Repository navigation

Commit 7ff7d12

committed

[JSC] Integrity::isSanePointer() should check alignment for typed pointers

https://bugs.webkit.org/show_bug.cgi?id=319215 Reviewed by Yusuke Suzuki. A sane pointer to a T must be aligned like a T. Add a typed overload that checks this on top of the existing canonical-address check. The void* overload keeps its old behavior for callers probing arbitrary addresses (e.g. the disassembler); all typed call sites pick up the stricter check without change. This catches the value seen in a real crash: a concurrent DFG thread read HeapCell::zap() residue (0x21700000002) out of a freshly reused JSString and dereferenced it as a StringImpl*, because it passed every existing check in speculationFromCell() (oven-sh#285). The reordering race itself is fixed in bug 319213; this hardens the checks that bug 216638 added as a mitigation for bad pointers from profiling data. * Source/JavaScriptCore/tools/Integrity.h: (JSC::Integrity::isSanePointer): Canonical link: https://commits.webkit.org/317118@main

1 parent 904ba51 commit 7ff7d12Copy full SHA for 7ff7d12

1 file changed

Source/JavaScriptCore/tools
- Integrity.h

`‎Source/JavaScriptCore/tools/Integrity.h‎`

-Original file line number
+Diff line change
 #endif // CPU(ADDRESS64)
+}
 +template<typename T>
 +ALWAYS_INLINE bool isSanePointer(const T* pointer)
 +{
 +    return isSanePointer(static_cast<const void*>(pointer)) && !(std::bit_cast<uintptr_t>(pointer) & (alignof(T) - 1));
 +}
++
 #if USE(JSVALUE64)
 class Analyzer {

Comments

(0)