Diff
Modified: trunk/Source/_javascript_Core/CMakeLists.txt (259546 => 259547)
--- trunk/Source/_javascript_Core/CMakeLists.txt 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/CMakeLists.txt 2020-04-05 08:34:43 UTC (rev 259547)
@@ -820,6 +820,7 @@
runtime/DisallowScope.h
runtime/DisallowVMReentry.h
runtime/DumpContext.h
+ runtime/EnsureStillAliveHere.h
runtime/EnumerationMode.h
runtime/Error.h
runtime/ErrorHandlingScope.h
Modified: trunk/Source/_javascript_Core/ChangeLog (259546 => 259547)
--- trunk/Source/_javascript_Core/ChangeLog 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,3 +1,73 @@
+2020-04-05 Mark Lam <[email protected]>
+
+ Add some structureID integrity checks to various runtime functions.
+ https://bugs.webkit.org/show_bug.cgi?id=210015
+ <rdar://problem/58116514>
+
+ Reviewed by Keith Miller.
+
+ Specifically, implementations of toString(), toValue(), and a few others.
+ I also moved the HeapCell version of ensureStillAliveHere() into the new
+ EnsureStillAliveHere.h/cpp since it's useful for any pointers, not just HeapCells.
+
+ This change is performance neutral on JetStream 2.0, Speedometer-2, and PLT5.
+
+ * CMakeLists.txt:
+ * _javascript_Core.xcodeproj/project.pbxproj:
+ * Sources.txt:
+ * heap/HeapCell.cpp:
+ (JSC::ensureStillAliveHere): Deleted.
+ * heap/HeapCell.h:
+ (JSC::ensureStillAliveHere): Deleted.
+ * heap/SlotVisitor.cpp:
+ (JSC::SlotVisitor::appendJSCellOrAuxiliary):
+ * runtime/ArrayPrototype.cpp:
+ (JSC::arrayProtoFuncToString):
+ * runtime/BigIntPrototype.cpp:
+ (JSC::bigIntProtoFuncToStringImpl):
+ (JSC::bigIntProtoFuncValueOf):
+ * runtime/BooleanPrototype.cpp:
+ (JSC::booleanProtoFuncToString):
+ (JSC::booleanProtoFuncValueOf):
+ * runtime/DatePrototype.cpp:
+ (JSC::formatLocaleDate):
+ (JSC::formateDateInstance):
+ (JSC::dateProtoFuncToISOString):
+ (JSC::dateProtoFuncToPrimitiveSymbol):
+ * runtime/EnsureStillAliveHere.cpp: Added.
+ (JSC::ensureStillAliveHere):
+ * runtime/EnsureStillAliveHere.h: Added.
+ (JSC::ensureStillAliveHere):
+ * runtime/ErrorInstance.cpp:
+ (JSC::ErrorInstance::sanitizedToString):
+ * runtime/ErrorPrototype.cpp:
+ (JSC::errorProtoFuncToString):
+ * runtime/FunctionPrototype.cpp:
+ (JSC::functionProtoFuncToString):
+ * runtime/JSCell.cpp:
+ (JSC::JSCell::toObjectSlow const):
+ * runtime/NumberPrototype.cpp:
+ (JSC::toThisNumber):
+ * runtime/ObjectPrototype.cpp:
+ (JSC::objectProtoFuncValueOf):
+ (JSC::objectProtoFuncToString):
+ * runtime/RegExpPrototype.cpp:
+ (JSC::regExpProtoFuncToString):
+ * runtime/StringPrototype.cpp:
+ (JSC::stringProtoFuncToString):
+ * runtime/StructureIDTable.h:
+ (JSC::StructureIDTable::validate):
+ (JSC::StructureIDTable::isValid): Deleted.
