Skip to content

Commit 0260639

Browse files
kmiller68kmiller68
committed
JSObjects should have a mask for loading indexed properties
https://bugs.webkit.org/show_bug.cgi?id=180768 Reviewed by Mark Lam. JSTests: * stress/int16-put-by-val-in-and-out-of-bounds.js: (test): Source/JavaScriptCore: This patch adds a new member to JSObject that holds an indexing mask. The indexing mask is bitwise anded with the index used to load a property. If for whatever reason an attacker is able to clobber the vectorLength of our butterfly they still won't be able to read substantially past the end of the buttefly. For performance reasons we don't use the indexing masking for TypedArrays. Since TypedArrays are already gigacaged the risk of wild reads is still restricted. This patch is a <1% regression on Speedometer and ~3% regression on JetStream in my testing. * assembler/MacroAssembler.h: (JSC::MacroAssembler::urshiftPtr): * bytecode/AccessCase.cpp: (JSC::AccessCase::generateImpl): * dfg/DFGAbstractHeap.h: * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::emitAllocateRawObject): (JSC::DFG::SpeculativeJIT::compileDoublePutByVal): (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon): (JSC::DFG::SpeculativeJIT::compileCreateActivation): (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments): (JSC::DFG::SpeculativeJIT::compileArraySlice): (JSC::DFG::SpeculativeJIT::compileNukeStructureAndSetButterfly): (JSC::DFG::SpeculativeJIT::compileNewStringObject): (JSC::DFG::SpeculativeJIT::compileNewTypedArray): * dfg/DFGSpeculativeJIT.h: (JSC::DFG::SpeculativeJIT::emitAllocateJSObject): (JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): * ftl/FTLAbstractHeap.cpp: (JSC::FTL::IndexedAbstractHeap::baseIndex): * ftl/FTLAbstractHeap.h: * ftl/FTLAbstractHeapRepository.h: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite): (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal): (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation): (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction): (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments): (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject): (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray): (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject): (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation): (JSC::FTL::DFG::LowerDFGToB3::maskedIndex): (JSC::FTL::DFG::LowerDFGToB3::computeButterflyIndexingMask): (JSC::FTL::DFG::LowerDFGToB3::allocateObject): (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject): (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray): (JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray): * ftl/FTLOutput.h: (JSC::FTL::Output::baseIndex): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitComputeButterflyIndexingMask): (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly): (JSC::AssemblyHelpers::emitAllocateJSObject): (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize): (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject): (JSC::AssemblyHelpers::emitAllocateDestructibleObject): (JSC::AssemblyHelpers::storeButterfly): Deleted. * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_new_object): (JSC::JIT::emit_op_create_this): * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_new_object): (JSC::JIT::emit_op_create_this): * jit/JITPropertyAccess.cpp: (JSC::JIT::emitDoubleLoad): (JSC::JIT::emitContiguousLoad): (JSC::JIT::emitArrayStorageLoad): * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/ArrayStorage.h: (JSC::ArrayStorage::availableVectorLength): * runtime/Butterfly.h: (JSC::ContiguousData::ContiguousData): (JSC::ContiguousData::at const): (JSC::ContiguousData::at): (JSC::Butterfly::publicLength const): (JSC::Butterfly::vectorLength const): (JSC::Butterfly::computeIndexingMaskForVectorLength): (JSC::Butterfly::computeIndexingMask): (JSC::Butterfly::contiguousInt32): (JSC::ContiguousData::operator[] const): Deleted. (JSC::ContiguousData::operator[]): Deleted. (JSC::Butterfly::publicLength): Deleted. (JSC::Butterfly::vectorLength): Deleted. * runtime/ButterflyInlines.h: (JSC::ContiguousData<T>::at const): (JSC::ContiguousData<T>::at): * runtime/ClonedArguments.cpp: (JSC::ClonedArguments::createEmpty): * runtime/JSArray.cpp: (JSC::JSArray::tryCreateUninitializedRestricted): (JSC::JSArray::appendMemcpy): (JSC::JSArray::setLength): (JSC::JSArray::pop): (JSC::JSArray::fastSlice): (JSC::JSArray::shiftCountWithArrayStorage): (JSC::JSArray::shiftCountWithAnyIndexingType): (JSC::JSArray::unshiftCountWithAnyIndexingType): (JSC::JSArray::fillArgList): (JSC::JSArray::copyToArguments): * runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::JSArrayBufferView): * runtime/JSArrayInlines.h: (JSC::JSArray::pushInline): * runtime/JSFixedArray.h: (JSC::JSFixedArray::createFromArray): * runtime/JSGenericTypedArrayViewInlines.h: (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory): * runtime/JSObject.cpp: (JSC::JSObject::getOwnPropertySlotByIndex): (JSC::JSObject::putByIndex): (JSC::JSObject::createInitialInt32): (JSC::JSObject::createInitialDouble): (JSC::JSObject::createInitialContiguous): (JSC::JSObject::convertUndecidedToInt32): (JSC::JSObject::convertUndecidedToDouble): (JSC::JSObject::convertUndecidedToContiguous): (JSC::JSObject::convertInt32ToDouble): (JSC::JSObject::convertInt32ToArrayStorage): (JSC::JSObject::convertDoubleToContiguous): (JSC::JSObject::convertDoubleToArrayStorage): (JSC::JSObject::convertContiguousToArrayStorage): (JSC::JSObject::createInitialForValueAndSet): (JSC::JSObject::deletePropertyByIndex): (JSC::JSObject::getOwnPropertyNames): (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes): (JSC::JSObject::countElements): (JSC::JSObject::ensureLengthSlow): (JSC::JSObject::reallocateAndShrinkButterfly): (JSC::JSObject::getEnumerableLength): * runtime/JSObject.h: (JSC::JSObject::canGetIndexQuickly): (JSC::JSObject::getIndexQuickly): (JSC::JSObject::tryGetIndexQuickly const): (JSC::JSObject::setIndexQuickly): (JSC::JSObject::initializeIndex): (JSC::JSObject::initializeIndexWithoutBarrier): (JSC::JSObject::butterflyIndexingMaskOffset): (JSC::JSObject::butterflyIndexingMask const): (JSC::JSObject::setButterflyWithIndexingMask): (JSC::JSObject::setButterfly): (JSC::JSObject::nukeStructureAndSetButterfly): (JSC::JSObject::JSObject): * runtime/RegExpMatchesArray.h: (JSC::tryCreateUninitializedRegExpMatchesArray): * runtime/Structure.cpp: (JSC::Structure::flattenDictionaryStructure): Source/WebCore: * bindings/js/JSDOMConvertSequences.h: (WebCore::Detail::NumericSequenceConverter::convertArray): (WebCore::Detail::SequenceConverter::convertArray): Source/WTF: Add a clz that wraps the builtin clz intrinisics provided by various compilers. The clz function by default assumes that the input may be zero. On X86 this makes a difference because not all CPUs have LZCNT and BSR has undefined behavior on zero. On ARM, the zero check gets optimized away, regardless. * wtf/StdLibExtras.h: (std::clz): Canonical link: https://commits.webkit.org/196715@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@225913 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 392ea23 commit 0260639

