WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
[patch]
new patch
blah.patch (text/plain), 39.94 KB, created by
Filip Pizlo
on 2018-01-30 10:25:55 PST
(
hide
)
Description:
new patch
Filename:
MIME Type:
Creator:
Filip Pizlo
Created:
2018-01-30 10:25:55 PST
Size:
39.94 KB
patch
obsolete
>Index: Source/JavaScriptCore/ChangeLog >=================================================================== >--- Source/JavaScriptCore/ChangeLog (revision 227738) >+++ Source/JavaScriptCore/ChangeLog (working copy) >@@ -1,3 +1,74 @@ >+2018-01-28 Filip Pizlo <fpizlo@apple.com> >+ >+ Global objects should be able to use TLCs to allocate from different blocks from each other >+ https://bugs.webkit.org/show_bug.cgi?id=182227 >+ >+ Reviewed by JF Bastien. >+ >+ This uses TLCs to create at least `minimumDistanceBetweenCellsFromDifferenOrigins` bytes of >+ distance between objects from different origins, using the following combination of things. For >+ short lets refer to that constant as K. >+ >+ - Since r227721, LargeAllocation puts K bytes padding at the end of each allocation. >+ >+ - Since r227718, MarkedBlock puts at least K bytes in its footer. >+ >+ - Since r227617, global objects can have their own TLCs, which make them allocate from a >+ different set of blocks than other global objects. The TLC of a global object comes into >+ effect when you enter the VM via that global object. >+ >+ - With this change, TLCs and blocks both have security origins. A TLC will only use blocks that >+ share the same security origin or empty blocks (in which case we zero the block and change >+ its security origin). >+ >+ WebCore determines the TLC-GlobalObject mapping. By default, global objects would simply use >+ the VM's default TLC. WebCore makes it so that DOM windows (but not worker global objects) get >+ a TLC from their document's SecurityOrigin. Each SecurityOrigin is able to vend you a TLC on >+ demand. >+ >+ * JavaScriptCore.xcodeproj/project.pbxproj: >+ * Sources.txt: >+ * heap/BlockDirectory.cpp: >+ (JSC::BlockDirectory::findBlockForAllocation): >+ (JSC::BlockDirectory::prepareForAllocation): >+ * heap/BlockDirectory.h: >+ * heap/LocalAllocator.cpp: >+ (JSC::LocalAllocator::LocalAllocator): >+ (JSC::LocalAllocator::reset): >+ (JSC::LocalAllocator::~LocalAllocator): >+ (JSC::LocalAllocator::allocateSlowCase): >+ (JSC::LocalAllocator::tryAllocateWithoutCollecting): >+ * heap/LocalAllocator.h: >+ (JSC::LocalAllocator::tlc const): >+ * heap/MarkStackMergingConstraint.cpp: >+ * heap/MarkStackMergingConstraint.h: >+ * heap/MarkedBlock.cpp: >+ (JSC::MarkedBlock::Handle::associateWithOrigin): >+ * heap/MarkedBlock.h: >+ (JSC::MarkedBlock::Handle::securityOriginToken const): >+ * heap/SecurityOriginToken.cpp: Added. >+ (JSC::uniqueSecurityOriginToken): >+ * heap/SecurityOriginToken.h: Added. >+ * heap/ThreadLocalCache.cpp: >+ (JSC::ThreadLocalCache::create): >+ (JSC::ThreadLocalCache::ThreadLocalCache): >+ (JSC::ThreadLocalCache::allocateData): >+ (JSC::ThreadLocalCache::installSlow): >+ * heap/ThreadLocalCache.h: >+ (JSC::ThreadLocalCache::securityOriginToken const): >+ * heap/ThreadLocalCacheInlines.h: >+ (JSC::ThreadLocalCache::install): >+ * runtime/JSGlobalObject.cpp: >+ (JSC::JSGlobalObject::JSGlobalObject): >+ (JSC::JSGlobalObject::createThreadLocalCache): >+ * runtime/JSGlobalObject.h: >+ (JSC::JSGlobalObject::threadLocalCache): >+ (JSC::JSGlobalObject::threadLocalCache const): Deleted. >+ * runtime/VMEntryScope.cpp: >+ (JSC::VMEntryScope::VMEntryScope): >+ (JSC::VMEntryScope::~VMEntryScope): >+ * runtime/VMEntryScope.h: >+ > 2018-01-29 Matt Lewis <jlewis3@apple.com> > > Unreviewed, rolling out r227725. >Index: Source/JavaScriptCore/Sources.txt >=================================================================== >--- Source/JavaScriptCore/Sources.txt (revision 227738) >+++ Source/JavaScriptCore/Sources.txt (working copy) >@@ -1,4 +1,4 @@ >-// Copyright (C) 2017 Apple Inc. All rights reserved. >+// Copyright (C) 2017-2018 Apple Inc. All rights reserved. > // > // Redistribution and use in source and binary forms, with or without > // modification, are permitted provided that the following conditions >@@ -512,6 +512,7 @@ heap/MarkingConstraintSet.cpp > heap/MarkingConstraintSolver.cpp > heap/MutatorScheduler.cpp > heap/MutatorState.cpp >+heap/SecurityOriginToken.cpp > heap/SimpleMarkingConstraint.cpp > heap/SlotVisitor.cpp > heap/SpaceTimeMutatorScheduler.cpp >Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj >=================================================================== >--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (revision 227738) >+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (working copy) >@@ -294,6 +294,7 @@ > 0F426A481460CBB300131F8F /* ValueRecovery.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A451460CBAB00131F8F /* ValueRecovery.