2626     assertIsTaggedWith(result, JSSwitchPtrTag);
     2626    assertIsTaggedWith<JSSwitchPtrTag>(result);
    26272627    return reinterpret_cast<char*>(result);
    26282628}
    … …  
    26442644    else
    26452645        result = jumpTable.ctiDefault.executableAddress();
    2646     assertIsTaggedWith(result, JSSwitchPtrTag);
     2646    assertIsTaggedWith<JSSwitchPtrTag>(result);
    26472647    return reinterpret_cast<char*>(result);
    26482648}
    … …  
    26692669        result = jumpTable.ctiDefault.executableAddress();
    26702670
    2671     assertIsTaggedWith(result, JSSwitchPtrTag);
     2671    assertIsTaggedWith<JSSwitchPtrTag>(result);
    26722672    return reinterpret_cast<char*>(result);
    26732673}

  • trunk/Source/JavaScriptCore/jit/Repatch.cpp

    r267489 r268170  
    7474static FunctionPtr<CFunctionPtrTag> readPutICCallTarget(CodeBlock* codeBlock, CodeLocationCall<JSInternalPtrTag> call)
    7575{
    76     FunctionPtr<OperationPtrTag> target = MacroAssembler::readCallTarget<OperationPtrTag>(call);
    7776#if ENABLE(FTL_JIT)
    7877    if (codeBlock->jitType() == JITType::FTLJIT) {
    79         MacroAssemblerCodePtr<JITThunkPtrTag> thunk = MacroAssemblerCodePtr<OperationPtrTag>::createFromExecutableAddress(target.executableAddress()).retagged<JITThunkPtrTag>();
     78        FunctionPtr<JITThunkPtrTag> target = MacroAssembler::readCallTarget<JITThunkPtrTag>(call);
     79        MacroAssemblerCodePtr<JITThunkPtrTag> thunk = MacroAssemblerCodePtr<JITThunkPtrTag>::createFromExecutableAddress(target.executableAddress());
    8080        return codeBlock->vm().ftlThunks->keyForSlowPathCallThunk(thunk).callTarget().retagged<CFunctionPtrTag>();
    8181    }
    … …  
    8383    UNUSED_PARAM(codeBlock);
    8484#endif // ENABLE(FTL_JIT)
     85    FunctionPtr<OperationPtrTag> target = MacroAssembler::readCallTarget<OperationPtrTag>(call);
    8586    return target.retagged<CFunctionPtrTag>();
    8687}
    … …  
    9293        VM& vm = codeBlock->vm();
    9394        FTL::Thunks& thunks = *vm.ftlThunks;
    94         FunctionPtr<OperationPtrTag> target = MacroAssembler::readCallTarget<OperationPtrTag>(call);
    95         auto slowPathThunk = MacroAssemblerCodePtr<JITThunkPtrTag>::createFromExecutableAddress(target.retaggedExecutableAddress<JITThunkPtrTag>());
     95        FunctionPtr<JITThunkPtrTag> target = MacroAssembler::readCallTarget<JITThunkPtrTag>(call);
     96        auto slowPathThunk = MacroAssemblerCodePtr<JITThunkPtrTag>::createFromExecutableAddress(target.executableAddress());
    9697        FTL::SlowPathCallKey key = thunks.keyForSlowPathCallThunk(slowPathThunk);
    9798        key = key.withCallTarget(newCalleeFunction);
    … …  
    406407                    newCase = GetterSetterAccessCase::create(
    407408                        vm, codeBlock, type, propertyName, offset, structure, conditionSet, loadTargetFromProxy,
    408                         slot.watchpointSet(), slot.isCacheableCustom() ? slot.customGetter() : nullptr,
     409                        slot.watchpointSet(), slot.isCacheableCustom() ? FunctionPtr<OperationPtrTag>(slot.customGetter()) : nullptr,
    409410                        slot.isCacheableCustom() && slot.slotBase() != baseValue ? slot.slotBase() : nullptr,
    410411                        domAttribute, WTFMove(prototypeAccessChain));
    … …  
    742743                newCase = GetterSetterAccessCase::create(
    743744                    vm, codeBlock, slot.isCustomAccessor() ? AccessCase::CustomAccessorSetter : AccessCase::CustomValueSetter, oldStructure, propertyName,
    744                     invalidOffset, conditionSet, WTFMove(prototypeAccessChain), isProxy, slot.customSetter(), slot.base() != baseValue ? slot.base() : nullptr);
     745                    invalidOffset, conditionSet, WTFMove(prototypeAccessChain), isProxy, slot.customSetter().retagged<OperationPtrTag>(), slot.base() != baseValue ? slot.base() : nullptr);
    745746            } else {
    746747                ASSERT(slot.isCacheableSetter());

