220021 2020-12-18 11:30:42 -0800 Fix MacroAssemblerARM64E::validateUntaggedPtr() to account for TBI. 2020-12-18 16:01:21 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam mark.lam ews-watchlist fpizlo keith_miller msaboff rmorisset saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1715768 0 mark.lam 2020-12-18 11:30:42 -0800 Patch coming. 1715770 1 webkit-bug-importer 2020-12-18 11:31:24 -0800 <rdar://problem/72474809> 1715776 2 416537 mark.lam 2020-12-18 11:37:49 -0800 Created attachment 416537 proposed patch. 1715777 3 416537 saam 2020-12-18 11:47:49 -0800 Comment on attachment 416537 proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=416537&action=review > Source/JavaScriptCore/assembler/MacroAssemblerARM64E.h:-86 > - load8(Address(target), scratch); We should DisallowScratch here, to make sure we're not relying on it. It'd kill your scratch > Source/JavaScriptCore/assembler/MacroAssemblerARM64E.h:87 > + and64(TrustedImm64(0xff000000000000), scratch, scratch); 0x0f000000000000, right? 1715782 4 416537 saam 2020-12-18 12:04:46 -0800 Comment on attachment 416537 proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=416537&action=review >> Source/JavaScriptCore/assembler/MacroAssemblerARM64E.h:87 >> + and64(TrustedImm64(0xff000000000000), scratch, scratch); > > 0x0f000000000000, right? ignore this 1715787 5 416540 mark.lam 2020-12-18 12:34:06 -0800 Created attachment 416540 patch for landing. Thanks for the review. 1715796 6 mark.lam 2020-12-18 13:43:11 -0800 Landed in r270988: <http://trac.webkit.org/r270988>. 1715833 7 mark.lam 2020-12-18 16:01:21 -0800 Also landed a build fix in r270993: <http://trac.webkit.org/r270993>. 416537 2020-12-18 11:37:49 -0800 2020-12-18 12:34:06 -0800 proposed patch. bug-220021.patch text/plain 1428 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjcwOTgxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBA CisyMDIwLTEyLTE4ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBG aXggTWFjcm9Bc3NlbWJsZXJBUk02NEU6OnZhbGlkYXRlVW50YWdnZWRQdHIoKSB0byBhY2NvdW50 IGZvciBUQkkuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p ZD0yMjAwMjEKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzcyNDc0ODA5PgorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogYXNzZW1ibGVyL01hY3JvQXNz ZW1ibGVyQVJNNjRFLmg6CisgICAgICAgIChKU0M6Ok1hY3JvQXNzZW1ibGVyQVJNNjRFOjp2YWxp ZGF0ZVVudGFnZ2VkUHRyKToKKwogMjAyMC0xMi0xNyAgTWFyayBMYW0gIDxtYXJrLmxhbUBhcHBs ZS5jb20+CiAKICAgICAgICAgQWRkIHRhZ2dpbmcgdG8gSklUIHByb2JlJ3MgcmV0dXJuIGFkZHJl c3MuCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYXNzZW1ibGVyL01hY3JvQXNzZW1ibGVy QVJNNjRFLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2Fzc2VtYmxlci9N YWNyb0Fzc2VtYmxlckFSTTY0RS5oCShyZXZpc2lvbiAyNzA5ODApCisrKyBTb3VyY2UvSmF2YVNj cmlwdENvcmUvYXNzZW1ibGVyL01hY3JvQXNzZW1ibGVyQVJNNjRFLmgJKHdvcmtpbmcgY29weSkK