41 files changed

Lines changed: 658 additions & 263 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎JSTests/ChangeLog‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
2017-12-13 Keith Miller <keith_miller@apple.com>
2+
3+
JSObjects should have a mask for loading indexed properties
4+
https://bugs.webkit.org/show_bug.cgi?id=180768
5+
6+
Reviewed by Mark Lam.
7+
8+
* stress/int16-put-by-val-in-and-out-of-bounds.js:
9+
(test):
10+
111
2017-12-13 Saam Barati <sbarati@apple.com>
212

313
Arrow functions need their own structure because they have different properties than sloppy functions

‎JSTests/stress/flattening-prototype-remove-butterfly.js‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Create an object with inline capacity 1.
2+
let obj = { foo: 1 };
3+
4+
// Make it into a dictionary.
5+
delete obj.foo;
6+
7+
// Get us to allocate out of line capacity.
8+
obj.foo = 1;
9+
obj.bar = 2;
10+
11+
// Delete the inline property.
12+
delete obj.foo;
13+
14+
let o = Object.create(obj);
15+
16+
function foo() {
17+
return o.toString();
18+
}
19+
noInline(foo);
20+
21+
// Flatten into an empty butterfly.
22+
for (let i = 0; i < 10000; i++)
23+
foo();

‎JSTests/stress/int16-put-by-val-in-and-out-of-bounds.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ function test(length, expected) {
99
foo(a);
1010
var result = a[42];
1111
if (result != expected)
12-
throw "Error: bad value at a[42]: " + result;
12+
throw new Error("bad value at a[42]: " + result);
1313
}
1414

