Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (279340 => 279341)
--- trunk/Source/_javascript_Core/ChangeLog 2021-06-28 16:39:19 UTC (rev 279340)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-06-28 16:48:33 UTC (rev 279341)
@@ -1,3 +1,26 @@
+2021-06-28 Mikhail R. Gadelha <[email protected]>
+
+ Prevent sign-extended casts for 32 bits arch
+ https://bugs.webkit.org/show_bug.cgi?id=227170
+
+ Reviewed by Yusuke Suzuki.
+
+ In a number of places, addresses are reinterpreted as uint64, which can
+ lead to wrong addresses in 32 bits arch.
+
+ * assembler/testmasm.cpp:
+ (JSC::testBranchTruncateDoubleToInt32):
+ * disassembler/ARM64/A64DOpcode.h:
+ (JSC::ARM64Disassembler::A64DOpcode::appendPCRelativeOffset):
+ * runtime/JSCell.cpp:
+ (JSC::reportZappedCellAndCrash):
+ * wasm/WasmAirIRGenerator.cpp:
+ (JSC::Wasm::AirIRGenerator::emitEntryTierUpCheck):
+ (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):
+ * wasm/WasmB3IRGenerator.cpp:
+ (JSC::Wasm::B3IRGenerator::emitEntryTierUpCheck):
+ (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):
+
2021-06-25 Commit Queue <[email protected]>
Unreviewed, reverting r279266.
Modified: trunk/Source/_javascript_Core/assembler/testmasm.cpp (279340 => 279341)
--- trunk/Source/_javascript_Core/assembler/testmasm.cpp 2021-06-28 16:39:19 UTC (rev 279340)
+++ trunk/Source/_javascript_Core/assembler/testmasm.cpp 2021-06-28 16:48:33 UTC (rev 279341)
@@ -292,7 +292,7 @@
// Nan, should either yield 0 in dest or fail.
void testBranchTruncateDoubleToInt32(double val, int32_t expected)
{
- const uint64_t valAsUInt = *reinterpret_cast<uint64_t*>(&val);
+ const uint64_t valAsUInt = bitwise_cast<uint64_t>(val);
#if CPU(BIG_ENDIAN)
const bool isBigEndian = true;
#else
Modified: trunk/Source/_javascript_Core/disassembler/ARM64/A64DOpcode.h (279340 => 279341)
--- trunk/Source/_javascript_Core/disassembler/ARM64/A64DOpcode.h 2021-06-28 16:39:19 UTC (rev 279340)
+++ trunk/Source/_javascript_Core/disassembler/ARM64/A64DOpcode.h 2021-06-28 16:48:33 UTC (rev 279341)
@@ -187,7 +187,7 @@
void appendPCRelativeOffset(uint32_t* pc, int32_t immediate)
{
- bufferPrintf("0x%" PRIx64, reinterpret_cast<uint64_t>(pc + immediate));
+ bufferPrintf("0x%" PRIxPTR, bitwise_cast<uintptr_t>(pc + immediate));
}
void appendShiftAmount(unsigned amount)
Modified: trunk/Source/_javascript_Core/jsc.cpp (279340 => 279341)
--- trunk/Source/_javascript_Core/jsc.cpp 2021-06-28 16:39:19 UTC (rev 279340)
+++ trunk/Source/_javascript_Core/jsc.cpp 2021-06-28 16:48:33 UTC (rev 279341)
@@ -1480,7 +1480,7 @@
if (!value.isCell())
return JSValue::encode(jsUndefined());
// Need to cast to uint64_t so bitwise_cast will play along.
