Title: [211091] trunk/Source/_javascript_Core
- Revision
- 211091
- Author
- [email protected]
- Date
- 2017-01-24 10:57:36 -0800 (Tue, 24 Jan 2017)
Log Message
InferredTypeTable entry manipulation is not TOCTOU race safe
https://bugs.webkit.org/show_bug.cgi?id=167344
Reviewed by Filip Pizlo.
Made the accesses to table values safe from Time of Check,
Time of Use races with local temporary values.
* runtime/InferredTypeTable.cpp:
(JSC::InferredTypeTable::visitChildren):
(JSC::InferredTypeTable::get):
(JSC::InferredTypeTable::willStoreValue):
(JSC::InferredTypeTable::makeTop):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (211090 => 211091)
--- trunk/Source/_javascript_Core/ChangeLog 2017-01-24 18:27:31 UTC (rev 211090)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-01-24 18:57:36 UTC (rev 211091)
@@ -1,3 +1,19 @@
+2017-01-23 Michael Saboff <[email protected]>
+
+ InferredTypeTable entry manipulation is not TOCTOU race safe
+ https://bugs.webkit.org/show_bug.cgi?id=167344
+
+ Reviewed by Filip Pizlo.
+
+ Made the accesses to table values safe from Time of Check,
+ Time of Use races with local temporary values.
+
+ * runtime/InferredTypeTable.cpp:
+ (JSC::InferredTypeTable::visitChildren):
+ (JSC::InferredTypeTable::get):
+ (JSC::InferredTypeTable::willStoreValue):
+ (JSC::InferredTypeTable::makeTop):
+
2017-01-23 Joseph Pecoraro <[email protected]>
Web Inspector: Provide a way to trigger a Garbage Collection
Modified: trunk/Source/_javascript_Core/runtime/InferredTypeTable.cpp (211090 => 211091)
--- trunk/Source/_javascript_Core/runtime/InferredTypeTable.cpp 2017-01-24 18:27:31 UTC (rev 211090)
+++ trunk/Source/_javascript_Core/runtime/InferredTypeTable.cpp 2017-01-24 18:57:36 UTC (rev 211091)
@@ -57,10 +57,12 @@
ConcurrentJSLocker locker(inferredTypeTable->m_lock);
for (auto& entry : inferredTypeTable->m_table) {
- if (!entry.value)
+ auto entryValue = entry.value;
+
+ if (!entryValue)
continue;
- if (entry.value->isRelevant())
- visitor.append(entry.value);
+ if (entryValue->isRelevant())
+ visitor.append(entryValue);
else
entry.value.clear();
}
@@ -69,16 +71,20 @@
InferredType* InferredTypeTable::get(const ConcurrentJSLocker&, UniquedStringImpl* uid)
{
auto iter = m_table.find(uid);
- if (iter == m_table.end() || !iter->value)
+ if (iter == m_table.end())
return nullptr;
+ auto entryValue = iter->value;
+ if (!entryValue)
+ return nullptr;
+
// Take this opportunity to prune invalidated types.
- if (!iter->value->isRelevant()) {
+ if (!entryValue->isRelevant()) {
iter->value.clear();
return nullptr;
}
- return iter->value.get();
+ return entryValue.get();
}
InferredType* InferredTypeTable::get(UniquedStringImpl* uid)
@@ -99,10 +105,14 @@
if (age == OldProperty) {
TableType::iterator iter = m_table.find(propertyName.uid());
- if (iter == m_table.end() || !iter->value)
+ if (iter == m_table.end())
return false; // Absence on replace => top.
+
+ auto entryValue = iter->value;
+ if (!entryValue)
+ return false;
- if (iter->value->willStoreValue(vm, propertyName, value))
+ if (entryValue->willStoreValue(vm, propertyName, value))
return true;
iter->value.clear();
@@ -114,14 +124,16 @@
ConcurrentJSLocker locker(m_lock);
result = m_table.add(propertyName.uid(), WriteBarrier<InferredType>());
}
+ auto entryValue = result.iterator->value;
+
if (result.isNewEntry) {
InferredType* inferredType = InferredType::create(vm);
WTF::storeStoreFence();
- result.iterator->value.set(vm, this, inferredType);
- } else if (!result.iterator->value)
+ entryValue.set(vm, this, inferredType);
+ } else if (!entryValue)
return false;
- if (result.iterator->value->willStoreValue(vm, propertyName, value))
+ if (entryValue->willStoreValue(vm, propertyName, value))
return true;
result.iterator->value.clear();
@@ -133,10 +145,15 @@
// The algorithm here relies on the fact that only one thread modifies the hash map.
if (age == OldProperty) {
TableType::iterator iter = m_table.find(propertyName.uid());
- if (iter == m_table.end() || !iter->value)
+ if (iter == m_table.end())
return; // Absence on replace => top.
- iter->value->makeTop(vm, propertyName);
+ auto entryValue = iter->value;
+
+ if (!entryValue)
+ return;
+
+ entryValue->makeTop(vm, propertyName);
iter->value.clear();
return;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