1515
for (var i = 0; i < 100000; ++i) {

‎Source/JavaScriptCore/ChangeLog‎

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,169 @@
1+
2017-12-13 Keith Miller <keith_miller@apple.com>
2+
3+
JSObjects should have a mask for loading indexed properties
4+
https://bugs.webkit.org/show_bug.cgi?id=180768
5+
6+
Reviewed by Mark Lam.
7+
8+
This patch adds a new member to JSObject that holds an indexing
9+
mask. The indexing mask is bitwise anded with the index used to
10+
load a property. If for whatever reason an attacker is able to
11+
clobber the vectorLength of our butterfly they still won't be able
12+
to read substantially past the end of the buttefly. For
13+
performance reasons we don't use the indexing masking for
14+
TypedArrays. Since TypedArrays are already gigacaged the risk of
15+
wild reads is still restricted.
16+
17+
This patch is a <1% regression on Speedometer and ~3% regression
18+
on JetStream in my testing.
19+
20+
* assembler/MacroAssembler.h:
21+
(JSC::MacroAssembler::urshiftPtr):
22+
* bytecode/AccessCase.cpp:
23+
(JSC::AccessCase::generateImpl):
24+
* dfg/DFGAbstractHeap.h:
25+
* dfg/DFGClobberize.h:
26+
(JSC::DFG::clobberize):
27+
* dfg/DFGSpeculativeJIT.cpp:
28+
(JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
29+
(JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
30+
(JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
31+
(JSC::DFG::SpeculativeJIT::compileCreateActivation):
32+
(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
33+
(JSC::DFG::SpeculativeJIT::compileArraySlice):
34+
(JSC::DFG::SpeculativeJIT::compileNukeStructureAndSetButterfly):
35+
(JSC::DFG::SpeculativeJIT::compileNewStringObject):
36+
(JSC::DFG::SpeculativeJIT::compileNewTypedArray):
37+
* dfg/DFGSpeculativeJIT.h:
38+
(JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
39+
(JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize):
40+
* dfg/DFGSpeculativeJIT32_64.cpp:
41+
(JSC::DFG::SpeculativeJIT::compile):
42+
(JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
43+
* dfg/DFGSpeculativeJIT64.cpp:
44+
(JSC::DFG::SpeculativeJIT::compile):
45+
(JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
46+
* ftl/FTLAbstractHeap.cpp:
47+
(JSC::FTL::IndexedAbstractHeap::baseIndex):
48+
* ftl/FTLAbstractHeap.h:
49+
* ftl/FTLAbstractHeapRepository.h:
50+
* ftl/FTLLowerDFGToB3.cpp:
51+
(JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite):
52+
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
53+
(JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
54+
(JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
55+
(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
56+
(JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
57+
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
58+
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
59+
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
60+
(JSC::FTL::DFG::LowerDFGToB3::maskedIndex):
61+
(JSC::FTL::DFG::LowerDFGToB3::computeButterflyIndexingMask):
62+
(JSC::FTL::DFG::LowerDFGToB3::allocateObject):
63+
(JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
64+
(JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
65+
(JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray):
66+
* ftl/FTLOutput.h:
67+
(JSC::FTL::Output::baseIndex):
68+
* jit/AssemblyHelpers.h:
69+
(JSC::AssemblyHelpers::emitComputeButterflyIndexingMask):
70+
(JSC::AssemblyHelpers::nukeStructureAndStoreButterfly):
71+
(JSC::AssemblyHelpers::emitAllocateJSObject):
72+
(JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
73+
(JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
74+
(JSC::AssemblyHelpers::emitAllocateDestructibleObject):
75+
(JSC::AssemblyHelpers::storeButterfly): Deleted.
76+
* jit/JITOpcodes.cpp:
77+
(JSC::JIT::emit_op_new_object):
