Skip to content

Commit d4a934d

Browse files
committed
[JSC] Assert arguments of CachedCall::callWithArguments using Integrity::auditCell
https://bugs.webkit.org/show_bug.cgi?id=301833 Reviewed by Yusuke Suzuki. This patch changes to assert arguments of `CachedCall:callWithArguments` using `Integrity::auditCell`. Also, following the best practice that `**Inlines.h` should not be included from any header file other than `**Inlines.h`[1], this patch creates a new `CachedCallInlines.h`. [1]: https://github.com/WebKit/WebKit/wiki/Analyzing-Build-Performance#avoid-including-inlinesh-headers-in-other-headers * Source/JavaScriptCore/CMakeLists.txt: * Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj: * Source/JavaScriptCore/interpreter/CachedCall.h: (JSC::CachedCall::callWithArguments): Deleted. * Source/JavaScriptCore/interpreter/CachedCallInlines.h: Added. (JSC::CachedCall::callWithArguments): * Source/JavaScriptCore/runtime/ArrayPrototype.cpp: * Source/JavaScriptCore/runtime/IteratorOperations.h: * Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h: * Source/JavaScriptCore/runtime/JSIteratorPrototype.cpp: * Source/JavaScriptCore/runtime/MapPrototype.cpp: * Source/JavaScriptCore/runtime/RegExpPrototype.cpp: * Source/JavaScriptCore/runtime/SetPrototype.cpp: * Source/JavaScriptCore/runtime/StringPrototypeInlines.h: * Source/JavaScriptCore/runtime/WeakMapPrototype.cpp: * Source/JavaScriptCore/tools/IntegrityInlines.h: * Source/WebCore/WebCore.xcodeproj/project.pbxproj: Canonical link: https://commits.webkit.org/302981@main
1 parent dfa42ca commit d4a934d

14 files changed

+105
-56
lines changed

Source/JavaScriptCore/CMakeLists.txt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -903,6 +903,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
903903
inspector/remote/RemoteInspector.h
904904

905905
interpreter/CachedCall.h
906+
interpreter/CachedCallInlines.h
906907
interpreter/CalleeBits.h
907908
interpreter/CallFrame.h
908909
interpreter/CallFrameInlines.h
@@ -1409,6 +1410,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
14091410
runtime/WriteBarrierInlines.h
14101411

14111412
tools/Integrity.h
1413+
tools/IntegrityInlines.h
14121414
tools/LLVMProfiling.h
14131415
tools/SourceProfiler.h
14141416

Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1722,6 +1722,7 @@
17221722
A7F9935F0FD7325100A0B2D0 /* JSONObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F9935D0FD7325100A0B2D0 /* JSONObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
17231723
A7FB61001040C38B0017A286 /* PropertyDescriptor.h in Headers */ = {isa = PBXBuildFile; fileRef = A7FB604B103F5EAB0017A286 /* PropertyDescriptor.h */; settings = {ATTRIBUTES = (Private, ); }; };
17241724
A7FCC26D17A0B6AA00786D1A /* FTLSwitchCase.h in Headers */ = {isa = PBXBuildFile; fileRef = A7FCC26C17A0B6AA00786D1A /* FTLSwitchCase.h */; };
1725+
AA45D14F2EB82FEB00FCBD16 /* CachedCallInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = AA45D14E2EB82FEB00FCBD16 /* CachedCallInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
17251726
AA785BEB2E77BECA0097F688 /* JSPromiseAllContext.h in Headers */ = {isa = PBXBuildFile; fileRef = AA785BEA2E77BECA0097F688 /* JSPromiseAllContext.h */; };
17261727
AA785BEE2E77BED70097F688 /* JSPromiseAllContextInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = AA785BED2E77BED70097F688 /* JSPromiseAllContextInlines.h */; };
17271728
AD00659E1ECAC812000CA926 /* WasmLimits.h in Headers */ = {isa = PBXBuildFile; fileRef = AD00659D1ECAC7FE000CA926 /* WasmLimits.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2236,7 +2237,7 @@
22362237
FEC503FE2B51E09700176A93 /* LineColumn.h in Headers */ = {isa = PBXBuildFile; fileRef = FEC503FD2B51E09700176A93 /* LineColumn.h */; settings = {ATTRIBUTES = (Private, ); }; };
22372238
FEC5797323105B5100BCA83F /* VMInspectorInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FEC5797223105B4800BCA83F /* VMInspectorInlines.h */; };
22382239
FEC5797623105F4E00BCA83F /* Integrity.h in Headers */ = {isa = PBXBuildFile; fileRef = FEC5797523105F4300BCA83F /* Integrity.h */; settings = {ATTRIBUTES = (Private, ); }; };
2239-
FEC579782310954C00BCA83F /* IntegrityInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FEC579772310954B00BCA83F /* IntegrityInlines.h */; };
2240+
FEC579782310954C00BCA83F /* IntegrityInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FEC579772310954B00BCA83F /* IntegrityInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
22402241
FECB8B271D25BB85006F2463 /* FunctionOverridesTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FECB8B251D25BB6E006F2463 /* FunctionOverridesTest.cpp */; };
22412242
FED287B215EC9A5700DA8161 /* LLIntOpcode.h in Headers */ = {isa = PBXBuildFile; fileRef = FED287B115EC9A5700DA8161 /* LLIntOpcode.h */; settings = {ATTRIBUTES = (Private, ); }; };
22422243
FED5FA3429A0859C00798A7F /* WasmBBQJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = FED5FA3229A0859C00798A7F /* WasmBBQJIT.h */; };
@@ -5427,6 +5428,7 @@
54275428
A7FF647A18C52E8500B55307 /* SpillRegistersMode.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = SpillRegistersMode.h; sourceTree = "<group>"; };
54285429
A8E894310CD0602400367179 /* JSCallbackObjectFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackObjectFunctions.h; sourceTree = "<group>"; };
54295430
A8E894330CD0603F00367179 /* JSGlobalObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObject.h; sourceTree = "<group>"; };
5431+
AA45D14E2EB82FEB00FCBD16 /* CachedCallInlines.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = CachedCallInlines.h; sourceTree = "<group>"; };
54305432
AA785BEA2E77BECA0097F688 /* JSPromiseAllContext.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSPromiseAllContext.h; sourceTree = "<group>"; };
54315433
AA785BEC2E77BECF0097F688 /* JSPromiseAllContext.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JSPromiseAllContext.cpp; sourceTree = "<group>"; };
54325434
AA785BED2E77BED70097F688 /* JSPromiseAllContextInlines.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSPromiseAllContextInlines.h; sourceTree = "<group>"; };
@@ -7095,6 +7097,7 @@
70957097
children = (
70967098
AAE814122E667AED00DF3D3A /* CachedCall.cpp */,
70977099
A7F8690E0F9584A100558697 /* CachedCall.h */,
7100+
AA45D14E2EB82FEB00FCBD16 /* CachedCallInlines.h */,
70987101
796DAA2A1E89CCD6005DF24A /* CalleeBits.h */,
70997102
1429D8DB0ED2205B00B89619 /* CallFrame.cpp */,
71007103
1429D8DC0ED2205B00B89619 /* CallFrame.h */,
@@ -10902,6 +10905,7 @@
1090210905
FE8DE54D23AC1E86005C9142 /* CacheableIdentifierInlines.h in Headers */,
1090310906
144CA3502224180100817789 /* CachedBytecode.h in Headers */,
1090410907
072F534E2E3C0B7100389E15 /* CachedCall.h in Headers */,
10908+
AA45D14F2EB82FEB00FCBD16 /* CachedCallInlines.h in Headers */,
1090510909
65B8392E1BACAD360044E824 /* CachedRecovery.h in Headers */,
1090610910
E39EEAF322812450008474F4 /* CachedSpecialPropertyAdaptiveStructureWatchpoint.h in Headers */,
1090710911
14F09C2A2231923100CF88EB /* CachedTypes.h in Headers */,

