[Webkit-unassigned] [Bug 280354] New: [JSC] AssemblerBuffer should poison its inline buffer when JIT_SCAN_ASSEMBLER_BUFFER_FOR_ZEROES is enabled

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=280354

            Bug ID: 280354
           Summary: [JSC] AssemblerBuffer should poison its inline buffer
                    when JIT_SCAN_ASSEMBLER_BUFFER_FOR_ZEROES is enabled
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: marcus_plutowski at apple.com

rdar://127124028

The JIT_SCAN_ASSEMBLER_BUFFER_FOR_ZEROES option is meant to detect 0-corruptions in the LinkBuffer/AssemblerBuffer structures used by JSC. However it strictly doesn't know whether the 0s were actually written there, or whether they're just leftover from initialization (having never been overwritten). Poisoning the buffers as we construct them will let us distinguish the latter case from the former.
Ideally we'd like to poison all assembler buffers, but doing so on the larger buffers seems to be too slow so we're just going to start with the inline-buffer, as that's the one most vulnerable to corruption (being on the stack, whereas the out-of-line buffer is on the heap).

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240925/36177679/attachment.htm>