Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c1f2f38f01247c312e784c62d17d902213c4ecfd
https://github.com/WebKit/WebKit/commit/c1f2f38f01247c312e784c62d17d902213c4ecfd
Author: Marcus Plutowski <[email protected]>
Date: 2026-10-12 (Mon, 12 Oct 2026)
Changed paths:
M Source/bmalloc/libpas/libpas.xcodeproj/project.pbxproj
M Source/bmalloc/libpas/src/libpas/pas_segregated_heap.c
A Source/bmalloc/libpas/src/test/MTETests.cpp
M Source/bmalloc/libpas/src/test/TestHarness.cpp
M Source/bmalloc/libpas/src/test/TestHarness.h
A Source/bmalloc/libpas/test_pas.entitlements
Log Message:
-----------
[libpas] Add MTE tag-policy tests for bmalloc heap
https://bugs.webkit.org/show_bug.cgi?id=315385
rdar://177738834
Reviewed by Dan Hecht.
These tests ensure that we tag objects we expect to be tagged (and vice
versa), correctly enforce tag-selection hardening policies (ATE, PTE,
etc.), and retag objects as appropriate (on free/scavenge).
Not all of these are stressed in production builds, so this is the only
place where some behaviors are enforced.
At present, the retagging tests require probabilistic checks,
as we cannot guarantee that all objects will be retagged with a
tag distinct from the previous one, and thus have to allow for a
certain number of temporal collisions. Once PTE is implemented, we
will be able to get rid of this if we so choose.
* Source/bmalloc/libpas/libpas.xcodeproj/project.pbxproj:
* Source/bmalloc/libpas/src/libpas/pas_segregated_heap.c:
(check_size_lookup_recomputation):
* Source/bmalloc/libpas/src/test/MTETests.cpp: Added.
(std::logicalTagOf):
(std::allocationTagOf):
(std::objectKindOf):
(std::isSegregatedKind):
(std::isBitfitKind):
(std::testMTETagsTaggedHeapObjectsAreTagged):
(std::testMTETagsUntaggedHeapObjectsAreZeroTagged):
(std::testMTETagsAtAndBelowCeilingAreTagged):
(std::testMTETagsAboveCeilingAreUntagged):
(std::testMTESegregatedAdjacentObjectsHaveDifferentTags):
(std::testMTEBitfitAdjacentObjectsHaveDifferentTags):
(std::testMTEReallocPreservesDataAndUsesNonzeroTag):
(std::testMTECompactReallocGivesZeroTag):
(std::testMTEBitfitObjectsGetRetaggedOnFreeManyIterations):
(std::testMTESegregatedObjectsGetRetaggedOnScavenge):
(addMTETests):
* Source/bmalloc/libpas/src/test/TestHarness.cpp:
(RuntimeConfigTestScope::RuntimeConfigTestScope):
(ForceSegregated::ForceSegregated):
(main):
* Source/bmalloc/libpas/src/test/TestHarness.h:
* Source/bmalloc/libpas/test_pas.entitlements: Added.
Canonical link: https://commits.webkit.org/323491@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