Source/JavaScriptCore/interpreter/CachedCall.h

Lines changed: 2 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -89,48 +89,9 @@ class CachedCall : public CallLinkInfoBase {
8989

9090
void relink();
9191

92-
template<typename... Args> requires (std::is_convertible_v<Args, JSValue> && ...)
93-
ALWAYS_INLINE JSValue callWithArguments(JSGlobalObject* globalObject, JSValue thisValue, Args... args)
94-
{
95-
VM& vm = m_vm;
96-
auto scope = DECLARE_THROW_SCOPE(vm);
97-
98-
ASSERT_WITH_MESSAGE(!thisValue.isEmpty(), "Expected thisValue to be non-empty. Use jsUndefined() if you meant to use undefined.");
99-
#if ASSERT_ENABLED
100-
if constexpr (sizeof...(args) > 0) {
101-
size_t argIndex = 0;
102-
auto checkArg = [&argIndex](JSValue arg) {
103-
ASSERT_WITH_MESSAGE(!arg.isEmpty(), "arguments[%zu] is JSValue(). Use jsUndefined() if you meant to make it undefined.", argIndex);
104-
++argIndex;
105-
};
106-
(checkArg(args), ...);
107-
}
108-
#endif
109-
110-
#if CPU(ARM64) && CPU(ADDRESS64) && !ENABLE(C_LOOP)
111-
ASSERT(sizeof...(args) == static_cast<size_t>(m_protoCallFrame.argumentCount()));
112-
constexpr unsigned argumentCountIncludingThis = 1 + sizeof...(args);
113-
if constexpr (argumentCountIncludingThis <= 4) {
114-
if (m_numParameters <= argumentCountIncludingThis) [[likely]] {
115-
JSValue result = m_vm.interpreter.tryCallWithArguments(*this, thisValue, args...);
116-
RETURN_IF_EXCEPTION(scope, { });
117-
if (result)
118-
return result;
119-
}
120-
}
121-
#endif
12292

123-
clearArguments();
124-
setThis(thisValue);
125-
(appendArgument(args), ...);
126-
127-
if (hasOverflowedArguments()) [[unlikely]] {
128-
throwOutOfMemoryError(globalObject, scope);
129-
return { };
130-
}
131-
132-
RELEASE_AND_RETURN(scope, call());
133-
}
93+
template<typename... Args> requires (std::is_convertible_v<Args, JSValue> && ...)
94+
JSValue callWithArguments(JSGlobalObject*, JSValue thisValue, Args...);
13495