  • trunk/Source/JavaScriptCore/llint/LLIntData.cpp

    r267371 r268170  
    6363
    6464    for (int i = 0; i < numOpcodeIDs + numWasmOpcodeIDs; ++i) {
    65         g_jscConfig.llint.opcodeMap[i] = tagCodePtr(g_jscConfig.llint.opcodeMap[i], BytecodePtrTag);
    66         g_jscConfig.llint.opcodeMapWide16[i] = tagCodePtr(g_jscConfig.llint.opcodeMapWide16[i], BytecodePtrTag);
    67         g_jscConfig.llint.opcodeMapWide32[i] = tagCodePtr(g_jscConfig.llint.opcodeMapWide32[i], BytecodePtrTag);
     65        g_jscConfig.llint.opcodeMap[i] = tagCodePtr<BytecodePtrTag>(g_jscConfig.llint.opcodeMap[i]);
     66        g_jscConfig.llint.opcodeMapWide16[i] = tagCodePtr<BytecodePtrTag>(g_jscConfig.llint.opcodeMapWide16[i]);
     67        g_jscConfig.llint.opcodeMapWide32[i] = tagCodePtr<BytecodePtrTag>(g_jscConfig.llint.opcodeMapWide32[i]);
    6868    }
    6969

  • trunk/Source/JavaScriptCore/llint/LLIntPCRanges.h

    r251263 r268170  
    4141{
    4242    uintptr_t pcAsInt = bitwise_cast<uintptr_t>(pc);
    43     uintptr_t llintStart = untagCodePtr<uintptr_t>(llintPCRangeStart, CFunctionPtrTag);
    44     uintptr_t llintEnd = untagCodePtr<uintptr_t>(llintPCRangeEnd, CFunctionPtrTag);
     43    uintptr_t llintStart = untagCodePtr<uintptr_t, CFunctionPtrTag>(llintPCRangeStart);
     44    uintptr_t llintEnd = untagCodePtr<uintptr_t, CFunctionPtrTag>(llintPCRangeEnd);
    4545    RELEASE_ASSERT(llintStart < llintEnd);
    4646    return llintStart <= pcAsInt && pcAsInt <= llintEnd;

  • trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

    r268077 r268170  
    156156
    157157#define LLINT_CALL_END_IMPL(callFrame, callTarget, callTargetTag) \
    158     LLINT_RETURN_TWO(retagCodePtr((callTarget), callTargetTag, SlowPathPtrTag), (callFrame))
     158    LLINT_RETURN_TWO((retagCodePtr<callTargetTag, SlowPathPtrTag>(callTarget)), (callFrame))
    159159
    160160#define LLINT_CALL_THROW(globalObject, exceptionToThrow) do {                   \
    … …  
    17231723            }
    17241724
    1725             assertIsTaggedWith(codePtr.executableAddress(), JSEntryPtrTag);
     1725            assertIsTaggedWith<JSEntryPtrTag>(codePtr.executableAddress());
    17261726            LLINT_CALL_RETURN(globalObject, calleeFrame, codePtr.executableAddress(), JSEntryPtrTag);
    17271727        }
    … …  
    17661766    }
    17671767
    1768     assertIsTaggedWith(codePtr.executableAddress(), JSEntryPtrTag);
     1768    assertIsTaggedWith<JSEntryPtrTag>(codePtr.executableAddress());
    17691769    LLINT_CALL_RETURN(globalObject, calleeFrame, codePtr.executableAddress(), JSEntryPtrTag);
    17701770}

