Bug 143894 - Use ASan poisoning to taint moved-out-of Refs
Summary: Use ASan poisoning to taint moved-out-of Refs
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Web Template Framework (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Alexey Proskuryakov
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2015-04-17 13:55 PDT by Alexey Proskuryakov
Modified: 2015-04-17 15:46 PDT (History)
5 users (show)

See Also:


Attachments
proposed patch (1.70 KB, patch)
2015-04-17 13:56 PDT, Alexey Proskuryakov
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2015-04-17 13:55:14 PDT
It has been suggested that we can taint Refs to check that they are not used after moving out.

I'm not sure if we can practically expect to catch any bugs (the pointer is already zeroed out), but this seems easy enough to do, and harmless. Could catch something one day.

<rdar://problem/19443723>
Comment 1 Alexey Proskuryakov 2015-04-17 13:56:50 PDT
Created attachment 251042 [details]
proposed patch
Comment 2 Sam Weinig 2015-04-17 15:33:58 PDT
Comment on attachment 251042 [details]
proposed patch

View in context: https://bugs.webkit.org/attachment.cgi?id=251042&action=review

> Source/WTF/wtf/Ref.h:38
> +#if ASAN_ENABLED
> +extern "C" void __asan_poison_memory_region(void const volatile *addr, size_t size);
> +extern "C" void __asan_unpoison_memory_region(void const volatile *addr, size_t size);
> +extern "C" bool __asan_address_is_poisoned(void const volatile *addr);
> +#endif

I think this should probably be in Compiler.h, since it seems like this could be generally useful.  Perhaps we should also put it behind some nicer macros / inline functions.
Comment 3 WebKit Commit Bot 2015-04-17 15:46:47 PDT
Comment on attachment 251042 [details]
proposed patch

Clearing flags on attachment: 251042

Committed r182977: <http://trac.webkit.org/changeset/182977>
Comment 4 WebKit Commit Bot 2015-04-17 15:46:53 PDT
All reviewed patches have been landed.  Closing bug.