Title: [236135] releases/WebKitGTK/webkit-2.22/Source/_javascript_Core
Revision
236135
Author
carlo...@webkit.org
Date
2018-09-18 08:40:00 -0700 (Tue, 18 Sep 2018)

Log Message

Merge r235603 - CallFrame::unsafeCallee() should use an ASAN suppressed Register::asanUnsafePointer().
https://bugs.webkit.org/show_bug.cgi?id=189247

Reviewed by Saam Barati.

* interpreter/CallFrame.h:
(JSC::ExecState::unsafeCallee const):
* interpreter/Register.h:
(JSC::Register::asanUnsafePointer const):
(JSC::Register::unsafePayload const):

Modified Paths

Diff

Modified: releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog (236134 => 236135)


--- releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog	2018-09-18 15:39:55 UTC (rev 236134)
+++ releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog	2018-09-18 15:40:00 UTC (rev 236135)
@@ -1,3 +1,16 @@
+2018-09-03  Mark Lam  <mark....@apple.com>
+
+        CallFrame::unsafeCallee() should use an ASAN suppressed Register::asanUnsafePointer().
+        https://bugs.webkit.org/show_bug.cgi?id=189247
+
+        Reviewed by Saam Barati.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::unsafeCallee const):
+        * interpreter/Register.h:
+        (JSC::Register::asanUnsafePointer const):
+        (JSC::Register::unsafePayload const):
+
 2018-08-24  Yusuke Suzuki  <yusukesuz...@slowstart.org>
 
         Function object should convert params to string before throw a parsing error

Modified: releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/interpreter/CallFrame.h (236134 => 236135)


--- releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/interpreter/CallFrame.h	2018-09-18 15:39:55 UTC (rev 236134)
+++ releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/interpreter/CallFrame.h	2018-09-18 15:40:00 UTC (rev 236135)
@@ -106,7 +106,7 @@
             return this[CallFrameSlot::callee].object();
         }
         CalleeBits callee() const { return CalleeBits(this[CallFrameSlot::callee].pointer()); }
-        SUPPRESS_ASAN CalleeBits unsafeCallee() const { return CalleeBits(this[CallFrameSlot::callee].pointer()); }
+        SUPPRESS_ASAN CalleeBits unsafeCallee() const { return CalleeBits(this[CallFrameSlot::callee].asanUnsafePointer()); }
         CodeBlock* codeBlock() const { return this[CallFrameSlot::codeBlock].Register::codeBlock(); }
         CodeBlock** addressOfCodeBlock() const { return bitwise_cast<CodeBlock**>(this + CallFrameSlot::codeBlock); }
         SUPPRESS_ASAN CodeBlock* unsafeCodeBlock() const { return this[CallFrameSlot::codeBlock].Register::asanUnsafeCodeBlock(); }

Modified: releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/interpreter/Register.h (236134 => 236135)


--- releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/interpreter/Register.h	2018-09-18 15:39:55 UTC (rev 236134)
+++ releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/interpreter/Register.h	2018-09-18 15:40:00 UTC (rev 236135)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -72,11 +72,13 @@
         JSCell* unboxedCell() const;
         int32_t payload() const;
         int32_t tag() const;
+        int32_t unsafePayload() const;
         int32_t unsafeTag() const;
         int32_t& payload();
         int32_t& tag();
 
         void* pointer() const;
+        void* asanUnsafePointer() const;
 
         static Register withInt(int32_t i)
         {
@@ -206,6 +208,15 @@
 #endif
     }
 
+    SUPPRESS_ASAN ALWAYS_INLINE void* Register::asanUnsafePointer() const
+    {
+#if USE(JSVALUE64)
+        return u.encodedValue.ptr;
+#else
+        return bitwise_cast<void*>(unsafePayload());
+#endif
+    }
+
     ALWAYS_INLINE int32_t Register::payload() const
     {
         return u.encodedValue.asBits.payload;
@@ -216,6 +227,11 @@
         return u.encodedValue.asBits.tag;
     }
 
+    SUPPRESS_ASAN ALWAYS_INLINE int32_t Register::unsafePayload() const
+    {
+        return u.encodedValue.asBits.payload;
+    }
+
     SUPPRESS_ASAN ALWAYS_INLINE int32_t Register::unsafeTag() const
     {
         return u.encodedValue.asBits.tag;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to