+ * runtime/SymbolPrototype.cpp:
+ (JSC::symbolProtoGetterDescription):
+ (JSC::symbolProtoFuncToString):
+ (JSC::symbolProtoFuncValueOf):
+ * tools/Integrity.h:
+ * tools/IntegrityInlines.h:
+ (JSC::Integrity::auditStructureID):
+ * wasm/js/WebAssemblyGlobalPrototype.cpp:
+ (JSC::getGlobal):
+
2020-04-05 Alexey Shvayka <[email protected]>
Octal escapes should be max 3 digits and syntax errors in Unicode patterns
Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (259546 => 259547)
--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1887,6 +1887,7 @@
FE3022D71E42857300BAC493 /* VMInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3022D51E42856700BAC493 /* VMInspector.h */; };
FE318FE01CAC982F00DFCC54 /* ECMAScriptSpecInternalFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */; };
FE3422121D6B81C30032BE88 /* ThrowScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3422111D6B818C0032BE88 /* ThrowScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+ FE34EE2124398AAE00AA2E7C /* EnsureStillAliveHere.h in Headers */ = {isa = PBXBuildFile; fileRef = FE34EE2024398A9A00AA2E7C /* EnsureStillAliveHere.h */; settings = {ATTRIBUTES = (Private, ); }; };
FE3842332324D51B009DD445 /* OptionsList.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3842312324D51B009DD445 /* OptionsList.h */; settings = {ATTRIBUTES = (Private, ); }; };
FE384EE61ADDB7AD0055DE2C /* JSDollarVM.h in Headers */ = {isa = PBXBuildFile; fileRef = FE384EE21ADDB7AD0055DE2C /* JSDollarVM.h */; settings = {ATTRIBUTES = (Private, ); }; };
FE3A06A61C10B72D00390FDD /* JITBitOrGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3A06A41C10B70800390FDD /* JITBitOrGenerator.h */; };
@@ -5121,6 +5122,8 @@
FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ECMAScriptSpecInternalFunctions.cpp; sourceTree = "<group>"; };
FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ECMAScriptSpecInternalFunctions.h; sourceTree = "<group>"; };
FE3422111D6B818C0032BE88 /* ThrowScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThrowScope.h; sourceTree = "<group>"; };
+ FE34EE2024398A9A00AA2E7C /* EnsureStillAliveHere.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = EnsureStillAliveHere.h; sourceTree = "<group>"; };
+ FE34EE2224398B8500AA2E7C /* EnsureStillAliveHere.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EnsureStillAliveHere.cpp; sourceTree = "<group>"; };
FE35C2F021B1E6C5000F4CA8 /* Template.rb */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.ruby; path = Template.rb; sourceTree = "<group>"; };
FE35C2F121B1E6C6000F4CA8 /* Fits.rb */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.ruby; path = Fits.rb; sourceTree = "<group>"; };
FE35C2F221B1E6C6000F4CA8 /* GeneratedFile.rb */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.ruby; path = GeneratedFile.rb; sourceTree = "<group>"; };
@@ -7110,6 +7113,8 @@
A70447EC17A0BD7000F5898E /* DumpContext.h */,
FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */,
FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */,
+ FE34EE2224398B8500AA2E7C /* EnsureStillAliveHere.cpp */,
+ FE34EE2024398A9A00AA2E7C /* EnsureStillAliveHere.h */,
2AD2EDFA19799E38004D6478 /* EnumerationMode.h */,
BC337BEA0E1B00CB0076918A /* Error.cpp */,
BC3046060E1F497F003232CF /* Error.h */,
@@ -8926,6 +8931,7 @@
0FE050141AA9091100D33B33 /* ArgumentsMode.h in Headers */,
79A228361D35D71F00D8E067 /* ArithProfile.h in Headers */,
0F6B1CB91861244C00845D97 /* ArityCheckMode.h in Headers */,
+ FE34EE2124398AAE00AA2E7C /* EnsureStillAliveHere.h in Headers */,
A1A009C11831A26E00CF8711 /* ARM64Assembler.h in Headers */,
FE1E2C402240DD6200F6B729 /* ARM64EAssembler.h in Headers */,
A1A009C11831A26E00CF8722 /* ARM64Registers.h in Headers */,
Modified: trunk/Source/_javascript_Core/Sources.txt (259546 => 259547)
--- trunk/Source/_javascript_Core/Sources.txt 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/Sources.txt 2020-04-05 08:34:43 UTC (rev 259547)
@@ -764,6 +764,7 @@
runtime/DoublePredictionFuzzerAgent.cpp
runtime/DumpContext.cpp
runtime/ECMAScriptSpecInternalFunctions.cpp
+runtime/EnsureStillAliveHere.cpp
runtime/Error.cpp
runtime/ErrorConstructor.cpp
runtime/ErrorHandlingScope.cpp
Modified: trunk/Source/_javascript_Core/heap/HeapCell.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/heap/HeapCell.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/heap/HeapCell.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2016-2020 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -42,13 +42,6 @@
return markedBlockHandle.isLive(this);
}
-#if !COMPILER(GCC_COMPATIBLE)
-// This makes the argument opaque from the compiler.