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 0F426A491460CBB700131F8F /* VirtualRegister.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A461460CBAB00131F8F /* VirtualRegister.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 0F426A4B1460CD6E00131F8F /* DataFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A4A1460CD6B00131F8F /* DataFormat.h */; settings = {ATTRIBUTES = (Private, ); }; }; >+ 0F42B3C3201EC9FF00357031 /* SecurityOriginToken.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F42B3C2201EC9FD00357031 /* SecurityOriginToken.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 0F431738146BAC69007E3890 /* ListableHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F431736146BAC65007E3890 /* ListableHandler.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 0F4570391BE44C910062A629 /* AirEliminateDeadCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4570371BE44C910062A629 /* AirEliminateDeadCode.h */; }; > 0F45703D1BE45F0A0062A629 /* AirReportUsedRegisters.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F45703B1BE45F0A0062A629 /* AirReportUsedRegisters.h */; }; >@@ -2262,6 +2263,8 @@ > 0F426A451460CBAB00131F8F /* ValueRecovery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ValueRecovery.h; sourceTree = "<group>"; }; > 0F426A461460CBAB00131F8F /* VirtualRegister.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VirtualRegister.h; sourceTree = "<group>"; }; > 0F426A4A1460CD6B00131F8F /* DataFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataFormat.h; sourceTree = "<group>"; }; >+ 0F42B3C0201EB50900357031 /* Allocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Allocator.cpp; sourceTree = "<group>"; }; >+ 0F42B3C2201EC9FD00357031 /* SecurityOriginToken.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SecurityOriginToken.h; sourceTree = "<group>"; }; > 0F431736146BAC65007E3890 /* ListableHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ListableHandler.h; sourceTree = "<group>"; }; > 0F4570361BE44C910062A629 /* AirEliminateDeadCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirEliminateDeadCode.cpp; path = b3/air/AirEliminateDeadCode.cpp; sourceTree = "<group>"; }; > 0F4570371BE44C910062A629 /* AirEliminateDeadCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirEliminateDeadCode.h; path = b3/air/AirEliminateDeadCode.h; sourceTree = "<group>"; }; >@@ -5559,21 +5562,14 @@ > 142E312A134FF0A600AFADB5 /* heap */ = { > isa = PBXGroup; > children = ( >- 0F75A054200D25EF0038E2CF /* Allocator.h */, >- 0F75A05D200D25F10038E2CF /* AllocatorInlines.h */, >- 0F75A059200D25F00038E2CF /* LocalAllocator.cpp */, >- 0F75A057200D25F00038E2CF /* LocalAllocator.h */, >- 0F75A05A200D25F00038E2CF /* LocalAllocatorInlines.h */, >- 0F75A058200D25F00038E2CF /* ThreadLocalCache.cpp */, >- 0F75A055200D25EF0038E2CF /* ThreadLocalCache.h */, >- 0F75A056200D25EF0038E2CF /* ThreadLocalCacheInlines.h */, >- 0F75A05B200D25F10038E2CF /* ThreadLocalCacheLayout.cpp */, >- 0F75A05C200D25F10038E2CF /* ThreadLocalCacheLayout.h */, > 0FEC3C501F33A41600F59B6C /* AlignedMemoryAllocator.cpp */, > 0FEC3C511F33A41600F59B6C /* AlignedMemoryAllocator.h */, > 0FA7620A1DB959F600B7A2FD /* AllocatingScope.h */, > 0FDCE11B1FAE61F4006F3901 /* AllocationFailureMode.h */, >+ 0F42B3C0201EB50900357031 /* Allocator.cpp */, >+ 0F75A054200D25EF0038E2CF /* Allocator.h */, > 0F30CB5D1FCE46B4004B5323 /* AllocatorForMode.h */, >+ 0F75A05D200D25F10038E2CF /* AllocatorInlines.h */, > 0FB4677E1FDDA6E5003FCB09 /* AtomIndices.h */, > C2B916C414DA040C00CBAC86 /* BlockDirectory.cpp */, > C2B916C114DA014E00CBAC86 /* BlockDirectory.h */, >@@ -5674,6 +5670,9 @@ > 0F070A451D543A89006E7232 /* LargeAllocation.cpp */, > 0F070A461D543A89006E7232 /* LargeAllocation.h */, > 0F431736146BAC65007E3890 /* ListableHandler.h */, >+ 0F75A059200D25F00038E2CF /* LocalAllocator.cpp */, >+ 0F75A057200D25F00038E2CF /* LocalAllocator.h */, >+ 0F75A05A200D25F00038E2CF /* LocalAllocatorInlines.h */, > 0F208AD61DF0925A007D3269 /* LockDuringMarking.h */, > 14B7233F12D7D0DA003BD5ED /* MachineStackMarker.cpp */, > 14B7234012D7D0DA003BD5ED /* MachineStackMarker.h */, >@@ -5703,6 +5702,7 @@ > 0FD0E5EF1E46BF230006AB08 /* RegisterState.h */, > 0F7CF94E1DBEEE860098CC12 /* ReleaseHeapAccessScope.h */, > 0F2C63A91E4FA42C00C13839 /* RunningScope.h */, >+ 0F42B3C2201EC9FD00357031 /* SecurityOriginToken.h */, > 0F4D8C761FCA3CF2001D32AC /* SimpleMarkingConstraint.cpp */, > 0F4D8C771FCA3CF3001D32AC /* SimpleMarkingConstraint.h */, > C225494215F7DBAA0065E898 /* SlotVisitor.cpp */, >@@ -5724,6 +5724,11 @@ > 0FD79A2C1EBBBDB200DA88D3 /* Synchronousness.h */, > 0F1FB38A1E173A6200A9BE50 /* SynchronousStopTheWorldMutatorScheduler.cpp */, > 0F1FB38B1E173A6200A9BE50 /* SynchronousStopTheWorldMutatorScheduler.h */, >+ 0F75A058200D25F00038E2CF /* ThreadLocalCache.cpp */, >+ 0F75A055200D25EF0038E2CF /* ThreadLocalCache.h */, >+ 0F75A056200D25EF0038E2CF /* ThreadLocalCacheInlines.h */, >+ 0F75A05B200D25F10038E2CF /* ThreadLocalCacheLayout.cpp */, >+ 0F75A05C200D25F10038E2CF /* ThreadLocalCacheLayout.h */, > 141448CC13A1783700F5BA1A /* TinyBloomFilter.h */, > 0F5F08CE146C762F000472A9 /* UnconditionalFinalizer.h */, > 0F4D8C721FC7A973001D32AC /* VisitCounter.h */, >@@ -8522,6 +8527,7 @@ > 0F7C39FF1C90C55B00480151 /* DFGOpInfo.h in Headers */, > A7D89CFE17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.h in Headers */, > 0FD82E57141DAF1000179C94 /* DFGOSREntry.h in Headers */, >+ 0F42B3C3201EC9FF00357031 /* SecurityOriginToken.h in Headers */, > 0FD8A32617D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.h in Headers */, > 0FC0976A1468A6F700CF2442 /* DFGOSRExit.h in Headers */, > 0F235BEC17178E7300690C7F /* DFGOSRExitBase.h in Headers */, >Index: Source/JavaScriptCore/heap/BlockDirectory.cpp >=================================================================== >--- Source/JavaScriptCore/heap/BlockDirectory.cpp (revision 227738) >+++ Source/JavaScriptCore/heap/BlockDirectory.cpp (working copy) >@@ -33,6 +33,7 @@ > #include "JSCInlines.h" > #include "MarkedBlockInlines.h" > #include "SuperSampler.h" >+#include "ThreadLocalCacheInlines.h" > #include "VM.h" > #include <wtf/CurrentTime.h> > >@@ -80,14 +81,20 @@ MarkedBlock::Handle* BlockDirectory::fin > return m_blocks[m_emptyCursor]; > } > >-MarkedBlock::Handle* BlockDirectory::findBlockForAllocation() >+MarkedBlock::Handle* BlockDirectory::findBlockForAllocation(LocalAllocator& allocator) > { >- m_allocationCursor = (m_canAllocateButNotEmpty | m_empty).findBit(m_allocationCursor, true); >- if (m_allocationCursor >= m_blocks.size()) >- return nullptr; >- >- setIsCanAllocateButNotEmpty(NoLockingNecessary, m_allocationCursor, false); >- return m_blocks[m_allocationCursor]; >+ for (;;) { >+ allocator.m_allocationCursor = (m_canAllocateButNotEmpty | m_empty).findBit(allocator.m_allocationCursor, true); >+ if (allocator.m_allocationCursor >= m_blocks.size()) >+ return nullptr; >+ >+ size_t blockIndex = allocator.m_allocationCursor++; >+ MarkedBlock::Handle* result = m_blocks[blockIndex]; >+ if (result->securityOriginToken() == allocator.tlc()->securityOriginToken()) { >+ setIsCanAllocateButNotEmpty(NoLockingNecessary, blockIndex, false); >+ return result; >+ } >+ } > } > > MarkedBlock::Handle* BlockDirectory::tryAllocateBlock() >@@ -183,8 +190,6 @@ void BlockDirectory::prepareForAllocatio > allocator->prepareForAllocation(); > }); > >- m_allocationCursor = 0; >- m_emptyCursor = 0; > m_unsweptCursor = 0; > > m_eden.clearAll(); >Index: Source/JavaScriptCore/heap/BlockDirectory.h >=================================================================== >--- Source/JavaScriptCore/heap/BlockDirectory.h (revision 227738) >+++ Source/JavaScriptCore/heap/BlockDirectory.h (working copy) >@@ -43,6 +43,7 @@ class Heap; > class IsoCellSet; > class MarkedSpace; > class LLIntOffsetsExtractor; >+class ThreadLocalCache; > class ThreadLocalCacheLayout; > > #define FOR_EACH_BLOCK_DIRECTORY_BIT(macro) \ >@@ -162,12 +163,13 @@ public: > void dumpBits(PrintStream& = WTF::dataFile()); > > private: >- friend class LocalAllocator; > friend class IsoCellSet; >+ friend class LocalAllocator; >+ friend class LocalSideAllocator; > friend class MarkedBlock; > friend class ThreadLocalCacheLayout; > >- MarkedBlock::Handle* findBlockForAllocation(); >+ MarkedBlock::Handle* findBlockForAllocation(LocalAllocator&); > > MarkedBlock::Handle* tryAllocateBlock(); > >@@ -184,8 +186,7 @@ private: > > // After you do something to a block based on one of these cursors, you clear the bit in the > // corresponding bitvector and leave the cursor where it was. >- size_t m_allocationCursor { 0 }; // Points to the next block that is a candidate for allocation. >- size_t m_emptyCursor { 0 }; // Points to the next block that is a candidate for empty allocation (allocating in empty blocks). >+ size_t m_emptyCursor { 0 }; > size_t m_unsweptCursor { 0 }; // Points to the next block that is a candidate for incremental sweeping. > > unsigned m_cellSize; >Index: Source/JavaScriptCore/heap/LocalAllocator.cpp >=================================================================== >--- Source/JavaScriptCore/heap/LocalAllocator.cpp (revision 227738) >+++ Source/JavaScriptCore/heap/LocalAllocator.cpp (working copy) >@@ -32,8 +32,9 @@ > > namespace JSC { > >-LocalAllocator::LocalAllocator(BlockDirectory* directory) >- : m_directory(directory) >+LocalAllocator::LocalAllocator(ThreadLocalCache* tlc, BlockDirectory* directory) >+ : m_tlc(tlc) >+ , m_directory(directory) > , m_cellSize(directory->m_cellSize) > , m_freeList(m_cellSize) > { >@@ -42,11 +43,13 @@ LocalAllocator::LocalAllocator(BlockDire > } > > LocalAllocator::LocalAllocator(LocalAllocator&& other) >- : m_directory(other.m_directory) >+ : m_tlc(other.m_tlc) >+ , m_directory(other.m_directory) > , m_cellSize(other.m_cellSize) > , m_freeList(WTFMove(other.m_freeList)) > , m_currentBlock(other.m_currentBlock) > , m_lastActiveBlock(other.m_lastActiveBlock) >+ , m_allocationCursor(other.m_allocationCursor) > { > other.reset(); > if (other.isOnList()) { >@@ -61,6 +64,7 @@ void LocalAllocator::reset() > m_freeList.clear(); > m_currentBlock = nullptr; > m_lastActiveBlock = nullptr; >+ m_allocationCursor = 0; > } > > LocalAllocator::~LocalAllocator() >@@ -80,6 +84,15 @@ LocalAllocator::~LocalAllocator() > // that it is not reachable. Therefore, the TLC should still be in a fully reset state at the > // time of destruction because for it to get into any other state, someone must have allocated > // in it (which is impossible because it's supposedly unreachable). >+ // >+ // My biggest worry with these assertions is that there will be some TLC that gets set as the >+ // current one but then never reset, and in the meantime the global object that owns it gets >+ // destroyed. >+ // >+ // Note that if we did hold onto some memory and we wanted to return it then this could be weird. >+ // We would potentially have to stopAllocating(). That would mean having to return a block to the >+ // BlockDirectory. It's not clear that the BlockDirectory is prepared to handle that during >+ // sweeping another block, for example. > bool ok = true; > if (!m_freeList.allocationWillFail()) { > dataLog("FATAL: ", RawPointer(this), "->~LocalAllocator has non-empty free-list.\n"); >@@ -164,6 +177,7 @@ void* LocalAllocator::allocateSlowCase(G > else > return nullptr; > } >+ block->associateWithOrigin(m_tlc->securityOriginToken()); > m_directory->addBlock(block); > result = allocateIn(block); > ASSERT(result); >@@ -201,7 +215,7 @@ void* LocalAllocator::tryAllocateWithout > ASSERT(m_freeList.allocationWillFail()); > > for (;;) { >- MarkedBlock::Handle* block = m_directory->findBlockForAllocation(); >+ MarkedBlock::Handle* block = m_directory->findBlockForAllocation(*this); > if (!block) > break; > >@@ -220,6 +234,7 @@ void* LocalAllocator::tryAllocateWithout > // because there is a remote chance that a block may have both canAllocateButNotEmpty > // and empty set at the same time. > block->removeFromDirectory(); >+ block->associateWithOrigin(m_tlc->securityOriginToken()); > m_directory->addBlock(block); > return allocateIn(block); > } >Index: Source/JavaScriptCore/heap/LocalAllocator.h >=================================================================== >--- Source/JavaScriptCore/heap/LocalAllocator.h (revision 227738) >+++ Source/JavaScriptCore/heap/LocalAllocator.h (working copy) >@@ -33,12 +33,13 @@ namespace JSC { > > class BlockDirectory; > class GCDeferralContext; >+class ThreadLocalCache; > > class LocalAllocator : public BasicRawSentinelNode<LocalAllocator> { > WTF_MAKE_NONCOPYABLE(LocalAllocator); > > public: >- LocalAllocator(BlockDirectory*); >+ LocalAllocator(ThreadLocalCache*, BlockDirectory*); > LocalAllocator(LocalAllocator&&); > ~LocalAllocator(); > >@@ -53,8 +54,12 @@ public: > static ptrdiff_t offsetOfCellSize(); > > bool isFreeListedCell(const void*) const; >+ >+ ThreadLocalCache* tlc() const { return m_tlc; } > > private: >+ friend class BlockDirectory; >+ > void reset(); > JS_EXPORT_PRIVATE void* allocateSlowCase(GCDeferralContext*, AllocationFailureMode failureMode); > void didConsumeFreeList(); >@@ -63,11 +68,16 @@ private: > void* allocateIn(MarkedBlock::Handle*); > ALWAYS_INLINE void doTestCollectionsIfNeeded(GCDeferralContext*); > >+ ThreadLocalCache* m_tlc; > BlockDirectory* m_directory; > unsigned m_cellSize; > FreeList m_freeList; > MarkedBlock::Handle* m_currentBlock { nullptr }; > MarkedBlock::Handle* m_lastActiveBlock { nullptr }; >+ >+ // After you do something to a block based on one of these cursors, you clear the bit in the >+ // corresponding bitvector and leave the cursor where it was. >+ size_t m_allocationCursor { 0 }; // Points to the next block that is a candidate for allocation. > }; > > inline ptrdiff_t LocalAllocator::offsetOfFreeList() >Index: Source/JavaScriptCore/heap/MarkStackMergingConstraint.cpp >=================================================================== >--- Source/JavaScriptCore/heap/MarkStackMergingConstraint.cpp (revision 227738) >+++ Source/JavaScriptCore/heap/MarkStackMergingConstraint.cpp (working copy) >@@ -26,6 +26,9 @@ > #include "config.h" > #include "MarkStackMergingConstraint.h" > >+#include "GCSegmentedArrayInlines.h" >+#include "JSCInlines.h" >+ > namespace JSC { > > MarkStackMergingConstraint::MarkStackMergingConstraint(Heap& heap) >Index: Source/JavaScriptCore/heap/MarkStackMergingConstraint.h >=================================================================== >--- Source/JavaScriptCore/heap/MarkStackMergingConstraint.h (revision 227738) >+++ Source/JavaScriptCore/heap/MarkStackMergingConstraint.h (working copy) >@@ -29,6 +29,9 @@ > > namespace JSC { > >+class Heap; >+class