209632 2020-03-26 17:14:20 -0700 Clear the entropy bits in the encodedStructureBits when deallocating a structureID. 2020-03-26 23:38:46 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam mark.lam ews-watchlist keith_miller msaboff saam tzagallo webkit-bug-importer oldest_to_newest 1634657 0 mark.lam 2020-03-26 17:14:20 -0700 We currently only use a 32-bit offset in the StructureIDTable's StructureOrOffset. Though we will never store an offset value that is near 32-bit in size, let alone 64-bit, there's no reason why we can't just use all 64-bits for the offset. Doing so will also have the benefit of zero'ing out the entropy bits in the old encodedStructureBits. This guarantees there's no chance of coalition between a "freed" structureID's entropy bits and the entropy bits in a dead cell due to GC bugs. 1634658 1 webkit-bug-importer 2020-03-26 17:14:46 -0700 <rdar://problem/60943876> 1634660 2 394681 mark.lam 2020-03-26 17:21:20 -0700 Created attachment 394681 proposed patch. 1634755 3 mark.lam 2020-03-26 23:38:46 -0700 Thanks for the review. Landed in r259107: <http://trac.webkit.org/r259107>. 394681 2020-03-26 17:21:20 -0700 2020-03-26 17:23:31 -0700 proposed patch. bug-209632.patch text/plain 1716 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjU5MDkzKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIxIEBA CisyMDIwLTAzLTI2ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBD bGVhciB0aGUgZW50cm9weSBiaXRzIGluIHRoZSBlbmNvZGVkU3RydWN0dXJlQml0cyB3aGVuIGRl YWxsb2NhdGluZyBhIHN0cnVjdHVyZUlELgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MjA5NjMyCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS82MDk0Mzg3 Nj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXZSBj dXJyZW50bHkgb25seSB1c2UgYSAzMi1iaXQgb2Zmc2V0IGluIHRoZSBTdHJ1Y3R1cmVJRFRhYmxl J3MgU3RydWN0dXJlT3JPZmZzZXQuCisgICAgICAgIFRob3VnaCB3ZSB3aWxsIG5ldmVyIHN0b3Jl IGFuIG9mZnNldCB2YWx1ZSB0aGF0IGlzIG5lYXIgMzItYml0IGluIHNpemUsIGxldCBhbG9uZQor ICAgICAgICA2NC1iaXQsIHRoZXJlJ3Mgbm8gcmVhc29uIHdoeSB3ZSBjYW4ndCBqdXN0IHVzZSBh bGwgNjQtYml0cyBmb3IgdGhlIG9mZnNldC4KKyAgICAgICAgRG9pbmcgc28gd2lsbCBhbHNvIGhh dmUgdGhlIGJlbmVmaXQgb2YgemVybydpbmcgb3V0IHRoZSBlbnRyb3B5IGJpdHMgaW4gdGhlIG9s ZAorICAgICAgICBlbmNvZGVkU3RydWN0dXJlQml0cy4gIFRoaXMgZ3VhcmFudGVlcyB0aGF0IHRo ZXJlJ3Mgbm8gY2hhbmNlIG9mIGNvYWxpdGlvbiBiZXR3ZWVuCisgICAgICAgIGEgImZyZWVkIiBz dHJ1Y3R1cmVJRCdzIGVudHJvcHkgYml0cyBhbmQgdGhlIGVudHJvcHkgYml0cyBpbiBhIGRlYWQg Y2VsbCBkdWUgdG8KKyAgICAgICAgR0MgYnVncy4KKworICAgICAgICAqIHJ1bnRpbWUvU3RydWN0 dXJlSURUYWJsZS5oOgorCiAyMDIwLTAzLTI2ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBw bGUuY29tPgogCiAgICAgICAgIFJlZmFjdG9yIFlBUlIgU3RhY2sgT3ZlcmZsb3cgQ2hlY2tzCklu ZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9TdHJ1Y3R1cmVJRFRhYmxlLmgKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvU3RydWN0dXJlSURUYWJs ZS5oCShyZXZpc2lvbiAyNTkwOTIpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9T dHJ1Y3R1cmVJRFRhYmxlLmgJKHdvcmtpbmcgY29weSkKQEAgLTEwOCw3ICsxMDgsNyBAQCBwcml2 YXRlOgogICAgICAgICBXVEZfTUFLRV9GQVNUX0FMTE9DQVRFRDsKICAgICBwdWJsaWM6CiAgICAg ICAgIEVuY29kZWRTdHJ1Y3R1cmVCaXRzIGVuY29kZWRTdHJ1Y3R1cmVCaXRzOwotICAgICAgICBT dHJ1Y3R1cmVJRCBvZmZzZXQ7CisgICAgICAgIHVpbnRwdHJfdCBvZmZzZXQ7CiAgICAgfTsKIAog ICAgIFN0cnVjdHVyZU9yT2Zmc2V0KiB0YWJsZSgpIGNvbnN0IHsgcmV0dXJuIG1fdGFibGUuZ2V0 KCk7IH0K