-NEVER_INLINE void ensureStillAliveHere(const void*)
-{
-}
-#endif
-
} // namespace JSC
namespace WTF {
Modified: trunk/Source/_javascript_Core/heap/HeapCell.h (259546 => 259547)
--- trunk/Source/_javascript_Core/heap/HeapCell.h 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/heap/HeapCell.h 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2016-2020 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -26,6 +26,7 @@
#pragma once
#include "DestructionMode.h"
+#include "EnsureStillAliveHere.h"
namespace JSC {
@@ -37,15 +38,6 @@
class VM;
struct CellAttributes;
-#if COMPILER(GCC_COMPATIBLE)
-ALWAYS_INLINE void ensureStillAliveHere(const void* pointer)
-{
- asm volatile ("" : : "r"(pointer) : "memory");
-}
-#else
-JS_EXPORT_PRIVATE void ensureStillAliveHere(const void*);
-#endif
-
class HeapCell {
public:
enum Kind : int8_t {
Modified: trunk/Source/_javascript_Core/heap/SlotVisitor.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/heap/SlotVisitor.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/heap/SlotVisitor.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2012-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2020 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -200,11 +200,8 @@
if (isNuked(structureID))
die("GC scan found object in bad state: structureID is nuked!\n");
-#if USE(JSVALUE64)
// This detects the worst of the badness.
- if (!heap()->structureIDTable().isValid(structureID))
- die("GC scan found corrupt object: structureID is invalid!\n");
-#endif
+ Integrity::auditStructureID(heap()->structureIDTable(), structureID);
};
// In debug mode, we validate before marking since this makes it clearer what the problem
Modified: trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,6 +1,6 @@
/*
* Copyright (C) 1999-2000 Harri Porten ([email protected])
- * Copyright (C) 2003-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2003-2020 Apple Inc. All rights reserved.
* Copyright (C) 2003 Peter Kelly ([email protected])
* Copyright (C) 2006 Alexey Proskuryakov ([email protected])
*
@@ -31,6 +31,7 @@
#include "CodeBlock.h"
#include "Error.h"
#include "GetterSetter.h"
+#include "IntegrityInlines.h"
#include "Interpreter.h"
#include "JIT.h"
#include "JSArrayInlines.h"
@@ -605,6 +606,7 @@
JSObject* thisObject = thisValue.toObject(globalObject);
RETURN_IF_EXCEPTION(scope, encodedJSValue());
+ Integrity::auditStructureID(vm, thisObject->structureID());
if (!canUseDefaultArrayJoinForToString(vm, thisObject)) {
// 2. Let func be the result of calling the [[Get]] internal method of array with argument "join".
JSValue function = JSValue(thisObject).get(globalObject, vm.propertyNames->join);
Modified: trunk/Source/_javascript_Core/runtime/BigIntPrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/BigIntPrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/BigIntPrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2017 Caio Lima <[email protected]>.