SlotVisitor; >+ > class MarkStackMergingConstraint : public MarkingConstraint { > public: > MarkStackMergingConstraint(Heap&); >Index: Source/JavaScriptCore/heap/MarkedBlock.cpp >=================================================================== >--- Source/JavaScriptCore/heap/MarkedBlock.cpp (revision 227738) >+++ Source/JavaScriptCore/heap/MarkedBlock.cpp (working copy) >@@ -488,6 +488,15 @@ bool MarkedBlock::Handle::isFreeListedCe > return m_directory->isFreeListedCell(target); > } > >+void MarkedBlock::Handle::associateWithOrigin(SecurityOriginToken securityOriginToken) >+{ >+ if (m_securityOriginToken == securityOriginToken) >+ return; >+ >+ memset(&block(), 0, endAtom * atomSize); >+ m_securityOriginToken = securityOriginToken; >+} >+ > } // namespace JSC > > namespace WTF { >Index: Source/JavaScriptCore/heap/MarkedBlock.h >=================================================================== >--- Source/JavaScriptCore/heap/MarkedBlock.h (revision 227738) >+++ Source/JavaScriptCore/heap/MarkedBlock.h (working copy) >@@ -25,6 +25,7 @@ > #include "DestructionMode.h" > #include "HeapCell.h" > #include "IterationStatus.h" >+#include "SecurityOriginToken.h" > #include "WeakSet.h" > #include <wtf/Atomics.h> > #include <wtf/Bitmap.h> >@@ -194,6 +195,9 @@ public: > > void dumpState(PrintStream&); > >+ void associateWithOrigin(SecurityOriginToken); >+ SecurityOriginToken securityOriginToken() const { return m_securityOriginToken; } >+ > private: > Handle(Heap&, AlignedMemoryAllocator*, void*); > >@@ -229,6 +233,8 @@ public: > WeakSet m_weakSet; > > MarkedBlock* m_block { nullptr }; >+ >+ SecurityOriginToken m_securityOriginToken { 0 }; > }; > > private: >Index: Source/JavaScriptCore/heap/SecurityOriginToken.cpp >=================================================================== >--- Source/JavaScriptCore/heap/SecurityOriginToken.cpp (nonexistent) >+++ Source/JavaScriptCore/heap/SecurityOriginToken.cpp (working copy) >@@ -0,0 +1,40 @@ >+/* >+ * Copyright (C) 2018 Apple Inc. All rights reserved. >+ * >+ * Redistribution and use in source and binary forms, with or without >+ * modification, are permitted provided that the following conditions >+ * are met: >+ * 1. Redistributions of source code must retain the above copyright >+ * notice, this list of conditions and the following disclaimer. >+ * 2. Redistributions in binary form must reproduce the above copyright >+ * notice, this list of conditions and the following disclaimer in the >+ * documentation and/or other materials provided with the distribution. >+ * >+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY >+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE >+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR >+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR >+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, >+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, >+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR >+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY >+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT >+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE >+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. >+ */ >+ >+#include "config.h" >+#include "SecurityOriginToken.h" >+ >+#include <wtf/Atomics.h> >+ >+namespace JSC { >+ >+SecurityOriginToken uniqueSecurityOriginToken() >+{ >+ static SecurityOriginToken counter; >+ return WTF::atomicExchangeAdd(&counter, 1) + 1; >+} >+ >+} // namespace JSC >+ >Index: Source/JavaScriptCore/heap/SecurityOriginToken.h >=================================================================== >--- Source/JavaScriptCore/heap/SecurityOriginToken.h (nonexistent) >+++ Source/JavaScriptCore/heap/SecurityOriginToken.h (working copy) >@@ -0,0 +1,35 @@ >+/* >+ * Copyright (C) 2018 Apple Inc. All rights reserved. >+ * >+ * Redistribution and use in source and binary forms, with or without >+ * modification, are permitted provided that the following conditions >+ * are met: >+ * 1. Redistributions of source code must retain the above copyright >+ * notice, this list of conditions and the following disclaimer. >+ * 2. Redistributions in binary form must reproduce the above copyright >+ * notice, this list of conditions and the following disclaimer in the >+ * documentation and/or other materials provided with the distribution. >+ * >+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY >+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE >+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR >+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR >+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, >+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, >+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR >+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY >+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT >+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE >+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. >+ */ >+ >+#pragma once >+ >+namespace JSC { >+ >+typedef uint64_t SecurityOriginToken; >+ >+JS_EXPORT_PRIVATE SecurityOriginToken uniqueSecurityOriginToken(); >+ >+} // namespace JSC >+ >Index: Source/JavaScriptCore/heap/ThreadLocalCache.cpp >=================================================================== >--- Source/JavaScriptCore/heap/ThreadLocalCache.cpp (revision 227738) >+++ Source/JavaScriptCore/heap/ThreadLocalCache.cpp (working copy) >@@ -32,13 +32,14 @@ > > namespace JSC { > >-RefPtr<ThreadLocalCache> ThreadLocalCache::create(Heap& heap) >+RefPtr<ThreadLocalCache> ThreadLocalCache::create(Heap& heap, SecurityOriginToken securityOriginToken) > { >- return adoptRef(new ThreadLocalCache(heap)); >+ return adoptRef(new ThreadLocalCache(heap, securityOriginToken)); > } > >-ThreadLocalCache::ThreadLocalCache(Heap& heap) >+ThreadLocalCache::ThreadLocalCache(Heap& heap, SecurityOriginToken securityOriginToken) > : m_heap(heap) >+ , m_securityOriginToken(securityOriginToken) > { > m_data = allocateData(); > } >@@ -59,7 +60,7 @@ ThreadLocalCache::Data* ThreadLocalCache > for (size_t offset = 0; offset < oldSize; offset += sizeof(LocalAllocator)) > new (&allocator(*result, offset)) LocalAllocator(WTFMove(allocator(*m_data, offset))); > for (size_t offset = oldSize; offset < layout.size; offset += sizeof(LocalAllocator)) >- new (&allocator(*result, offset)) LocalAllocator(layout.directories[offset / sizeof(LocalAllocator)]); >+ new (&allocator(*result, offset)) LocalAllocator(this, layout.directories[offset / sizeof(LocalAllocator)]); > return result; > } > >@@ -70,7 +71,7 @@ void ThreadLocalCache::destroyData(Data* > fastFree(data); > } > >-void ThreadLocalCache::installSlow(VM& vm) >+void ThreadLocalCache::installSlow(VM& vm, RefPtr<ThreadLocalCache>* previous) > { > #if USE(FAST_TLS_FOR_TLC) > static std::once_flag onceFlag; >@@ -83,8 +84,13 @@ void ThreadLocalCache::installSlow(VM& v > > ref(); > >- if (RefPtr<ThreadLocalCache> oldCache = get(vm)) >- oldCache->deref(); >+ if (ThreadLocalCache::Data* oldCacheData = getImpl(vm)) { >+ ThreadLocalCache* oldCache = oldCacheData->cache; >+ if (previous) >+ *previous = adoptRef(oldCache); >+ else >+ oldCache->deref(); >+ } > > installData(vm, m_data); > } >Index: Source/JavaScriptCore/heap/ThreadLocalCache.h >=================================================================== >--- Source/JavaScriptCore/heap/ThreadLocalCache.h (revision 227738) >+++ Source/JavaScriptCore/heap/ThreadLocalCache.h (working copy) >@@ -25,9 +25,13 @@ > > #pragma once > >+#include "AllocationFailureMode.h" >+#include "LocalAllocator.h" >+#include "SecurityOriginToken.h" > #include <wtf/FastMalloc.h> > #include <wtf/FastTLS.h> > #include <wtf/ThreadSafeRefCounted.h> >+#include <wtf/Vector.h> > > namespace JSC { > >@@ -39,7 +43,7 @@ class ThreadLocalCache : public ThreadSa > WTF_MAKE_FAST_ALLOCATED; > > public: >- static RefPtr<ThreadLocalCache> create(Heap&); >+ JS_EXPORT_PRIVATE static RefPtr<ThreadLocalCache> create(Heap&, SecurityOriginToken = uniqueSecurityOriginToken()); > > JS_EXPORT_PRIVATE ~ThreadLocalCache(); > >@@ -49,7 +53,7 @@ public: > // optimizing for the case that you're just installing the cache that is already installed. This > // assumes a relatively small number of caches or low chance of actual context switch combined > // with possibly high rate of "I may have context switched" sites that call this out of paranoia. >- void install(VM&); >+ void install(VM&, RefPtr<ThreadLocalCache>* = nullptr); > > static LocalAllocator& allocator(VM&, size_t offset); > >@@ -59,10 +63,12 @@ public: > static ptrdiff_t offsetOfSizeInData() { return OBJECT_OFFSETOF(Data, size); } > static ptrdiff_t offsetOfFirstAllocatorInData() { return OBJECT_OFFSETOF(Data, allocator); } > >+ SecurityOriginToken securityOriginToken() const { return m_securityOriginToken; } >+ > private: > friend class VM; > >- ThreadLocalCache(Heap&); >+ ThreadLocalCache(Heap&, SecurityOriginToken); > > struct Data { > size_t size; >@@ -76,7 +82,7 @@ private: > void destroyData(Data*); > static LocalAllocator& allocator(Data& data, size_t offset); > >- void installSlow(VM&); >+ void installSlow(VM&, RefPtr<ThreadLocalCache>*); > static void installData(VM&, Data*); > > LocalAllocator& allocatorSlow(VM&, size_t offset); >@@ -91,6 +97,8 @@ private: > // it's correct for immortal caches. > Heap& m_heap; > Data* m_data { nullptr }; >+ >+ SecurityOriginToken m_securityOriginToken; > > #if USE(FAST_TLS_FOR_TLC) > static const pthread_key_t tlsKey = WTF_GC_TLC_KEY; >Index: Source/JavaScriptCore/heap/ThreadLocalCacheInlines.h >=================================================================== >--- Source/JavaScriptCore/heap/ThreadLocalCacheInlines.h (revision 227738) >+++ Source/JavaScriptCore/heap/ThreadLocalCacheInlines.h (working copy) >@@ -26,6 +26,7 @@ > #pragma once > > #include "ThreadLocalCache.h" >+#include "VM.h" > > namespace JSC { > >@@ -47,11 +48,14 @@ inline RefPtr<ThreadLocalCache> ThreadLo > return nullptr; > } > >-inline void ThreadLocalCache::install(VM& vm) >+inline void ThreadLocalCache::install(VM& vm, RefPtr<ThreadLocalCache>* previous) > { >- if (getImpl(vm) == m_data) >+ if (getImpl(vm) == m_data) { >+ if (previous) >+ *previous = nullptr; > return; >- installSlow(vm); >+ } >+ installSlow(vm, previous); > } > > inline LocalAllocator& ThreadLocalCache::allocator(VM& vm, size_t offset) >Index: Source/JavaScriptCore/runtime/JSGlobalObject.h >=================================================================== >--- Source/JavaScriptCore/runtime/JSGlobalObject.h (revision 227738) >+++ Source/JavaScriptCore/runtime/JSGlobalObject.h (working copy) >@@ -491,7 +491,7 @@ public: > const RuntimeFlags& runtimeFlags() const { return m_runtimeFlags; } > > protected: >- JS_EXPORT_PRIVATE explicit JSGlobalObject(VM&, Structure*, const GlobalObjectMethodTable* = 0, RefPtr<ThreadLocalCache> = nullptr); >+ JS_EXPORT_PRIVATE explicit JSGlobalObject(VM&, Structure*, const GlobalObjectMethodTable* = nullptr, RefPtr<ThreadLocalCache> = nullptr); > > JS_EXPORT_PRIVATE void finishCreation(VM&); > >Index: Source/JavaScriptCore/runtime/VMEntryScope.cpp >=================================================================== >--- Source/JavaScriptCore/runtime/VMEntryScope.cpp (revision 227738) >+++ Source/JavaScriptCore/runtime/VMEntryScope.cpp (working copy) >@@ -41,7 +41,7 @@ VMEntryScope::VMEntryScope(VM& vm, JSGlo > : m_vm(vm) > , m_globalObject(globalObject) > { >- globalObject->threadLocalCache().install(vm); >+ globalObject->threadLocalCache().install(vm, &m_previousTLC); > ASSERT(!DisallowVMReentry::isInEffectOnCurrentThread()); > ASSERT(Thread::current().stack().isGrowingDownward()); > if (!vm.entryScope) { >@@ -71,11 +71,14 @@ void VMEntryScope::addDidPopListener(std > > VMEntryScope::~VMEntryScope() > { >+ if (m_previousTLC) >+ m_previousTLC->install(m_vm); >+ > if (m_vm.entryScope != this) > return; > > TracePoint(VMEntryScopeEnd); >- >+ > if (m_vm.watchdog()) > m_vm.watchdog()->exitedVM(); > >Index: Source/JavaScriptCore/runtime/VMEntryScope.h >=================================================================== >--- Source/JavaScriptCore/runtime/VMEntryScope.h (revision 227738) >+++ Source/JavaScriptCore/runtime/VMEntryScope.h (working copy) >@@ -31,6 +31,7 @@ > namespace JSC { > > class JSGlobalObject; >+class ThreadLocalCache; > class VM; > > class VMEntryScope { >@@ -47,6 +48,7 @@ private: > VM& m_vm; > JSGlobalObject* m_globalObject; > Vector<std::function<void ()>> m_didPopListeners; >+ RefPtr<ThreadLocalCache> m_previousTLC; > }; > > } // namespace JSC >Index: Source/WebCore/ChangeLog >=================================================================== >--- Source/WebCore/ChangeLog (revision 227792) >+++ Source/WebCore/ChangeLog (working copy) >@@ -1,3 +1,24 @@ >+2018-01-30 Filip Pizlo <fpizlo@apple.com> >+ >+ Global objects should be able to use TLCs to allocate from different blocks from each other >+ https://bugs.webkit.org/show_bug.cgi?id=182227 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ No new tests because no change in behavior. >+ >+ Adopt JSC TLC API to put distance between objects from different security origin. >+ >+ * ForwardingHeaders/heap/ThreadLocalCache.h: Added. >+ * bindings/js/JSDOMGlobalObject.cpp: >+ (WebCore::JSDOMGlobalObject::JSDOMGlobalObject): >+ * bindings/js/JSDOMGlobalObject.h: >+ * bindings/js/JSDOMWindowBase.cpp: >+ (WebCore::JSDOMWindowBase::JSDOMWindowBase): >+ * page/SecurityOrigin.cpp: >+ (WebCore::SecurityOrigin::threadLocalCache): >+ * page/SecurityOrigin.h: >+ > 2018-01-30 Zalan Bujtas <zalan@apple.com> > > [RenderTreeBuilder] Move childBecameNonInline to RenderTreeBuilder >Index: Source/WebCore/ForwardingHeaders/heap/ThreadLocalCache.h >=================================================================== >--- Source/WebCore/ForwardingHeaders/heap/ThreadLocalCache.h (nonexistent) >+++ Source/WebCore/ForwardingHeaders/heap/ThreadLocalCache.h (working copy) >@@ -0,0 +1,2 @@ >+#pragma once >+#include <JavaScriptCore/ThreadLocalCache.h> >Index: Source/WebCore/bindings/js/JSDOMGlobalObject.cpp >=================================================================== >--- Source/WebCore/bindings/js/JSDOMGlobalObject.cpp (revision 227738) >+++ Source/WebCore/bindings/js/JSDOMGlobalObject.cpp (working copy) >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2008-2017 Apple Inc. All Rights Reserved. >+ * Copyright (C) 2008-2018 Apple Inc. All Rights Reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -56,8 +56,8 @@ EncodedJSValue JSC_HOST_CALL isReadableB > > const ClassInfo JSDOMGlobalObject::s_info = { "DOMGlobalObject", &JSGlobalObject::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSDOMGlobalObject) }; > >-JSDOMGlobalObject::JSDOMGlobalObject(VM& vm, Structure* structure, Ref<DOMWrapperWorld>&& world, const GlobalObjectMethodTable* globalObjectMethodTable) >- : JSGlobalObject(vm, structure, globalObjectMethodTable) >+JSDOMGlobalObject::JSDOMGlobalObject(VM& vm, Structure* structure, Ref<DOMWrapperWorld>&& world, const GlobalObjectMethodTable* globalObjectMethodTable, RefPtr<JSC::ThreadLocalCache> threadLocalCache) >+ : JSGlobalObject(vm, structure, globalObjectMethodTable, threadLocalCache) > , m_currentEvent(0) > , m_world(WTFMove(world)) > , m_worldIsNormal(m_world->isNormal()) >Index: Source/WebCore/bindings/js/JSDOMGlobalObject.h >=================================================================== >--- Source/WebCore/bindings/js/JSDOMGlobalObject.h (revision 227738) >+++ Source/WebCore/bindings/js/JSDOMGlobalObject.h (working copy) >@@ -30,6 +30,7 @@ > #include "WebCoreJSBuiltinInternals.h" > #include <heap/HeapInlines.h> > #include <heap/LockDuringMarking.h> >+#include <heap/ThreadLocalCache.h> > #include <runtime/JSGlobalObject.h> > #include <runtime/StructureInlines.h> > >@@ -50,7 +51,7 @@ class WEBCORE_EXPORT JSDOMGlobalObject : > protected: > struct JSDOMGlobalObjectData; > >- JSDOMGlobalObject(JSC::VM&, JSC::Structure*, Ref<DOMWrapperWorld>&&, const JSC::GlobalObjectMethodTable* = 0); >+ JSDOMGlobalObject(JSC::VM&, JSC::Structure*, Ref<DOMWrapperWorld>&&, const JSC::GlobalObjectMethodTable* = nullptr, RefPtr<JSC::ThreadLocalCache> = nullptr); > static void destroy(JSC::JSCell*); > void finishCreation(JSC::VM&); > void finishCreation(JSC::VM&, JSC::JSObject*); >Index: Source/WebCore/bindings/js/JSDOMWindowBase.cpp >=================================================================== >--- Source/WebCore/bindings/js/JSDOMWindowBase.cpp (revision 227738) >+++ Source/WebCore/bindings/js/JSDOMWindowBase.cpp (working copy) >@@ -79,7 +79,7 @@ const GlobalObjectMethodTable JSDOMWindo > }; > > JSDOMWindowBase::JSDOMWindowBase(VM& vm, Structure* structure, RefPtr<DOMWindow>&& window, JSDOMWindowProxy* proxy) >- : JSDOMGlobalObject(vm, structure, proxy->world(), &s_globalObjectMethodTable) >+ : JSDOMGlobalObject(vm, structure, proxy->world(), &s_globalObjectMethodTable, window->document()->securityOrigin().threadLocalCache()) > , m_windowCloseWatchpoints((window && window->frame()) ? IsWatched : IsInvalidated) > , m_wrapped(WTFMove(window)) > , m_proxy(proxy) >Index: Source/WebCore/page/SecurityOrigin.cpp >=================================================================== >--- Source/WebCore/page/SecurityOrigin.cpp (revision 227738) >+++ Source/WebCore/page/SecurityOrigin.cpp (working copy) >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2007-2017 Apple Inc. All rights reserved. >+ * Copyright (C) 2007-2018 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -30,11 +30,13 @@ > #include "SecurityOrigin.h" > > #include "BlobURL.h" >+#include "CommonVM.h" > #include "FileSystem.h" > #include "URL.h" > #include "SchemeRegistry.h" > #include "SecurityPolicy.h" > #include "ThreadableBlobRegistry.h" >+#include <runtime/VM.h> > #include <wtf/MainThread.h> > #include <wtf/NeverDestroyed.h> > #include <wtf/StdLibExtras.h> >@@ -595,4 +597,11 @@ bool SecurityOrigin::isLocalHostOrLoopba > return false; > } > >+RefPtr<JSC::ThreadLocalCache> SecurityOrigin::threadLocalCache() >+{ >+ if (!m_threadLocalCache) >+ m_threadLocalCache = JSC::ThreadLocalCache::create(commonVM().heap); >+ return m_threadLocalCache; >+} >+ > } // namespace WebCore >Index: Source/WebCore/page/SecurityOrigin.h >=================================================================== >--- Source/WebCore/page/SecurityOrigin.h (revision 227738) >+++ Source/WebCore/page/SecurityOrigin.h (working copy) >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2007-2017 Apple Inc. All rights reserved. >+ * Copyright (C) 2007-2018 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -28,6 +28,7 @@ > > #pragma once > >+#include <heap/ThreadLocalCache.h> > #include <wtf/ThreadSafeRefCounted.h> > #include <wtf/text/WTFString.h> > >@@ -203,6 +204,8 @@ public: > bool isPotentiallyTrustworthy() const { return m_isPotentiallyTrustworthy; } > > static bool isLocalHostOrLoopbackIPAddress(const URL&); >+ >+ RefPtr<JSC::ThreadLocalCache> threadLocalCache(); > > private: > SecurityOrigin(); >@@ -232,6 +235,7 @@ private: > bool m_enforceFilePathSeparation { false }; > bool m_needsStorageAccessFromFileURLsQuirk { false }; > bool m_isPotentiallyTrustworthy { false }; >+ RefPtr<JSC::ThreadLocalCache> m_threadLocalCache; > }; > > bool shouldTreatAsPotentiallyTrustworthy(const URL&);
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=332666">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 182227
:
332502
|
332503
|
332508
|
332588
|
332666
|
332810
|
332811
|
333100
|
333104
|
333138
|
333139