78+
(JSC::JIT::emit_op_create_this):
79+
* jit/JITOpcodes32_64.cpp:
80+
(JSC::JIT::emit_op_new_object):
81+
(JSC::JIT::emit_op_create_this):
82+
* jit/JITPropertyAccess.cpp:
83+
(JSC::JIT::emitDoubleLoad):
84+
(JSC::JIT::emitContiguousLoad):
85+
(JSC::JIT::emitArrayStorageLoad):
86+
* llint/LowLevelInterpreter32_64.asm:
87+
* llint/LowLevelInterpreter64.asm:
88+
* runtime/ArrayStorage.h:
89+
(JSC::ArrayStorage::availableVectorLength):
90+
* runtime/Butterfly.h:
91+
(JSC::ContiguousData::ContiguousData):
92+
(JSC::ContiguousData::at const):
93+
(JSC::ContiguousData::at):
94+
(JSC::Butterfly::publicLength const):
95+
(JSC::Butterfly::vectorLength const):
96+
(JSC::Butterfly::computeIndexingMaskForVectorLength):
97+
(JSC::Butterfly::computeIndexingMask):
98+
(JSC::Butterfly::contiguousInt32):
99+
(JSC::ContiguousData::operator[] const): Deleted.
100+
(JSC::ContiguousData::operator[]): Deleted.
101+
(JSC::Butterfly::publicLength): Deleted.
102+
(JSC::Butterfly::vectorLength): Deleted.
103+
* runtime/ButterflyInlines.h:
104+
(JSC::ContiguousData<T>::at const):
105+
(JSC::ContiguousData<T>::at):
106+
* runtime/ClonedArguments.cpp:
107+
(JSC::ClonedArguments::createEmpty):
108+
* runtime/JSArray.cpp:
109+
(JSC::JSArray::tryCreateUninitializedRestricted):
110+
(JSC::JSArray::appendMemcpy):
111+
(JSC::JSArray::setLength):
112+
(JSC::JSArray::pop):
113+
(JSC::JSArray::fastSlice):
114+
(JSC::JSArray::shiftCountWithArrayStorage):
115+
(JSC::JSArray::shiftCountWithAnyIndexingType):
116+
(JSC::JSArray::unshiftCountWithAnyIndexingType):
117+
(JSC::JSArray::fillArgList):
118+
(JSC::JSArray::copyToArguments):
119+
* runtime/JSArrayBufferView.cpp:
120+
(JSC::JSArrayBufferView::JSArrayBufferView):
121+
* runtime/JSArrayInlines.h:
122+
(JSC::JSArray::pushInline):
123+
* runtime/JSFixedArray.h:
124+
(JSC::JSFixedArray::createFromArray):
125+
* runtime/JSGenericTypedArrayViewInlines.h:
126+
(JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
127+
* runtime/JSObject.cpp:
128+
(JSC::JSObject::getOwnPropertySlotByIndex):
129+
(JSC::JSObject::putByIndex):
130+
(JSC::JSObject::createInitialInt32):
131+
(JSC::JSObject::createInitialDouble):
132+
(JSC::JSObject::createInitialContiguous):
133+
(JSC::JSObject::convertUndecidedToInt32):
134+
(JSC::JSObject::convertUndecidedToDouble):
135+
(JSC::JSObject::convertUndecidedToContiguous):
136+
(JSC::JSObject::convertInt32ToDouble):
137+
(JSC::JSObject::convertInt32ToArrayStorage):
138+
(JSC::JSObject::convertDoubleToContiguous):
139+
(JSC::JSObject::convertDoubleToArrayStorage):
140+
(JSC::JSObject::convertContiguousToArrayStorage):
141+
(JSC::JSObject::createInitialForValueAndSet):
142+
(JSC::JSObject::deletePropertyByIndex):
143+
(JSC::JSObject::getOwnPropertyNames):
144+
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
145+
(JSC::JSObject::countElements):
146+
(JSC::JSObject::ensureLengthSlow):
147+
(JSC::JSObject::reallocateAndShrinkButterfly):
148+
(JSC::JSObject::getEnumerableLength):
149+
* runtime/JSObject.h:
150+
(JSC::JSObject::canGetIndexQuickly):
151+
(JSC::JSObject::getIndexQuickly):
152+
(JSC::JSObject::tryGetIndexQuickly const):
153+
(JSC::JSObject::setIndexQuickly):
154+
(JSC::JSObject::initializeIndex):
155+
(JSC::JSObject::initializeIndexWithoutBarrier):
156+
(JSC::JSObject::butterflyIndexingMaskOffset):
157+
(JSC::JSObject::butterflyIndexingMask const):
158+
(JSC::JSObject::setButterflyWithIndexingMask):
159+
(JSC::JSObject::setButterfly):
160+
(JSC::JSObject::nukeStructureAndSetButterfly):
161+
(JSC::JSObject::JSObject):
162+
* runtime/RegExpMatchesArray.h:
163+
(JSC::tryCreateUninitializedRegExpMatchesArray):
164+
* runtime/Structure.cpp:
165+
(JSC::Structure::flattenDictionaryStructure):
166+
1167
2017-12-14 David Kilzer <ddkilzer@apple.com>
2168