  • trunk/Source/JavaScriptCore/llint/LLIntThunks.cpp

    r268077 r268170  
    5353    JSInterfaceJIT jit;
    5454
    55     assertIsTaggedWith(target, JSEntryPtrTag);
     55    assertIsTaggedWith<JSEntryPtrTag>(target);
    5656
    5757#if ENABLE(WEBASSEMBLY)

  • trunk/Source/JavaScriptCore/runtime/JSCPtrTag.h

    r267867 r268170  
    5151    v(OSREntryPtrTag) \
    5252    v(OSRExitPtrTag) \
     53    v(PutValuePtrTag) \
    5354    v(SlowPathPtrTag) \
    5455    v(WasmEntryPtrTag) \

  • trunk/Source/JavaScriptCore/runtime/MachineContext.h

    r261546 r268170  
    458458    if (!usesPointerTagging())
    459459        return makeOptional(MacroAssemblerCodePtr<PlatformRegistersPCPtrTag>(value));
    460     if (isTaggedWith(value, PlatformRegistersPCPtrTag))
     460    if (isTaggedWith<PlatformRegistersPCPtrTag>(value))
    461461        return makeOptional(MacroAssemblerCodePtr<PlatformRegistersPCPtrTag>(value));
    462462    return WTF::nullopt;

  • trunk/Source/JavaScriptCore/runtime/NativeExecutable.cpp

    r267239 r268170  
    6161    m_name = name;
    6262
    63     assertIsTaggedWith(m_jitCodeForCall->addressForCall(ArityCheckNotRequired).executableAddress(), JSEntryPtrTag);
    64     assertIsTaggedWith(m_jitCodeForConstruct->addressForCall(ArityCheckNotRequired).executableAddress(), JSEntryPtrTag);
    65     assertIsTaggedWith(m_jitCodeForCallWithArityCheck.executableAddress(), JSEntryPtrTag);
    66     assertIsTaggedWith(m_jitCodeForConstructWithArityCheck.executableAddress(), JSEntryPtrTag);
     63    assertIsTaggedWith<JSEntryPtrTag>(m_jitCodeForCall->addressForCall(ArityCheckNotRequired).executableAddress());
     64    assertIsTaggedWith<JSEntryPtrTag>(m_jitCodeForConstruct->addressForCall(ArityCheckNotRequired).executableAddress());
     65    assertIsTaggedWith<JSEntryPtrTag>(m_jitCodeForCallWithArityCheck.executableAddress());
     66    assertIsTaggedWith<JSEntryPtrTag>(m_jitCodeForConstructWithArityCheck.executableAddress());
    6767}
    6868

  • trunk/Source/JavaScriptCore/runtime/PutPropertySlot.h

    r267163 r268170  
    6767    }
    6868
    69     void setCustomValue(JSObject* base, FunctionPtr<OperationPtrTag> function)
     69    void setCustomValue(JSObject* base, PutValueFunc function)
    7070    {
    7171        m_type = CustomValue;
    … …  
    7474    }
    7575
    76     void setCustomAccessor(JSObject* base, FunctionPtr<OperationPtrTag> function)
     76    void setCustomAccessor(JSObject* base, PutValueFunc function)
    7777    {
    7878        m_type = CustomAccessor;
    … …  
    9898    }
    9999
    100     FunctionPtr<OperationPtrTag> customSetter() const
     100    FunctionPtr<PutValuePtrTag> customSetter() const
    101101    {
    102102        ASSERT(isCacheableCustom());
    … …  
    138138    uint8_t m_context;
    139139    CacheabilityType m_cacheability;
    140     FunctionPtr<OperationPtrTag> m_putFunction;
     140    FunctionPtr<PutValuePtrTag> m_putFunction;
    141141};
    142142

  • trunk/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp

    r267783 r268170  
    599599
    600600        Tmp callee = g64();
    601         append(block, Move, Arg::immPtr(tagCFunctionPtr<void*>(func, OperationPtrTag)), callee);
     601        append(block, Move, Arg::immPtr(tagCFunctionPtr<void*, OperationPtrTag>(func)), callee);
    602602        inst.args.append(callee);
    603603