- * Copyright (C) 2017-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2017-2020 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -29,6 +29,7 @@
#include "BigIntObject.h"
#include "Error.h"
+#include "IntegrityInlines.h"
#include "JSBigInt.h"
#include "JSCBuiltins.h"
#include "JSCInlines.h"
@@ -101,6 +102,7 @@
ASSERT(value);
+ Integrity::auditStructureID(vm, value->structureID());
int32_t radix = extractToStringRadixArgument(globalObject, callFrame->argument(0), scope);
RETURN_IF_EXCEPTION(scope, { });
@@ -126,11 +128,14 @@
EncodedJSValue JSC_HOST_CALL bigIntProtoFuncValueOf(JSGlobalObject* globalObject, CallFrame* callFrame)
{
VM& vm = globalObject->vm();
- if (JSBigInt* value = toThisBigIntValue(vm, callFrame->thisValue()))
- return JSValue::encode(value);
-
auto scope = DECLARE_THROW_SCOPE(vm);
- return throwVMTypeError(globalObject, scope, "'this' value must be a BigInt or BigIntObject"_s);
+
+ JSBigInt* value = toThisBigIntValue(vm, callFrame->thisValue());
+ if (!value)
+ return throwVMTypeError(globalObject, scope, "'this' value must be a BigInt or BigIntObject"_s);
+
+ Integrity::auditStructureID(vm, value->structureID());
+ return JSValue::encode(value);
}
} // namespace JSC
Modified: trunk/Source/_javascript_Core/runtime/BooleanPrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/BooleanPrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/BooleanPrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,6 +1,6 @@
/*
* Copyright (C) 1999-2000 Harri Porten ([email protected])
- * Copyright (C) 2003, 2008, 2011, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2003-2020 Apple Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -23,6 +23,7 @@
#include "Error.h"
#include "ExceptionHelpers.h"
+#include "IntegrityInlines.h"
#include "JSFunction.h"
#include "JSString.h"
#include "ObjectPrototype.h"
@@ -80,6 +81,7 @@
if (UNLIKELY(!thisObject))
return throwVMTypeError(globalObject, scope);
+ Integrity::auditStructureID(vm, thisObject->structureID());
if (thisObject->internalValue() == jsBoolean(false))
return JSValue::encode(vm.smallStrings.falseString());
@@ -99,6 +101,7 @@
if (UNLIKELY(!thisObject))
return throwVMTypeError(globalObject, scope);
+ Integrity::auditStructureID(vm, thisObject->structureID());
return JSValue::encode(thisObject->internalValue());
}
Modified: trunk/Source/_javascript_Core/runtime/DatePrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/DatePrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/DatePrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,6 +1,6 @@
/*
* Copyright (C) 1999-2000 Harri Porten ([email protected])
- * Copyright (C) 2004-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2004-2020 Apple Inc. All rights reserved.
* Copyright (C) 2008, 2009 Torch Mobile, Inc. All rights reserved.
* Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
*
@@ -27,6 +27,7 @@
#include "DateConversion.h"
#include "DateInstance.h"
#include "Error.h"
+#include "IntegrityInlines.h"
#include "JSCBuiltins.h"
#include "JSDateMath.h"
#include "JSGlobalObject.h"
@@ -140,9 +141,11 @@
return defaultStyle;
}
-static JSCell* formatLocaleDate(JSGlobalObject* globalObject, CallFrame* callFrame, DateInstance*, double timeInMilliseconds, LocaleDateTimeFormat format)
+static JSCell* formatLocaleDate(JSGlobalObject* globalObject, CallFrame* callFrame, DateInstance* dateObject, double timeInMilliseconds, LocaleDateTimeFormat format)
{
VM& vm = globalObject->vm();
+ Integrity::auditStructureID(vm, dateObject->structureID());
+
CFDateFormatterStyle dateStyle = (format != LocaleTime ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
CFDateFormatterStyle timeStyle = (format != LocaleDate ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
@@ -171,9 +174,11 @@
#elif !UCONFIG_NO_FORMATTING
-static JSCell* formatLocaleDate(JSGlobalObject* globalObject, CallFrame*, DateInstance*, double timeInMilliseconds, LocaleDateTimeFormat format)
+static JSCell* formatLocaleDate(JSGlobalObject* globalObject, CallFrame*, DateInstance* dateObject, double timeInMilliseconds, LocaleDateTimeFormat format)
{
VM& vm = globalObject->vm();
+ Integrity::auditStructureID(vm, dateObject->structureID());
+
UDateFormatStyle timeStyle = (format != LocaleDate ? UDAT_LONG : UDAT_NONE);
UDateFormatStyle dateStyle = (format != LocaleTime ? UDAT_LONG : UDAT_NONE);
@@ -311,6 +316,8 @@
static JSCell* formatLocaleDate(JSGlobalObject* globalObject, CallFrame* callFrame, DateInstance* dateObject, double, LocaleDateTimeFormat format)
