Attachment 348789 Details for Bug 189247 – proposed patch.

[patch] proposed patch.

bug-189247.patch (text/plain), 3.42 KB, created by Mark Lam on 2018-09-03 13:45:31 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Lam

Created: 2018-09-03 13:45:31 PDT

Size: 3.42 KB

patch

obsolete

>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 235601)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,16 @@
>+2018-09-03  Mark Lam  <mark.lam@apple.com>
>+
>+        CallFrame::unsafeCallee() should use an ASAN suppressed Register::asanUnsafePointer().
>+        https://bugs.webkit.org/show_bug.cgi?id=189247
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * interpreter/CallFrame.h:
>+        (JSC::ExecState::unsafeCallee const):
>+        * interpreter/Register.h:
>+        (JSC::Register::asanUnsafePointer const):
>+        (JSC::Register::unsafePayload const):
>+
> 2018-09-02  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
> 
>         Implement Object.fromEntries
>Index: Source/JavaScriptCore/interpreter/CallFrame.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/CallFrame.h	(revision 235601)
>+++ Source/JavaScriptCore/interpreter/CallFrame.h	(working copy)
>@@ -106,7 +106,7 @@ namespace JSC  {
>             return this[CallFrameSlot::callee].object();
>         }
>         CalleeBits callee() const { return CalleeBits(this[CallFrameSlot::callee].pointer()); }
>-        SUPPRESS_ASAN CalleeBits unsafeCallee() const { return CalleeBits(this[CallFrameSlot::callee].pointer()); }
>+        SUPPRESS_ASAN CalleeBits unsafeCallee() const { return CalleeBits(this[CallFrameSlot::callee].asanUnsafePointer()); }
>         CodeBlock* codeBlock() const { return this[CallFrameSlot::codeBlock].Register::codeBlock(); }
>         CodeBlock** addressOfCodeBlock() const { return bitwise_cast<CodeBlock**>(this + CallFrameSlot::codeBlock); }
>         SUPPRESS_ASAN CodeBlock* unsafeCodeBlock() const { return this[CallFrameSlot::codeBlock].Register::asanUnsafeCodeBlock(); }
>Index: Source/JavaScriptCore/interpreter/Register.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/Register.h	(revision 235601)
>+++ Source/JavaScriptCore/interpreter/Register.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
>+ * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -72,11 +72,13 @@ namespace JSC {
>         JSCell* unboxedCell() const;
>         int32_t payload() const;
>         int32_t tag() const;
>+        int32_t unsafePayload() const;
>         int32_t unsafeTag() const;
>         int32_t& payload();
>         int32_t& tag();
> 
>         void* pointer() const;
>+        void* asanUnsafePointer() const;
> 
>         static Register withInt(int32_t i)
>         {
>@@ -206,6 +208,15 @@ namespace JSC {
> #endif
>     }
> 
>+    SUPPRESS_ASAN ALWAYS_INLINE void* Register::asanUnsafePointer() const
>+    {
>+#if USE(JSVALUE64)
>+        return u.encodedValue.ptr;
>+#else
>+        return bitwise_cast<void*>(unsafePayload());
>+#endif
>+    }
>+
>     ALWAYS_INLINE int32_t Register::payload() const
>     {
>         return u.encodedValue.asBits.payload;
>@@ -216,6 +227,11 @@ namespace JSC {
>         return u.encodedValue.asBits.tag;
>     }
> 
>+    SUPPRESS_ASAN ALWAYS_INLINE int32_t Register::unsafePayload() const
>+    {
>+        return u.encodedValue.asBits.payload;
>+    }
>+
>     SUPPRESS_ASAN ALWAYS_INLINE int32_t Register::unsafeTag() const
>     {
>         return u.encodedValue.asBits.tag;

Actions: View | Formatted Diff | Diff

Attachments on bug 189247: 348779 | 348788 | 348789