  • trunk/Source/JavaScriptCore/wasm/WasmSlowPaths.cpp

    r263117 r268170  
    6565
    6666#define WASM_CALL_RETURN(targetInstance, callTarget, callTargetTag) do { \
    67         WASM_RETURN_TWO(retagCodePtr(callTarget, callTargetTag, SlowPathPtrTag), targetInstance); \
     67        WASM_RETURN_TWO((retagCodePtr<callTargetTag, SlowPathPtrTag>(callTarget)), targetInstance); \
    6868    } while (false)
    6969

  • trunk/Source/WTF/ChangeLog

    r268163 r268170  
     12020-10-07  Yusuke Suzuki  <[email protected]>
     2
     3        [JSC] Restrict more ptr-tagging and avoid using OperationPtrTag for JIT code
     4        https://bugs.webkit.org/show_bug.cgi?id=217460
     5
     6        Reviewed by Saam Barati.
     7
     8        * wtf/PlatformRegisters.cpp:
     9        (WTF::threadStateLRInternal):
     10        (WTF::threadStatePCInternal):
     11        * wtf/PtrTag.h:
     12        (WTF::tagCFunctionPtr):
     13        (WTF::tagCFunction):
     14        (WTF::untagCFunctionPtr):
     15        (WTF::tagInt):
     16        (WTF::isTaggedWith):
     17        (WTF::assertIsTaggedWith):
     18        (WTF::assertIsNullOrTaggedWith):
     19
    1202020-10-07  Keith Rollin  <[email protected]>
    221

  • trunk/Source/WTF/wtf/PlatformRegisters.cpp

    r243254 r268170  
    4040
    4141#if USE(UNTAGGED_THREAD_STATE_PTR)
    42     if (candidateLR && isTaggedWith(candidateLR, CFunctionPtrTag))
     42    if (candidateLR && isTaggedWith<CFunctionPtrTag>(candidateLR))
    4343        return retagCodePtr<CFunctionPtrTag, PlatformRegistersLRPtrTag>(candidateLR);
    4444    candidateLR = bitwise_cast<void*>(arm_thread_state64_get_lr(regs));
    … …  
    5757
    5858#if USE(UNTAGGED_THREAD_STATE_PTR)
    59     if (candidatePC && isTaggedWith(candidatePC, CFunctionPtrTag))
     59    if (candidatePC && isTaggedWith<CFunctionPtrTag>(candidatePC))
    6060        return retagCodePtr<CFunctionPtrTag, PlatformRegistersPCPtrTag>(candidatePC);
    6161    candidatePC = bitwise_cast<void*>(arm_thread_state64_get_pc(regs));