13596
private:
13697
VM& m_vm;
Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
/*
2+
* Copyright (C) 2009-2023 Apple Inc. All rights reserved.
3+
* Copyright (C) 2025 Codeblog CORP.
4+
*
5+
* Redistribution and use in source and binary forms, with or without
6+
* modification, are permitted provided that the following conditions
7+
* are met:
8+
* 1. Redistributions of source code must retain the above copyright
9+
* notice, this list of conditions and the following disclaimer.
10+
* 2. Redistributions in binary form must reproduce the above copyright
11+
* notice, this list of conditions and the following disclaimer in the
12+
* documentation and/or other materials provided with the distribution.
13+
*
14+
* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
15+
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16+
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
17+
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
18+
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
19+
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
20+
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
21+
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
22+
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23+
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
24+
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25+
*/
26+
27+
#pragma once
28+
29+
#include <JavaScriptCore/CachedCall.h>
30+
31+
#if ASSERT_ENABLED
32+
#include <JavaScriptCore/IntegrityInlines.h>
33+
#endif
34+
35+
namespace JSC {
36+
37+
template<typename... Args> requires (std::is_convertible_v<Args, JSValue> && ...)
38+
ALWAYS_INLINE JSValue CachedCall::callWithArguments(JSGlobalObject* globalObject, JSValue thisValue, Args... args)
39+
{
40+
VM& vm = m_vm;
41+
auto scope = DECLARE_THROW_SCOPE(vm);
42+
43+
ASSERT_WITH_MESSAGE(!thisValue.isEmpty(), "Expected thisValue to be non-empty. Use jsUndefined() if you meant to use undefined.");
44+
#if ASSERT_ENABLED
45+
if constexpr (sizeof...(args) > 0) {
46+
size_t argIndex = 0;
47+
auto checkArg = [&argIndex, &vm](JSValue arg) {
48+
ASSERT_WITH_MESSAGE(!arg.isEmpty(), "arguments[%zu] is JSValue(). Use jsUndefined() if you meant to make it undefined.", argIndex);
49+
if (arg.isCell())
50+
Integrity::auditCell(vm, arg.asCell());
51+
++argIndex;
52+
};
53+
(checkArg(args), ...);
54+
}
55+
#endif
56+
57+
#if CPU(ARM64) && CPU(ADDRESS64) && !ENABLE(C_LOOP)
58+
ASSERT(sizeof...(args) == static_cast<size_t>(m_protoCallFrame.argumentCount()));
59+
constexpr unsigned argumentCountIncludingThis = 1 + sizeof...(args);
60+
if constexpr (argumentCountIncludingThis <= 4) {
61+
if (m_numParameters <= argumentCountIncludingThis) [[likely]] {
62+
JSValue result = m_vm.interpreter.tryCallWithArguments(*this, thisValue, args...);
63+
RETURN_IF_EXCEPTION(scope, { });
64+
if (result)
65+
return result;
66+
}
67+
}
68+
#endif
69+
70+
clearArguments();
71+
setThis(thisValue);
72+
(appendArgument(args), ...);
73+
74+
if (hasOverflowedArguments()) [[unlikely]] {
75+
throwOutOfMemoryError(globalObject, scope);
76+
return { };
77+
}
78+
79+
RELEASE_AND_RETURN(scope, call());
80+
}
81+
82+
}

Source/JavaScriptCore/runtime/ArrayPrototype.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
#include "ArrayConstructor.h"
2828
#include "ArrayPrototypeInlines.h"
2929
#include "BuiltinNames.h"
30-
#include "CachedCall.h"
30+
#include "CachedCallInlines.h"
3131
#include "IntegrityInlines.h"
3232
#include "InterpreterInlines.h"
3333
#include "JSArrayInlines.h"

Source/JavaScriptCore/runtime/IteratorOperations.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626

2727
#pragma once
2828

29-
#include <JavaScriptCore/CachedCall.h>
29+
#include <JavaScriptCore/CachedCallInlines.h>
3030
#include <JavaScriptCore/IterationModeMetadata.h>
3131
#include <JavaScriptCore/JSArrayIterator.h>
3232
#include <JavaScriptCore/JSCJSValue.h>

Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@
4949

5050
#pragma once
5151

52-
#include "CachedCall.h"
52+
#include "CachedCallInlines.h"
5353
#include "Error.h"
5454
#include "InterpreterInlines.h"
5555
#include "JSArrayBufferViewInlines.h"

Source/JavaScriptCore/runtime/JSIteratorPrototype.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
#include "JSIteratorPrototype.h"
3030

3131
#include "BuiltinNames.h"
32-
#include "CachedCall.h"
32+
#include "CachedCallInlines.h"
3333
#include "InterpreterInlines.h"
3434
#include "IteratorOperations.h"
3535
#include "JSCBuiltins.h"

Source/JavaScriptCore/runtime/MapPrototype.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
#include "MapPrototype.h"
2828

2929
#include "BuiltinNames.h"
30-
#include "CachedCall.h"
30+
#include "CachedCallInlines.h"
3131
#include "GetterSetter.h"
3232
#include "InterpreterInlines.h"
3333
#include "JSCInlines.h"

Source/JavaScriptCore/runtime/RegExpPrototype.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
#include "config.h"
2222
#include "RegExpPrototype.h"
2323

24-
#include "CachedCall.h"
24+
#include "CachedCallInlines.h"
2525
#include "InterpreterInlines.h"
2626
#include "IntegrityInlines.h"
2727
#include "JSArray.h"

0 commit comments

Comments
 (0)