{
VM& vm = globalObject->vm();
+ Integrity::auditStructureID(vm, dateObject->structureID());
+
const GregorianDateTime* gregorianDateTime = dateObject->gregorianDateTime(vm);
if (!gregorianDateTime)
return jsNontrivialString(vm, "Invalid Date"_s);
@@ -328,6 +335,7 @@
if (UNLIKELY(!thisDateObj))
return throwVMTypeError(globalObject, scope);
+ Integrity::auditStructureID(vm, thisDateObj->structureID());
const GregorianDateTime* gregorianDateTime = asUTCVariant
? thisDateObj->gregorianDateTimeUTC(vm)
: thisDateObj->gregorianDateTime(vm);
@@ -543,7 +551,8 @@
auto* thisDateObj = jsDynamicCast<DateInstance*>(vm, thisValue);
if (UNLIKELY(!thisDateObj))
return throwVMTypeError(globalObject, scope);
-
+
+ Integrity::auditStructureID(vm, thisDateObj->structureID());
if (!std::isfinite(thisDateObj->internalNumber()))
return throwVMError(globalObject, scope, createRangeError(globalObject, "Invalid Date"_s));
@@ -627,6 +636,7 @@
if (!thisValue.isObject())
return throwVMTypeError(globalObject, scope, "Date.prototype[Symbol.toPrimitive] expected |this| to be an object.");
JSObject* thisObject = jsCast<JSObject*>(thisValue);
+ Integrity::auditStructureID(vm, thisObject->structureID());
if (!callFrame->argumentCount())
return throwVMTypeError(globalObject, scope, "Date.prototype[Symbol.toPrimitive] expected a first argument.");
Added: trunk/Source/_javascript_Core/runtime/EnsureStillAliveHere.cpp (0 => 259547)
--- trunk/Source/_javascript_Core/runtime/EnsureStillAliveHere.cpp (rev 0)
+++ trunk/Source/_javascript_Core/runtime/EnsureStillAliveHere.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2020 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "EnsureStillAliveHere.h"
+
+namespace JSC {
+
+#if !COMPILER(GCC_COMPATIBLE)
+
+// These makes the argument opaque from the compiler.
+
+NEVER_INLINE void ensureStillAliveHere(uint64_t)
+{
+}
+
+NEVER_INLINE void ensureStillAliveHere(const void*)
+{
+}
+
+#endif // !COMPILER(GCC_COMPATIBLE)
+
+} // namespace JSC
Added: trunk/Source/_javascript_Core/runtime/EnsureStillAliveHere.h (0 => 259547)
--- trunk/Source/_javascript_Core/runtime/EnsureStillAliveHere.h (rev 0)
+++ trunk/Source/_javascript_Core/runtime/EnsureStillAliveHere.h 2020-04-05 08:34:43 UTC (rev 259547)
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2020 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+#if COMPILER(GCC_COMPATIBLE)
+
+ALWAYS_INLINE void ensureStillAliveHere(uint64_t value)
+{
+ asm volatile ("" : : "r"(value) : "memory");
+}
+
+ALWAYS_INLINE void ensureStillAliveHere(const void* pointer)
+{
+ asm volatile ("" : : "r"(pointer) : "memory");
+}
+
+#else
+
+JS_EXPORT_PRIVATE void ensureStillAliveHere(uint64_t value);
+JS_EXPORT_PRIVATE void ensureStillAliveHere(const void*);
+
+#endif
+
+} // namespace JSC
Modified: trunk/Source/_javascript_Core/runtime/ErrorInstance.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/ErrorInstance.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/ErrorInstance.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,6 +1,6 @@
/*
* Copyright (C) 1999-2000 Harri Porten ([email protected])
- * Copyright (C) 2003-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2003-2020 Apple Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -23,6 +23,7 @@
#include "CodeBlock.h"
#include "InlineCallFrame.h"
+#include "IntegrityInlines.h"
#include "Interpreter.h"
#include "JSScope.h"
#include "JSCInlines.h"
@@ -139,6 +140,7 @@
{
VM& vm = globalObject->vm();
auto scope = DECLARE_THROW_SCOPE(vm);
+ Integrity::auditStructureID(vm, structureID());
JSValue nameValue;
auto namePropertName = vm.propertyNames->name;
Modified: trunk/Source/_javascript_Core/runtime/ErrorPrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/ErrorPrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/ErrorPrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,6 +1,6 @@
/*
* Copyright (C) 1999-2000 Harri Porten ([email protected])
- * Copyright (C) 2003-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2003-2020 Apple Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -22,6 +22,7 @@
#include "ErrorPrototype.h"
#include "Error.h"
+#include "IntegrityInlines.h"
#include "JSFunction.h"
#include "JSStringInlines.h"
#include "ObjectPrototype.h"
@@ -82,6 +83,7 @@
if (!thisValue.isObject())
return throwVMTypeError(globalObject, scope);
JSObject* thisObj = asObject(thisValue);
+ Integrity::auditStructureID(vm, thisObj->structureID());
// Guard against recursion!