  • trunk/Source/WTF/wtf/PtrTag.h

    r266406 r268170  
    194194}
    195195
    196 template<typename T, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value && !std::is_same<T, PtrType>::value>>
    197 inline T tagCodePtr(PtrType ptr, PtrTag tag)
    198 {
    199     return bitwise_cast<T>(tagCodePtrImpl<PtrTagAction::DebugAssert>(ptr, tag));
    200 }
    201 
    202196template<typename T, PtrTag tag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    203197inline T tagCodePtr(PtrType ptr)
    204198{
    205199    return bitwise_cast<T>(tagCodePtrImpl<PtrTagAction::DebugAssert>(ptr, tag));
    206 }
    207 
    208 template<typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    209 inline PtrType tagCodePtr(PtrType ptr, PtrTag tag)
    210 {
    211     return tagCodePtrImpl<PtrTagAction::DebugAssert>(ptr, tag);
    212200}
    213201
    … …  
    235223}
    236224
    237 template<typename T, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value && !std::is_same<T, PtrType>::value>>
    238 inline T untagCodePtr(PtrType ptr, PtrTag tag)
    239 {
    240     return bitwise_cast<T>(untagCodePtrImpl<PtrTagAction::DebugAssert>(ptr, tag));
    241 }
    242 
    243225template<typename T, PtrTag tag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    244226inline T untagCodePtr(PtrType ptr)
    245227{
    246228    return bitwise_cast<T>(untagCodePtrImpl<PtrTagAction::DebugAssert>(ptr, tag));
    247 }
    248 
    249 template<typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    250 inline PtrType untagCodePtr(PtrType ptr, PtrTag tag)
    251 {
    252     return untagCodePtrImpl<PtrTagAction::DebugAssert>(ptr, tag);
    253229}
    254230
    … …  
    313289}
    314290
    315 template<typename T, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value && !std::is_same<T, PtrType>::value>>
    316 inline T tagCFunctionPtr(PtrType ptr, PtrTag tag)
    317 {
    318     return bitwise_cast<T>(tagCFunctionPtrImpl<PtrTagAction::DebugAssert>(ptr, tag));
    319 }
    320 
    321291template<typename T, PtrTag tag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    322292inline T tagCFunctionPtr(PtrType ptr)
    … …  
    325295}
    326296
    327 template<typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    328 inline PtrType tagCFunctionPtr(PtrType ptr, PtrTag tag)
    329 {
    330     return tagCFunctionPtrImpl<PtrTagAction::DebugAssert>(ptr, tag);
    331 }
    332 
    333297template<PtrTag tag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    334 inline PtrType tagCFunctionPtr(PtrType ptr) { return tagCFunctionPtr(ptr, tag); }
     298inline PtrType tagCFunctionPtr(PtrType ptr) { return tagCFunctionPtrImpl<PtrTagAction::DebugAssert>(ptr, tag); }
    335299
    336300template<PtrTag newTag, typename FunctionType, class = typename std::enable_if<std::is_pointer<FunctionType>::value && std::is_function<typename std::remove_pointer<FunctionType>::type>::value>::type>
    337301inline FunctionType tagCFunction(FunctionType func)
    338302{
    339     ASSERT(isTaggedWith(func, CFunctionPtrTag));
     303    assertIsTaggedWith<CFunctionPtrTag>(func);
    340304    ASSERT(newTag != CFunctionPtrTag);
    341305    return ptrauth_auth_and_resign(func, ptrauth_key_function_pointer, 0, ptrauth_key_process_dependent_code, newTag);
    … …  
    357321}
    358322
    359 template<typename T, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value && !std::is_same<T, PtrType>::value>>
    360 inline T untagCFunctionPtr(PtrType ptr, PtrTag tag)
    361 {
    362     return bitwise_cast<T>(untagCFunctionPtrImpl<PtrTagAction::DebugAssert>(ptr, tag));
    363 }
    364 
    365323template<typename T, PtrTag tag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    366324inline T untagCFunctionPtr(PtrType ptr)
    … …  
    375333}
    376334
    377 template<typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    378 inline PtrType untagCFunctionPtr(PtrType ptr, PtrTag tag)
    379 {
    380     return untagCFunctionPtrImpl<PtrTagAction::DebugAssert>(ptr, tag);
    381 }
    382 
    383335template<PtrTag tag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    384 inline PtrType untagCFunctionPtr(PtrType ptr) { return untagCFunctionPtr(ptr, tag); }
    385 
    386 template <typename IntType>
    387 inline IntType tagInt(IntType ptrInt, PtrTag tag)
     336inline PtrType untagCFunctionPtr(PtrType ptr) { return untagCFunctionPtrImpl<PtrTagAction::DebugAssert>(ptr, tag); }
     337
     338template <PtrTag tag, typename IntType>
     339inline IntType tagInt(IntType ptrInt)
    388340{
    389341    static_assert(sizeof(IntType) == sizeof(uintptr_t), "");
    … …  
    426378}
    427379
    428 template<typename PtrType>
    429 bool isTaggedWith(PtrType value, PtrTag tag)
     380template<PtrTag tag, typename PtrType>
