Bug 214953 - validate untagArrayPtr
Summary: validate untagArrayPtr
Status: REOPENED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
URL:
Keywords: InRadar
Depends on: 215074
Blocks:
  Show dependency treegraph
 
Reported: 2020-07-29 17:51 PDT by Saam Barati
Modified: 2020-08-02 01:21 PDT (History)
16 users (show)

See Also:


Attachments
patch (22.95 KB, patch)
2020-07-30 15:10 PDT, Saam Barati
no flags Details | Formatted Diff | Diff
patch (23.01 KB, patch)
2020-07-30 18:03 PDT, Saam Barati
keith_miller: review+
Details | Formatted Diff | Diff
patch for landing (23.05 KB, patch)
2020-07-31 11:09 PDT, Saam Barati
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2020-07-29 17:51:09 PDT
....
Comment 1 Saam Barati 2020-07-30 15:10:47 PDT
Created attachment 405627 [details]
patch
Comment 2 Saam Barati 2020-07-30 15:11:29 PDT
Comment on attachment 405627 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=405627&action=review

> Source/JavaScriptCore/assembler/MacroAssemblerARM64E.h:135
> +        TrustedImm32 shiftAmount { 64 - OS_CONSTANT(EFFECTIVE_ADDRESS_WIDTH) };

Will switch to using Keith's new constant once it lands.

> Source/JavaScriptCore/jit/AssemblyHelpers.cpp:1152
> +        skip = branchPtr(Equal, storage, TrustedImmPtr(JSArrayBufferView::nullVectorPtr()));

this is the change.

> Source/JavaScriptCore/jit/AssemblyHelpers.cpp:1188
> +            done.append(branchPtr(Equal, storage, TrustedImmPtr(JSArrayBufferView::nullVectorPtr())));

this is the changed line.
Comment 3 Saam Barati 2020-07-30 18:03:50 PDT
Created attachment 405646 [details]
patch
Comment 4 Keith Miller 2020-07-31 10:13:34 PDT
Comment on attachment 405646 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=405646&action=review

r=me with some comments.

> Source/JavaScriptCore/assembler/MacroAssemblerARM64E.h:135
> +        TrustedImm32 shiftAmount { 64 - OS_CONSTANT(EFFECTIVE_ADDRESS_WIDTH) };

Nit: Can you use numberOfPACBits?

> Source/JavaScriptCore/assembler/MacroAssemblerARM64E.h:137
> +        lshift64(shiftAmount, target);
> +        urshift64(shiftAmount, target);

I think this can probably be a single and instruction for each of the constants we currently use.
Comment 5 Saam Barati 2020-07-31 11:09:41 PDT
Created attachment 405710 [details]
patch for landing
Comment 6 EWS 2020-07-31 11:46:23 PDT
Committed r265151: <https://trac.webkit.org/changeset/265151>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 405710 [details].
Comment 7 Radar WebKit Bug Importer 2020-07-31 11:47:19 PDT
<rdar://problem/66391434>
Comment 8 WebKit Commit Bot 2020-08-02 01:21:33 PDT
Re-opened since this is blocked by bug 215074