- uint64_t asNumber = reinterpret_cast<uintptr_t>(value.asCell());
+ uint64_t asNumber = bitwise_cast<uintptr_t>(value.asCell());
EncodedJSValue returnValue = JSValue::encode(jsNumber(bitwise_cast<double>(asNumber)));
return returnValue;
}
Modified: trunk/Source/_javascript_Core/runtime/JSCell.cpp (279340 => 279341)
--- trunk/Source/_javascript_Core/runtime/JSCell.cpp 2021-06-28 16:39:19 UTC (rev 279340)
+++ trunk/Source/_javascript_Core/runtime/JSCell.cpp 2021-06-28 16:48:33 UTC (rev 279341)
@@ -292,7 +292,7 @@
variousState |= static_cast<uint64_t>(foundBlockHandle->needsDestruction()) << 3;
variousState |= static_cast<uint64_t>(foundBlock->isNewlyAllocated(cell)) << 4;
- ptrdiff_t cellOffset = cellAddress - reinterpret_cast<uint64_t>(foundBlockHandle->start());
+ ptrdiff_t cellOffset = cellAddress - bitwise_cast<uintptr_t>(foundBlockHandle->start());
bool cellIsProperlyAligned = !(cellOffset % cellSize);
variousState |= static_cast<uint64_t>(cellIsProperlyAligned) << 5;
} else {
Modified: trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp (279340 => 279341)
--- trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp 2021-06-28 16:39:19 UTC (rev 279340)
+++ trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp 2021-06-28 16:48:33 UTC (rev 279341)
@@ -2808,9 +2808,8 @@
return;
auto countdownPtr = g64();
+ append(Move, Arg::bigImm(bitwise_cast<uintptr_t>(&m_tierUp->m_counter)), countdownPtr);
- append(Move, Arg::bigImm(reinterpret_cast<uint64_t>(&m_tierUp->m_counter)), countdownPtr);
-
auto* patch = addPatchpoint(B3::Void);
B3::Effects effects = B3::Effects::none();
effects.reads = B3::HeapRange::top();
@@ -2860,9 +2859,8 @@
m_tierUp->outerLoops().append(outerLoopIndex);
auto countdownPtr = g64();
+ append(Move, Arg::bigImm(bitwise_cast<uintptr_t>(&m_tierUp->m_counter)), countdownPtr);
- append(Move, Arg::bigImm(reinterpret_cast<uint64_t>(&m_tierUp->m_counter)), countdownPtr);
-
auto* patch = addPatchpoint(B3::Void);
B3::Effects effects = B3::Effects::none();
effects.reads = B3::HeapRange::top();
Modified: trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp (279340 => 279341)
--- trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp 2021-06-28 16:39:19 UTC (rev 279340)
+++ trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp 2021-06-28 16:48:33 UTC (rev 279341)
@@ -2030,7 +2030,7 @@
return;
ASSERT(m_tierUp);
- Value* countDownLocation = constant(pointerType(), reinterpret_cast<uint64_t>(&m_tierUp->m_counter), Origin());
+ Value* countDownLocation = constant(pointerType(), bitwise_cast<uintptr_t>(&m_tierUp->m_counter), Origin());
PatchpointValue* patch = m_currentBlock->appendNew<PatchpointValue>(m_proc, B3::Void, Origin());
Effects effects = Effects::none();
@@ -2080,7 +2080,7 @@
m_tierUp->osrEntryTriggers().append(TierUpCount::TriggerReason::DontTrigger);
m_tierUp->outerLoops().append(outerLoopIndex);
- Value* countDownLocation = constant(pointerType(), reinterpret_cast<uint64_t>(&m_tierUp->m_counter), origin);
+ Value* countDownLocation = constant(pointerType(), bitwise_cast<uintptr_t>(&m_tierUp->m_counter), origin);
Vector<ExpressionType> stackmap;
for (auto& local : m_locals) {
Modified: trunk/Source/WTF/ChangeLog (279340 => 279341)
--- trunk/Source/WTF/ChangeLog 2021-06-28 16:39:19 UTC (rev 279340)
+++ trunk/Source/WTF/ChangeLog 2021-06-28 16:48:33 UTC (rev 279341)
@@ -1,3 +1,16 @@
+2021-06-28 Mikhail R. Gadelha <[email protected]>
+
+ Prevent sign-extended casts for 32 bits arch
+ https://bugs.webkit.org/show_bug.cgi?id=227170
+
+ Reviewed by Yusuke Suzuki.
+
+ In a number of places, addresses are reinterpreted as uint64, which can
+ lead to wrong addresses in 32 bits arch.
+
+ * wtf/LoggerHelper.h:
+ (WTF::LoggerHelper::childLogIdentifier):
+
2021-06-28 Sam Weinig <[email protected]>
Add helpers to create Spans from CFDataRef and NSData
Modified: trunk/Source/WTF/wtf/LoggerHelper.h (279340 => 279341)
--- trunk/Source/WTF/wtf/LoggerHelper.h 2021-06-28 16:39:19 UTC (rev 279340)
+++ trunk/Source/WTF/wtf/LoggerHelper.h 2021-06-28 16:48:33 UTC (rev 279341)
@@ -76,7 +76,7 @@
{
static constexpr uint64_t parentMask = 0xffffffffffff0000ull;
static constexpr uint64_t maskLowerWord = 0xffffull;
- return reinterpret_cast<const void*>((reinterpret_cast<uint64_t>(parentIdentifier) & parentMask) | (childIdentifier & maskLowerWord));
+ return reinterpret_cast<const void*>((bitwise_cast<uintptr_t>(parentIdentifier) & parentMask) | (childIdentifier & maskLowerWord));
}
static const void* uniqueLogIdentifier()