3169
REGRESSION (r225799/r225887): Remove duplicate entries for JSCPoisonedPtr.h in Xcode project

‎Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1008,6 +1008,7 @@
10081008
536B319C1F735E7D0037FC33 /* UnifiedSource134.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 536B31971F735E5B0037FC33 /* UnifiedSource134.cpp */; };
10091009
536B319D1F735E7D0037FC33 /* UnifiedSource135.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 536B31991F735E5D0037FC33 /* UnifiedSource135.cpp */; };
10101010
536B319E1F735F160037FC33 /* LowLevelInterpreter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680C714BBB16900BFE272 /* LowLevelInterpreter.cpp */; };
1011+
5370806B1FE232DF00299E44 /* JSArrayBufferView.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66BB17B6B5AB00A7AE3F /* JSArrayBufferView.h */; };
10111012
5370B4F61BF26205005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 5370B4F41BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h */; };
10121013
5381B9391E60E97D0090F794 /* WasmFaultSignalHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 5381B9381E60E97D0090F794 /* WasmFaultSignalHandler.h */; settings = {ATTRIBUTES = (Private, ); }; };
10131014
53917E7B1B7906FA000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = 53917E7A1B7906E4000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h */; };
@@ -7993,6 +7994,7 @@
79937994
files = (
79947995
A72701B90DADE94900E548D7 /* ExceptionHelpers.h in Headers */,
79957996
144005CB0A5338D10005F061 /* JSNode.h in Headers */,
7997+
5370806B1FE232DF00299E44 /* JSArrayBufferView.h in Headers */,
79967998
144007570A5370D20005F061 /* JSNodeList.h in Headers */,
79977999
144005CC0A5338F80005F061 /* Node.h in Headers */,
79988000
1440074A0A536CC20005F061 /* NodeList.h in Headers */,
@@ -8867,7 +8869,7 @@
88678869
148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */,
88688870
FE2B0B731FD9EF700075DA5F /* JSCPoison.h in Headers */,
88698871
FE2B0B691FD227E00075DA5F /* JSCPoisonedPtr.h in Headers */,
8870-
A72028B81797601E0098028C /* JSCTestRunnerUtils.h in Headers */,
8872+
A72028B81797601E0098028C /* JSCTestRunnerUtils.h in Headers */,
88718873
72AAF7CE1D0D31B3005E60BE /* JSCustomGetterSetterFunction.h in Headers */,
88728874
0F2B66EC17B6B5AB00A7AE3F /* JSDataView.h in Headers */,
88738875
0F2B66EE17B6B5AB00A7AE3F /* JSDataViewPrototype.h in Headers */,