StringRecursionChecker checker(globalObject, thisObj);
Modified: trunk/Source/_javascript_Core/runtime/FunctionPrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/FunctionPrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/FunctionPrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,6 +1,6 @@
/*
* Copyright (C) 1999-2001 Harri Porten ([email protected])
- * Copyright (C) 2003-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2003-2020 Apple Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -25,6 +25,7 @@
#include "BuiltinNames.h"
#include "Error.h"
#include "GetterSetter.h"
+#include "IntegrityInlines.h"
#include "JSAsyncFunction.h"
#include "JSCInlines.h"
#include "JSFunction.h"
@@ -84,6 +85,7 @@
JSValue thisValue = callFrame->thisValue();
if (thisValue.inherits<JSFunction>(vm)) {
JSFunction* function = jsCast<JSFunction*>(thisValue);
+ Integrity::auditStructureID(vm, function->structureID());
if (function->isHostOrBuiltinFunction())
RELEASE_AND_RETURN(scope, JSValue::encode(jsMakeNontrivialString(globalObject, "function ", function->name(vm), "() {\n [native code]\n}")));
@@ -140,11 +142,13 @@
if (thisValue.inherits<InternalFunction>(vm)) {
InternalFunction* function = jsCast<InternalFunction*>(thisValue);
+ Integrity::auditStructureID(vm, function->structureID());
RELEASE_AND_RETURN(scope, JSValue::encode(jsMakeNontrivialString(globalObject, "function ", function->name(), "() {\n [native code]\n}")));
}
if (thisValue.isObject()) {
JSObject* object = asObject(thisValue);
+ Integrity::auditStructureID(vm, object->structureID());
if (object->isFunction(vm))
RELEASE_AND_RETURN(scope, JSValue::encode(jsMakeNontrivialString(globalObject, "function ", object->classInfo(vm)->className, "() {\n [native code]\n}")));
}
Modified: trunk/Source/_javascript_Core/runtime/JSCell.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/JSCell.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/JSCell.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,7 +1,7 @@
/*
* Copyright (C) 1999-2001 Harri Porten ([email protected])
* Copyright (C) 2001 Peter Kelly ([email protected])
- * Copyright (C) 2003-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2003-2020 Apple Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Library General Public
@@ -25,6 +25,7 @@
#include "ArrayBufferView.h"
#include "BlockDirectoryInlines.h"
+#include "IntegrityInlines.h"
#include "IsoSubspaceInlines.h"
#include "JSCInlines.h"
#include "JSCast.h"
@@ -191,6 +192,7 @@
JSObject* JSCell::toObjectSlow(JSGlobalObject* globalObject) const
{
+ Integrity::auditStructureID(globalObject->vm(), structureID());
ASSERT(!isObject());
if (isString())
return static_cast<const JSString*>(this)->toObject(globalObject);
Modified: trunk/Source/_javascript_Core/runtime/NumberPrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/NumberPrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/NumberPrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,6 +1,6 @@
/*
* Copyright (C) 1999-2000,2003 Harri Porten ([email protected])
- * Copyright (C) 2007-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2007-2020 Apple Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -24,6 +24,7 @@
#include "BigInteger.h"
#include "Error.h"
+#include "IntegrityInlines.h"
#include "IntlNumberFormat.h"
#include "IntlObject.h"
#include "JSCInlines.h"
@@ -98,6 +99,7 @@
}
if (auto* numberObject = jsDynamicCast<NumberObject*>(vm, thisValue)) {
+ Integrity::auditStructureID(vm, numberObject->structureID());
x = numberObject->internalValue().asNumber();
return true;
}
Modified: trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,6 +1,6 @@
/*
* Copyright (C) 1999-2000 Harri Porten ([email protected])
- * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2020 Apple Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -24,6 +24,7 @@
#include "Error.h"
#include "GetterSetter.h"
#include "HasOwnPropertyCache.h"
+#include "IntegrityInlines.h"
#include "JSFunction.h"
#include "JSString.h"
#include "JSCInlines.h"
@@ -84,6 +85,7 @@
JSObject* valueObj = thisValue.toObject(globalObject);
if (UNLIKELY(!valueObj))
return encodedJSValue();
+ Integrity::auditStructureID(globalObject->vm(), valueObj->structureID());
return JSValue::encode(valueObj);
}
@@ -321,6 +323,7 @@
if (!thisObject)
return JSValue::encode(jsUndefined());
