Bug 280354 – [JSC] AssemblerBuffer should poison its inline buffer when JIT_SCAN_ASSEMBLER_BUFFER_FOR_ZEROES is enabled

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Marcus Plutowski]

rdar://127124028

The JIT_SCAN_ASSEMBLER_BUFFER_FOR_ZEROES option is meant to detect 0-corruptions in the LinkBuffer/AssemblerBuffer structures used by JSC. However it strictly doesn't know whether the 0s were actually written there, or whether they're just leftover from initialization (having never been overwritten). Poisoning the buffers as we construct them will let us distinguish the latter case from the former.
Ideally we'd like to poison all assembler buffers, but doing so on the larger buffers seems to be too slow so we're just going to start with the inline-buffer, as that's the one most vulnerable to corruption (being on the stack, whereas the out-of-line buffer is on the heap).

[Marcus Plutowski]

Pull request: https://github.com/WebKit/WebKit/pull/34249

[EWS]

Committed 284300@main (60a72b8caf51): <https://commits.webkit.org/284300@main>

Reviewed commits have been landed. Closing PR #34249 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/136764436>

[EWS]

Committed 283286.144@safari-7620-branch (4101a80ce0e0): <https://commits.webkit.org/283286.144@safari-7620-branch>

Reviewed commits have been landed. Closing PR #1919 and removing active labels.