QEAgLTgzLDcgKzgzLDEwIEBAIHB1YmxpYzoKICAgICB7CiAgICAgICAgIGlmIChzY3JhdGNoID09 IEludmFsaWRHUFIpCiAgICAgICAgICAgICBzY3JhdGNoID0gZ2V0Q2FjaGVkRGF0YVRlbXBSZWdp c3RlcklEQW5kSW52YWxpZGF0ZSgpOwotICAgICAgICBsb2FkOChBZGRyZXNzKHRhcmdldCksIHNj cmF0Y2gpOworICAgICAgICByc2hpZnQ2NCh0YXJnZXQsIFRydXN0ZWRJbW0zMig4KSwgc2NyYXRj aCk7CisgICAgICAgIGFuZDY0KFRydXN0ZWRJbW02NCgweGZmMDAwMDAwMDAwMDAwKSwgc2NyYXRj aCwgc2NyYXRjaCk7CisgICAgICAgIG9yNjQodGFyZ2V0LCBzY3JhdGNoLCBzY3JhdGNoKTsKKyAg ICAgICAgbG9hZDgoQWRkcmVzcyhzY3JhdGNoKSwgc2NyYXRjaCk7CiAgICAgfQogCiAgICAgQUxX QVlTX0lOTElORSB2b2lkIHVudGFnUHRyKFJlZ2lzdGVySUQgdGFnLCBSZWdpc3RlcklEIHRhcmdl dCkK 416540 2020-12-18 12:34:06 -0800 2020-12-18 12:34:06 -0800 patch for landing. bug-220021.patch text/plain 3786 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjcwOTg1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDIwLTEyLTE4ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBG aXggTWFjcm9Bc3NlbWJsZXJBUk02NEU6OnZhbGlkYXRlVW50YWdnZWRQdHIoKSB0byBhY2NvdW50 IGZvciBUQkkuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p ZD0yMjAwMjEKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzcyNDc0ODA5PgorCisgICAgICAgIFJl dmlld2VkIGJ5IFNhYW0gQmFyYXRpLgorCisgICAgICAgICogYXNzZW1ibGVyL0Fic3RyYWN0TWFj cm9Bc3NlbWJsZXIuaDoKKyAgICAgICAgKiBhc3NlbWJsZXIvRGlzYWxsb3dNYWNyb1NjcmF0Y2hS ZWdpc3RlclVzYWdlLmg6CisgICAgICAgIC0gdGVtcGxhdGl6ZWQgdGhlIERpc2FsbG93TWFjcm9T Y3JhdGNoUmVnaXN0ZXJVc2FnZSBjbGFzcyBzbyB0aGF0IHdlIGNhbiAjaW5jbHVkZQorICAgICAg ICAgIGl0IGluIE1hY3JvQXNzZW1ibGVyIGltcGxlbWVudGF0aW9ucy4KKyAgICAgICAgKiBhc3Nl bWJsZXIvTWFjcm9Bc3NlbWJsZXJBUk02NEUuaDoKKyAgICAgICAgKEpTQzo6TWFjcm9Bc3NlbWJs ZXJBUk02NEU6OnZhbGlkYXRlVW50YWdnZWRQdHIpOgorCiAyMDIwLTEyLTE3ICBNYXJrIExhbSAg PG1hcmsubGFtQGFwcGxlLmNvbT4KIAogICAgICAgICBBZGQgdGFnZ2luZyB0byBKSVQgcHJvYmUn cyByZXR1cm4gYWRkcmVzcy4KSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIv QWJzdHJhY3RNYWNyb0Fzc2VtYmxlci5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9hc3NlbWJsZXIvQWJzdHJhY3RNYWNyb0Fzc2VtYmxlci5oCShyZXZpc2lvbiAyNzA5ODAp CisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYXNzZW1ibGVyL0Fic3RyYWN0TWFjcm9Bc3NlbWJs ZXIuaAkod29ya2luZyBjb3B5KQpAQCAtNDYsOSArNDYsMTEgQEAgbmFtZXNwYWNlIEpTQyB7CiAj aWYgRU5BQkxFKEFTU0VNQkxFUikKIAogY2xhc3MgQWxsb3dNYWNyb1NjcmF0Y2hSZWdpc3RlclVz YWdlOwotY2xhc3MgRGlzYWxsb3dNYWNyb1NjcmF0Y2hSZWdpc3RlclVzYWdlOwogY2xhc3MgTGlu a0J1ZmZlcjsKIGNsYXNzIFdhdGNocG9pbnQ7CisKK3RlbXBsYXRlPHR5cGVuYW1lIFQ+IGNsYXNz IERpc2FsbG93TWFjcm9TY3JhdGNoUmVnaXN0ZXJVc2FnZTsKKwogbmFtZXNwYWNlIERGRyB7CiBz dHJ1Y3QgT1NSRXhpdDsKIH0KQEAgLTExMDcsNyArMTEwOSw3IEBAIHByb3RlY3RlZDoKIAogICAg IGZyaWVuZCBjbGFzcyBBbGxvd01hY3JvU2NyYXRjaFJlZ2lzdGVyVXNhZ2U7CiAgICAgZnJpZW5k IGNsYXNzIEFsbG93TWFjcm9TY3JhdGNoUmVnaXN0ZXJVc2FnZUlmOwotICAgIGZyaWVuZCBjbGFz