+ Integrity::auditStructureID(vm, thisObject->structureID());
auto result = thisObject->structure(vm)->objectToStringValue();
if (result)
return JSValue::encode(result);
Modified: trunk/Source/_javascript_Core/runtime/RegExpPrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/RegExpPrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/RegExpPrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,6 +1,6 @@
/*
* Copyright (C) 1999-2000 Harri Porten ([email protected])
- * Copyright (C) 2003-2019 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2003-2020 Apple Inc. All Rights Reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -24,6 +24,7 @@
#include "ArrayPrototype.h"
#include "BuiltinNames.h"
#include "Error.h"
+#include "IntegrityInlines.h"
#include "JSArray.h"
#include "JSCBuiltins.h"
#include "JSCInlines.h"
@@ -217,6 +218,7 @@
return throwVMTypeError(globalObject, scope);
JSObject* thisObject = asObject(thisValue);
+ Integrity::auditStructureID(vm, thisObject->structureID());
StringRecursionChecker checker(globalObject, thisObject);
EXCEPTION_ASSERT(!scope.exception() || checker.earlyReturnValue());
Modified: trunk/Source/_javascript_Core/runtime/StringPrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/StringPrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/StringPrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,6 +1,6 @@
/*
* Copyright (C) 1999-2001 Harri Porten ([email protected])
- * Copyright (C) 2004-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2004-2020 Apple Inc. All rights reserved.
* Copyright (C) 2009 Torch Mobile, Inc.
* Copyright (C) 2015 Jordan Harband ([email protected])
*
@@ -29,6 +29,7 @@
#include "Error.h"
#include "ExecutableBaseInlines.h"
#include "FrameTracers.h"
+#include "IntegrityInlines.h"
#include "InterpreterInlines.h"
#include "IntlCollator.h"
#include "IntlObject.h"
@@ -979,10 +980,11 @@
return JSValue::encode(thisValue);
auto* stringObject = jsDynamicCast<StringObject*>(vm, thisValue);
- if (stringObject)
- return JSValue::encode(stringObject->internalValue());
+ if (!stringObject)
+ return throwVMTypeError(globalObject, scope);
- return throwVMTypeError(globalObject, scope);
+ Integrity::auditStructureID(vm, stringObject->structureID());
+ return JSValue::encode(stringObject->internalValue());
}
EncodedJSValue JSC_HOST_CALL stringProtoFuncCharAt(JSGlobalObject* globalObject, CallFrame* callFrame)
Modified: trunk/Source/_javascript_Core/runtime/StructureIDTable.h (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/StructureIDTable.h 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/StructureIDTable.h 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -25,6 +25,7 @@
#pragma once
+#include "EnsureStillAliveHere.h"
#include "UnusedPointer.h"
#include <wtf/UniqueArray.h>
#include <wtf/Vector.h>
@@ -91,7 +92,8 @@
void** base() { return reinterpret_cast<void**>(&m_table); }
- bool isValid(StructureID);
+ ALWAYS_INLINE void validate(StructureID);
+
Structure* get(StructureID);
void deallocateID(Structure*, StructureID);
StructureID allocateID(Structure*);
@@ -176,19 +178,13 @@
return decode(table()[structureIndex].encodedStructureBits, structureID);
}
-inline bool StructureIDTable::isValid(StructureID structureID)
+ALWAYS_INLINE void StructureIDTable::validate(StructureID structureID)
{
- if (!structureID)
- return false;
uint32_t structureIndex = structureID >> s_numberOfEntropyBits;
- if (structureIndex >= m_capacity)
- return false;
-#if CPU(ADDRESS64)
Structure* structure = decode(table()[structureIndex].encodedStructureBits, structureID);
- if (reinterpret_cast<uintptr_t>(structure) >> s_entropyBitsShiftForStructurePointer)
- return false;
-#endif
- return true;
+ RELEASE_ASSERT(structureIndex < m_capacity);
+ uint64_t value = *bitwise_cast<uint64_t*>(structure);
+ ensureStillAliveHere(value);
}
#else // not USE(JSVALUE64)
@@ -207,6 +203,7 @@
};
void flushOldTables() { }
+ void validate(StructureID) { }
};
#endif // not USE(JSVALUE64)
Modified: trunk/Source/_javascript_Core/runtime/SymbolPrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/runtime/SymbolPrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/runtime/SymbolPrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2012-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2020 Apple Inc. All rights reserved.