‎Source/JavaScriptCore/assembler/MacroAssembler.h‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -592,6 +592,11 @@ class MacroAssembler : public MacroAssemblerBase {
592592
urshift32(trustedImm32ForShift(imm), srcDest);
593593
}
594594

595+
void urshiftPtr(RegisterID shiftAmmount, RegisterID srcDest)
596+
{
597+
urshift32(shiftAmmount, srcDest);
598+
}
599+
595600
void negPtr(RegisterID dest)
596601
{
597602
neg32(dest);
@@ -906,6 +911,11 @@ class MacroAssembler : public MacroAssemblerBase {
906911
urshift64(trustedImm32ForShift(imm), srcDest);
907912
}
908913

914+
void urshiftPtr(RegisterID shiftAmmount, RegisterID srcDest)
915+
{
916+
urshift64(shiftAmmount, srcDest);
917+
}
918+
909919
void negPtr(RegisterID dest)
910920
{
911921
neg64(dest);

‎Source/JavaScriptCore/bytecode/AccessCase.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1062,6 +1062,8 @@ void AccessCase::generateImpl(AccessGenerationState& state)
10621062
}
10631063

10641064
if (allocatingInline) {
1065+
// If we were to have any indexed properties, then we would need to update the indexing mask on the base object.
1066+
RELEASE_ASSERT(!newStructure()->couldHaveIndexingHeader());
10651067
// We set the new butterfly and the structure last. Doing it this way ensures that
10661068
// whatever we had done up to this point is forgotten if we choose to branch to slow
10671069
// path.

‎Source/JavaScriptCore/dfg/DFGAbstractHeap.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ namespace JSC { namespace DFG {
5858
macro(JSCell_typeInfoFlags) \
5959
macro(JSCell_typeInfoType) \
6060
macro(JSObject_butterfly) \
61+
macro(JSObject_butterflyMask) \
6162
macro(JSPropertyNameEnumerator_cachedPropertyNames) \
6263
macro(RegExpObject_lastIndex) \
6364
macro(NamedProperties) \

‎Source/JavaScriptCore/dfg/DFGClobberize.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
561561
read(JSCell_indexingType);
562562
read(JSCell_structureID);
563563
read(JSObject_butterfly);
564+
read(JSObject_butterflyMask);
564565
read(Butterfly_publicLength);
565566
read(IndexedDoubleProperties);
566567
read(IndexedInt32Properties);
@@ -576,6 +577,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
576577
read(JSCell_indexingType);
577578
read(JSCell_structureID);
578579
read(JSObject_butterfly);
580+
read(JSObject_butterflyMask);
579581
read(Butterfly_publicLength);
580582
switch (node->arrayMode().type()) {
581583
case Array::Double:
@@ -1109,6 +1111,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
11091111
write(JSCell_structureID);
11101112
write(JSCell_indexingType);
11111113
write(JSObject_butterfly);
1114+
write(JSObject_butterflyMask);
11121115
write(Watchpoint_fire);
11131116
return;
11141117

@@ -1160,6 +1163,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
11601163
case MultiGetByOffset: {
11611164
read(JSCell_structureID);
11621165
read(JSObject_butterfly);
1166+
read(JSObject_butterflyMask);
11631167
AbstractHeap heap(NamedProperties, node->multiGetByOffsetData().identifierNumber);
11641168
read(heap);
11651169
// FIXME: We cannot def() for MultiGetByOffset because CSE is not smart enough to decay it

0 commit comments

Comments
 (0)