[webkit-changes] [WebKit/WebKit] 0b2785: REGRESSION(macOS Ventura): OpenAudible, Eclipse an...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 0b2785823edb7d59c4120003351de6e04446d1df
      https://github.com/WebKit/WebKit/commit/0b2785823edb7d59c4120003351de6e04446d1df
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2022-12-15 (Thu, 15 Dec 2022)

  Changed paths:
    M Source/JavaScriptCore/tools/Integrity.h
    M Source/bmalloc/libpas/src/libpas/pas_root.c

  Log Message:
  -----------
  REGRESSION(macOS Ventura): OpenAudible, Eclipse and other Java applications crash when using WebKit
https://bugs.webkit.org/show_bug.cgi?id=247387
rdar://101892715

Reviewed by Mark Lam.

x64 binary can change unmapped memory region, breaking JSC's assumption on mmap-returned memory address.
By modifying PAGEZERO address, x64 application can change the start of mmap-returned memory address.
By default, it is 4GB, but it can be anything larger than 4KB (On the other hand, ARM64 enforces it
to 4GB at minimum). This patch updates the number for filtering.

* Source/JavaScriptCore/tools/Integrity.h:
(JSC::Integrity::isSanePointer):
* Source/bmalloc/libpas/src/libpas/pas_root.c:
(pas_root_visit_conservative_candidate_pointers_in_address_range):

Canonical link: https://commits.webkit.org/257973@main