Attachment 331457 Details for Bug 181685 – patch

[patch] patch

0001-Allow-dangerous-disabling-of-poison.patch (text/plain), 2.81 KB, created by JF Bastien on 2018-01-16 20:28:29 PST

(hide)

Description:

Filename:

MIME Type:

Creator: JF Bastien

Created: 2018-01-16 20:28:29 PST

Size: 2.81 KB

patch

obsolete

>From 2efba6563de2fcd1087e2b381ca7eadfc8356a15 Mon Sep 17 00:00:00 2001
>From: JF Bastien <jfbastien@apple.com>
>Date: Tue, 16 Jan 2018 09:15:01 -0800
>Subject: [PATCH] Allow dangerous disabling of poison
>
>---
> Source/JavaScriptCore/ChangeLog             | 16 ++++++++++++++++
> Source/JavaScriptCore/runtime/JSCPoison.cpp |  3 +++
> Source/JavaScriptCore/runtime/Options.h     |  2 +-
> 3 files changed, 20 insertions(+), 1 deletion(-)
>
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 517d33f..c8327f4 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,19 @@
>+2018-01-16  JF Bastien  <jfbastien@apple.com>
>+
>+        Allow dangerous disabling of poison
>+        https://bugs.webkit.org/show_bug.cgi?id=181685
>+        <rdar://problem/36546265>
>+
>+        Reviewed by Keith Miller.
>+
>+        Some tools such as leak detectors and such like to look at real
>+        pointers, and poisoned ones confuse them. Add a JSC option to
>+        disable poisoning, but log to the console when this is done.
>+
>+        * runtime/JSCPoison.cpp:
>+        (JSC::initializePoison):
>+        * runtime/Options.h:
>+
> 2018-01-16  Michael Catanzaro  <mcatanzaro@igalia.com>
> 
>         Test programs should only be built in developer mode
>diff --git a/Source/JavaScriptCore/runtime/JSCPoison.cpp b/Source/JavaScriptCore/runtime/JSCPoison.cpp
>index 7770d71..708a349 100644
>--- a/Source/JavaScriptCore/runtime/JSCPoison.cpp
>+++ b/Source/JavaScriptCore/runtime/JSCPoison.cpp
>@@ -26,6 +26,7 @@
> #include "config.h"
> #include "JSCPoison.h"
> 
>+#include "Options.h"
> #include <mutex>
> #include <wtf/HashSet.h>
> 
>@@ -39,6 +40,8 @@ void initializePoison()
> {
>     static std::once_flag initializeOnceFlag;
>     std::call_once(initializeOnceFlag, [] {
>+        if (!Options::usePoisoning())
>+            return;
> 
> #define INITIALIZE_POISON(poisonID) \
>     POISON(poisonID) = makePoison();
>diff --git a/Source/JavaScriptCore/runtime/Options.h b/Source/JavaScriptCore/runtime/Options.h
>index f0189e2..4be5f5d 100644
>--- a/Source/JavaScriptCore/runtime/Options.h
>+++ b/Source/JavaScriptCore/runtime/Options.h
>@@ -459,8 +459,8 @@ constexpr bool enableAsyncIteration = false;
>     v(bool, useWebAssembly, true, Normal, "Expose the WebAssembly global object.") \
>     \
>     v(bool, enableSpectreMitigations, true, Restricted, "Enable Spectre mitigations.") \
>-    \
>     v(bool, enableSpectreGadgets, false, Restricted, "enable gadgets to test Spectre mitigations.") \
>+    v(bool, usePoisoning, true, Normal, "Poison is randomized at load time when true, and initialized to 0 if false which defeats some Spectre and type confusion mitigations, but allows tools such as leak detectors to function better.") \
>     \
>     v(bool, useAsyncIterator, enableAsyncIteration, Normal, "Allow to use Async Iterator in JS.") \
>     \
>-- 
>2.9.3
>

Actions: View | Formatted Diff | Diff

Attachments on bug 181685: 331392 | 331395 | 331421 | 331435 | 331441 | 331457