Bug 195476 - Randomize the LocalAllocator free list.
Summary: Randomize the LocalAllocator free list.
Status: ASSIGNED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2019-03-08 12:42 PST by Mark Lam
Modified: 2019-03-08 14:34 PST (History)
8 users (show)

See Also:


Attachments
proposed patch. (3.60 KB, patch)
2019-03-08 12:48 PST, Mark Lam
no flags Details | Formatted Diff | Diff
proposed patch. (3.71 KB, patch)
2019-03-08 13:28 PST, Mark Lam
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2019-03-08 12:42:45 PST
<rdar://problem/48722162>
Comment 1 Mark Lam 2019-03-08 12:48:22 PST
Created attachment 364052 [details]
proposed patch.
Comment 2 Mark Lam 2019-03-08 12:55:07 PST
Comment on attachment 364052 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=364052&action=review

> Source/JavaScriptCore/heap/MarkedBlockInlines.h:308
>      // This produces a free list that is ordered in reverse through the block.
>      // This is fine, since the allocation code makes no assumptions about the
>      // order of the free list.

I should also fix this comment.
Comment 3 Mark Lam 2019-03-08 13:28:18 PST
Created attachment 364054 [details]
proposed patch.
Comment 4 Filip Pizlo 2019-03-08 13:29:10 PST
Since this does not randomize bump pointer, I'm not sure there is much protection here.
Comment 5 Mark Lam 2019-03-08 14:34:35 PST
Comment on attachment 364054 [details]
proposed patch.

Taking this out of review while I do some A/B testing.