* Copyright (C) 2015 Yusuke Suzuki <[email protected]>.
*
* Redistribution and use in source and binary forms, with or without
@@ -28,6 +28,7 @@
#include "SymbolPrototype.h"
#include "Error.h"
+#include "IntegrityInlines.h"
#include "JSCInlines.h"
#include "JSString.h"
#include "SymbolObject.h"
@@ -97,6 +98,7 @@
if (!symbol)
return throwVMTypeError(globalObject, scope, SymbolDescriptionTypeError);
scope.release();
+ Integrity::auditStructureID(vm, symbol->structureID());
const auto description = symbol->description();
return JSValue::encode(description.isNull() ? jsUndefined() : jsString(vm, description));
}
@@ -109,6 +111,7 @@
Symbol* symbol = tryExtractSymbol(vm, callFrame->thisValue());
if (!symbol)
return throwVMTypeError(globalObject, scope, SymbolToStringTypeError);
+ Integrity::auditStructureID(vm, symbol->structureID());
RELEASE_AND_RETURN(scope, JSValue::encode(jsNontrivialString(vm, symbol->descriptiveString())));
}
@@ -121,6 +124,7 @@
if (!symbol)
return throwVMTypeError(globalObject, scope, SymbolValueOfTypeError);
+ Integrity::auditStructureID(vm, symbol->structureID());
RELEASE_AND_RETURN(scope, JSValue::encode(symbol));
}
Modified: trunk/Source/_javascript_Core/tools/Integrity.h (259546 => 259547)
--- trunk/Source/_javascript_Core/tools/Integrity.h 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/tools/Integrity.h 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2019-2020 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -32,6 +32,7 @@
namespace JSC {
class JSCell;
+class StructureIDTable;
class VM;
namespace Integrity {
@@ -99,6 +100,9 @@
auditCell<auditLevel>(vm, value.asCell());
}
+ALWAYS_INLINE void auditStructureID(StructureIDTable&, StructureID);
+ALWAYS_INLINE void auditStructureID(VM&, StructureID);
+
} // namespace Integrity
} // namespace JSC
Modified: trunk/Source/_javascript_Core/tools/IntegrityInlines.h (259546 => 259547)
--- trunk/Source/_javascript_Core/tools/IntegrityInlines.h 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/tools/IntegrityInlines.h 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2019-2020 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -73,5 +73,15 @@
auditCellFully(vm, cell);
}
+ALWAYS_INLINE void auditStructureID(StructureIDTable& table, StructureID id)
+{
+ table.validate(id);
+}
+
+ALWAYS_INLINE void auditStructureID(VM& vm, StructureID id)
+{
+ auditStructureID(vm.heap.structureIDTable(), id);
+}
+
} // namespace Integrity
} // namespace JSC
Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyGlobalPrototype.cpp (259546 => 259547)
--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyGlobalPrototype.cpp 2020-04-05 08:12:54 UTC (rev 259546)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyGlobalPrototype.cpp 2020-04-05 08:34:43 UTC (rev 259547)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2019-2020 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -30,6 +30,7 @@
#include "FunctionPrototype.h"
#include "GetterSetter.h"
+#include "IntegrityInlines.h"
#include "JSCInlines.h"
#include "JSWebAssemblyGlobal.h"
#include "JSWebAssemblyHelpers.h"
@@ -61,6 +62,7 @@
createTypeError(globalObject, "expected |this| value to be an instance of WebAssembly.Global"_s));
return nullptr;
}
+ Integrity::auditStructureID(vm, result->structureID());
return result;
}