cyBEaXNhbGxvd01hY3JvU2NyYXRjaFJlZ2lzdGVyVXNhZ2U7CisgICAgdGVtcGxhdGU8dHlwZW5h bWUgVD4gZnJpZW5kIGNsYXNzIERpc2FsbG93TWFjcm9TY3JhdGNoUmVnaXN0ZXJVc2FnZTsKICAg ICB1bnNpZ25lZCBtX3RlbXBSZWdpc3RlcnNWYWxpZEJpdHM7CiAgICAgYm9vbCBtX2FsbG93U2Ny YXRjaFJlZ2lzdGVyIHsgdHJ1ZSB9OwogCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYXNz ZW1ibGVyL0Rpc2FsbG93TWFjcm9TY3JhdGNoUmVnaXN0ZXJVc2FnZS5oCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIvRGlzYWxsb3dNYWNyb1NjcmF0Y2hSZWdp c3RlclVzYWdlLmgJKHJldmlzaW9uIDI3MDk4MCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9h c3NlbWJsZXIvRGlzYWxsb3dNYWNyb1NjcmF0Y2hSZWdpc3RlclVzYWdlLmgJKHdvcmtpbmcgY29w eSkKQEAgLTEsNSArMSw1IEBACiAvKgotICogQ29weXJpZ2h0IChDKSAyMDE1IEFwcGxlIEluYy4g QWxsIHJpZ2h0cyByZXNlcnZlZC4KKyAqIENvcHlyaWdodCAoQykgMjAxNS0yMDIwIEFwcGxlIElu Yy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KICAqCiAgKiBSZWRpc3RyaWJ1dGlvbiBhbmQgdXNlIGlu IHNvdXJjZSBhbmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdpdGhvdXQKICAqIG1vZGlmaWNhdGlv biwgYXJlIHBlcm1pdHRlZCBwcm92aWRlZCB0aGF0IHRoZSBmb2xsb3dpbmcgY29uZGl0aW9ucwpA QCAtMjcsMTAgKzI3LDkgQEAKIAogI2lmIEVOQUJMRShBU1NFTUJMRVIpCiAKLSNpbmNsdWRlICJN YWNyb0Fzc2VtYmxlci5oIgotCiBuYW1lc3BhY2UgSlNDIHsKIAordGVtcGxhdGU8dHlwZW5hbWUg TWFjcm9Bc3NlbWJsZXI+CiBjbGFzcyBEaXNhbGxvd01hY3JvU2NyYXRjaFJlZ2lzdGVyVXNhZ2Ug ewogcHVibGljOgogICAgIERpc2FsbG93TWFjcm9TY3JhdGNoUmVnaXN0ZXJVc2FnZShNYWNyb0Fz c2VtYmxlciYgbWFzbSkKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIvTWFj cm9Bc3NlbWJsZXJBUk02NEUuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUv YXNzZW1ibGVyL01hY3JvQXNzZW1ibGVyQVJNNjRFLmgJKHJldmlzaW9uIDI3MDk4MCkKKysrIFNv dXJjZS9KYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIvTWFjcm9Bc3NlbWJsZXJBUk02NEUuaAkod29y a2luZyBjb3B5KQpAQCAtMjcsNiArMjcsOCBAQAogCiAjaWYgRU5BQkxFKEFTU0VNQkxFUikgJiYg Q1BVKEFSTTY0RSkKIAorI2luY2x1ZGUgIkRpc2FsbG93TWFjcm9TY3JhdGNoUmVnaXN0ZXJVc2Fn ZS5oIgorCiAvLyBXZSBuZWVkIHRvIGluY2x1ZGUgdGhpcyBiZWZvcmUgTWFjcm9Bc3NlbWJsZXJB Uk02NC5oIGJlY2F1c2UgTWFjcm9Bc3NlbWJsZXJBUk02NAogLy8gd2lsbCBiZSBkZWZpbmVkIGlu IHRlcm1zIG9mIEFSTTY0RUFzc2VtYmxlciBmb3IgQVJNNjRFLgogI2luY2x1ZGUgIkFSTTY0RUFz c2VtYmxlci5oIgpAQCAtODMsNyArODUsMTIgQEAgcHVibGljOgogICAgIHsKICAgICAgICAgaWYg KHNjcmF0Y2ggPT0gSW52YWxpZEdQUikKICAgICAgICAgICAgIHNjcmF0Y2ggPSBnZXRDYWNoZWRE YXRhVGVtcFJlZ2lzdGVySURBbmRJbnZhbGlkYXRlKCk7Ci0gICAgICAgIGxvYWQ4KEFkZHJlc3Mo dGFyZ2V0KSwgc2NyYXRjaCk7CisKKyAgICAgICAgRGlzYWxsb3dNYWNyb1NjcmF0Y2hSZWdpc3Rl clVzYWdlIGRpc2FsbG93U2NvcGUoKnRoaXMpOworICAgICAgICByc2hpZnQ2NCh0YXJnZXQsIFRy dXN0ZWRJbW0zMig4KSwgc2NyYXRjaCk7CisgICAgICAgIGFuZDY0KFRydXN0ZWRJbW02NCgweGZm MDAwMDAwMDAwMDAwKSwgc2NyYXRjaCwgc2NyYXRjaCk7CisgICAgICAgIG9yNjQodGFyZ2V0LCBz Y3JhdGNoLCBzY3JhdGNoKTsKKyAgICAgICAgbG9hZDgoQWRkcmVzcyhzY3JhdGNoKSwgc2NyYXRj aCk7CiAgICAgfQogCiAgICAgQUxXQVlTX0lOTElORSB2b2lkIHVudGFnUHRyKFJlZ2lzdGVySUQg dGFnLCBSZWdpc3RlcklEIHRhcmdldCkK