     381bool isTaggedWith(PtrType value)
    430382{
    431383    void* ptr = bitwise_cast<void*>(value);
    … …  
    435387}
    436388
    437 template<typename PtrType>
    438 void assertIsTaggedWith(PtrType value, PtrTag tag)
     389template<PtrTag tag, typename PtrType>
     390void assertIsTaggedWith(PtrType value)
    439391{
    440392    WTF_PTRTAG_ASSERT(PtrTagAction::DebugAssert, value, tag, isTaggedWith(value, tag));
    441393}
    442394
    443 template<typename PtrType>
    444 void assertIsNullOrTaggedWith(PtrType ptr, PtrTag tag)
     395template<PtrTag tag, typename PtrType>
     396void assertIsNullOrTaggedWith(PtrType ptr)
    445397{
    446398    if (ptr)
    447         assertIsTaggedWith(ptr, tag);
     399        assertIsTaggedWith<tag>(ptr);
    448400}
    449401
    … …  
    495447
    496448
    497 template<typename T, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value && !std::is_same<T, PtrType>::value>>
    498 constexpr T tagCodePtr(PtrType ptr, PtrTag) { return bitwise_cast<T>(ptr); }
    499 
    500449template<typename T, PtrTag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    501450inline T tagCodePtr(PtrType ptr) { return bitwise_cast<T>(ptr); }
    502451
    503 template<typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    504 constexpr PtrType tagCodePtr(PtrType ptr, PtrTag) { return ptr; }
    505 
    506452template<PtrTag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    507453inline PtrType tagCodePtr(PtrType ptr) { return ptr; }
    508454
    509 template<typename T, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value && !std::is_same<T, PtrType>::value>>
    510 constexpr T untagCodePtr(PtrType ptr, PtrTag) { return bitwise_cast<T>(ptr); }
    511 
    512455template<typename T, PtrTag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    513456inline T untagCodePtr(PtrType ptr)  { return bitwise_cast<T>(ptr); }
    514457
    515 template<typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    516 constexpr PtrType untagCodePtr(PtrType ptr, PtrTag) { return ptr; }
    517 
    518458template<PtrTag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    519459inline PtrType untagCodePtr(PtrType ptr) { return ptr; }
    … …  
    537477constexpr PtrType removeCodePtrTag(PtrType ptr) { return ptr; }
    538478
    539 template<typename T, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value && !std::is_same<T, PtrType>::value>>
    540 inline T tagCFunctionPtr(PtrType ptr, PtrTag) { return bitwise_cast<T>(ptr); }
    541 
    542479template<typename T, PtrTag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    543480inline T tagCFunctionPtr(PtrType ptr) { return bitwise_cast<T>(ptr); }
    544481
    545 template<typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    546 inline PtrType tagCFunctionPtr(PtrType ptr, PtrTag) { return ptr; }
    547 
    548482template<PtrTag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    549483inline PtrType tagCFunctionPtr(PtrType ptr) { return ptr; }
    … …  
    558492}
    559493
    560 template<typename T, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value && !std::is_same<T, PtrType>::value>>
    561 inline T untagCFunctionPtr(PtrType ptr, PtrTag) { return bitwise_cast<T>(ptr); }
    562 
    563494template<typename T, PtrTag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    564495inline T untagCFunctionPtr(PtrType ptr) { return bitwise_cast<T>(ptr); }
    565496
    566 template<typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    567 inline PtrType untagCFunctionPtr(PtrType ptr, PtrTag) { return ptr; }
    568 
    569497template<PtrTag, typename PtrType, typename = std::enable_if_t<std::is_pointer<PtrType>::value>>
    570498inline PtrType untagCFunctionPtr(PtrType ptr) { return ptr; }
    571499
    572 template <typename IntType>
    573 inline IntType tagInt(IntType ptrInt, PtrTag)
     500template <PtrTag, typename IntType>
     501inline IntType tagInt(IntType ptrInt)
    574502{
    575503    static_assert(sizeof(IntType) == sizeof(uintptr_t), "");
    … …  
    584512template<typename PtrType> void assertIsNullOrTagged(PtrType) { }
    585513
    586 template<typename PtrType> bool isTaggedWith(PtrType, PtrTag) { return false; }
    587 
    588 template<typename PtrType> void assertIsTaggedWith(PtrType, PtrTag) { }
    589 template<typename PtrType> void assertIsNullOrTaggedWith(PtrType, PtrTag) { }
     514template<PtrTag, typename PtrType> bool isTaggedWith(PtrType) { return false; }
     515
     516template<PtrTag, typename PtrType> void assertIsTaggedWith(PtrType) { }
     517template<PtrTag, typename PtrType> void assertIsNullOrTaggedWith(PtrType) { }
    590518
    591519inline bool usesPointerTagging() { return false; }
Note: See TracChangeset for help on using the changeset viewer.