Skip to content

Commit 82f6bfa

Browse files
ConstellationConstellation
committed
Fix std::make_unique / new[] using system malloc
https://bugs.webkit.org/show_bug.cgi?id=182975 Reviewed by JF Bastien. Source/JavaScriptCore: Use Vector, FAST_ALLOCATED, or UniqueArray instead. * API/JSStringRefCF.cpp: (JSStringCreateWithCFString): * bytecode/BytecodeKills.h: * bytecode/BytecodeLivenessAnalysis.cpp: (JSC::BytecodeLivenessAnalysis::computeKills): * dfg/DFGDisassembler.cpp: (JSC::DFG::Disassembler::dumpDisassembly): * jit/PolymorphicCallStubRoutine.cpp: (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine): * jit/PolymorphicCallStubRoutine.h: * jit/Repatch.cpp: (JSC::linkPolymorphicCall): * jsc.cpp: (currentWorkingDirectory): * llint/LLIntData.cpp: (JSC::LLInt::initialize): * llint/LLIntData.h: * runtime/ArgList.h: * runtime/StructureChain.h: * runtime/StructureIDTable.cpp: (JSC::StructureIDTable::StructureIDTable): (JSC::StructureIDTable::resize): * runtime/StructureIDTable.h: * runtime/TypeProfilerLog.cpp: (JSC::TypeProfilerLog::TypeProfilerLog): (JSC::TypeProfilerLog::initializeLog): Deleted. * runtime/TypeProfilerLog.h: (JSC::TypeProfilerLog::TypeProfilerLog): Deleted. * runtime/VM.cpp: (JSC::VM::~VM): (JSC::VM::acquireRegExpPatternContexBuffer): * runtime/VM.h: * testRegExp.cpp: (runFromFiles): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::HeapVerifier): * tools/HeapVerifier.h: Source/WebCore: Use Vector, FAST_ALLOCATED, or UniqueArray instead. * Modules/webaudio/AudioBufferSourceNode.cpp: (WebCore::AudioBufferSourceNode::setBuffer): * Modules/webaudio/AudioBufferSourceNode.h: * css/StyleRule.h: * cssjit/CompiledSelector.h: * html/HTMLFrameSetElement.h: * html/canvas/WebGLRenderingContextBase.cpp: (WebCore::WebGLRenderingContextBase::copyTexSubImage2D): (WebCore::WebGLRenderingContextBase::simulateVertexAttrib0): (WebCore::WebGLRenderingContextBase::LRUImageBufferCache::LRUImageBufferCache): (WebCore::WebGLRenderingContextBase::LRUImageBufferCache::imageBuffer): (WebCore::WebGLRenderingContextBase::LRUImageBufferCache::bubbleToFront): * html/canvas/WebGLRenderingContextBase.h: * platform/Length.cpp: (WebCore::newCoordsArray): (WebCore::newLengthArray): (): Deleted. * platform/Length.h: * platform/audio/DynamicsCompressor.cpp: (WebCore::DynamicsCompressor::setNumberOfChannels): * platform/audio/DynamicsCompressor.h: * platform/audio/FFTFrame.h: * platform/audio/gstreamer/FFTFrameGStreamer.cpp: (WebCore::FFTFrame::FFTFrame): * platform/graphics/FormatConverter.h: (WebCore::FormatConverter::FormatConverter): * platform/graphics/GraphicsContext3D.cpp: (WebCore::GraphicsContext3D::texImage2DResourceSafe): * platform/graphics/GraphicsContext3D.h: * platform/graphics/ca/win/CACFLayerTreeHost.cpp: (WebCore::getDirtyRects): * platform/graphics/cairo/CairoUtilities.cpp: (WebCore::flipImageSurfaceVertically): * platform/graphics/cg/GraphicsContext3DCG.cpp: (WebCore::GraphicsContext3D::ImageExtractor::extractImage): * platform/graphics/gpu/Texture.cpp: (WebCore::Texture::updateSubRect): * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp: (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas): (WebCore::GraphicsContext3D::compileShader): (WebCore::GraphicsContext3D::getActiveAttribImpl): (WebCore::GraphicsContext3D::getActiveUniformImpl): (WebCore::GraphicsContext3D::getProgramInfoLog): (WebCore::GraphicsContext3D::getShaderInfoLog): * platform/graphics/texmap/TextureMapperShaderProgram.cpp: (WebCore::getShaderLog): (WebCore::getProgramLog): * platform/graphics/win/ImageBufferDataDirect2D.cpp: (WebCore::ImageBufferData::putData): * platform/image-decoders/png/PNGImageDecoder.cpp: (WebCore::PNGImageReader::PNGImageReader): (WebCore::PNGImageReader::close): (WebCore::PNGImageReader::interlaceBuffer const): (WebCore::PNGImageReader::createInterlaceBuffer): * platform/image-decoders/webp/WEBPImageDecoder.cpp: (WebCore::WEBPImageDecoder::decodeFrame): * platform/network/curl/SocketStreamHandleImpl.h: (WebCore::SocketStreamHandleImpl::SocketData::SocketData): * platform/network/curl/SocketStreamHandleImplCurl.cpp: (WebCore::createCopy): (WebCore::SocketStreamHandleImpl::readData): (): Deleted. * platform/network/soup/SocketStreamHandleImpl.h: * platform/network/soup/SocketStreamHandleImplSoup.cpp: (WebCore::SocketStreamHandleImpl::connected): * platform/win/LoggingWin.cpp: (WebCore::logLevelString): Source/WebCore/PAL: Use Vector instead. * pal/win/LoggingWin.cpp: (PAL::logLevelString): Source/WebKit: Use Vector instead. * NetworkProcess/win/SystemProxyWin.cpp: (WindowsSystemProxy::getSystemHttpProxy): * Platform/IPC/unix/ConnectionUnix.cpp: (IPC::Connection::processMessage): (IPC::Connection::sendOutputMessage): * Platform/win/LoggingWin.cpp: (WebKit::logLevelString): * Shared/SandboxExtension.h: * Shared/mac/SandboxExtensionMac.mm: (WebKit::SandboxExtension::HandleArray::allocate): (WebKit::SandboxExtension::HandleArray::operator[]): (WebKit::SandboxExtension::HandleArray::operator[] const): (WebKit::SandboxExtension::HandleArray::size const): (WebKit::SandboxExtension::HandleArray::encode const): Source/WebKitLegacy/win: Use Vector instead. * MarshallingHelpers.cpp: (MarshallingHelpers::safeArrayToStringArray): (MarshallingHelpers::safeArrayToIntArray): * Plugins/PluginPackageWin.cpp: (WebCore::PluginPackage::fetchInfo): * WebPreferences.cpp: (WebPreferences::copyWebKitPreferencesToCFPreferences): * WebView.cpp: (WebView::onMenuCommand): Source/WTF: If we use `make_unique<char[]>(num)` or `new char[num]`, allocation is done by the system malloc instead of bmalloc. This patch fixes this issue by following three changes. 1. Introduce UniqueArray<T>. It allocates memory from FastMalloc. While C++ array with `new` need to hold the size to call destructor correctly, our UniqueArray only supports type T which does not have a non trivial destructor. It reduces the allocation size since we do not need to track the size of the array compared to standard `new T[]`. This is basically usable if we want to have raw array which pointer won't be changed even if the container is moved. In addition, we also extend UniqueArray<T> for types which have non trivial destructors. 2. Use Vector<T> instead. 3. Annotate allocated types with MAKE_FAST_ALLOCATED. Since it introduces new[] and delete[] operators, make_unique<T[]>(num) will allocate memory from FastMalloc. * WTF.xcodeproj/project.pbxproj: * wtf/Assertions.cpp: * wtf/CMakeLists.txt: * wtf/FastMalloc.h: (WTF::FastFree::operator() const): (WTF::FastFree<T::operator() const): * wtf/MallocPtr.h: (WTF::MallocPtr::operator bool const): * wtf/StackShot.h: (WTF::StackShot::StackShot): (WTF::StackShot::operator=): * wtf/SystemFree.h: (WTF::SystemFree<T::operator() const): * wtf/UniqueArray.h: Copied from Source/WebKit/Platform/win/LoggingWin.cpp. (WTF::makeUniqueArray): * wtf/Vector.h: (WTF::VectorTypeOperations::forceInitialize): Tools: * TestWebKitAPI/CMakeLists.txt: * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: * TestWebKitAPI/Tests/WTF/UniqueArray.cpp: Copied from Source/WebKit/Platform/win/LoggingWin.cpp. (TestWebKitAPI::NonTrivialDestructor::NonTrivialDestructor): (TestWebKitAPI::NonTrivialDestructor::~NonTrivialDestructor): (TestWebKitAPI::NonTrivialDestructor::setLog): (TestWebKitAPI::TEST): Canonical link: https://commits.webkit.org/199024@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229309 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 13a4c27 commit 82f6bfa

80 files changed

Lines changed: 697 additions & 214 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Source/JavaScriptCore/API/JSStringRefCF.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,10 @@ JSStringRef JSStringCreateWithCFString(CFStringRef string)
4949
if (static_cast<size_t>(convertedSize) == length && static_cast<size_t>(usedBufferLength) == length)
5050
return &OpaqueJSString::create(lcharBuffer.data(), length).leakRef();
5151

52-
auto buffer = std::make_unique<UniChar[]>(length);
53-
CFStringGetCharacters(string, CFRangeMake(0, length), buffer.get());
52+
Vector<UniChar> buffer(length);
53+
CFStringGetCharacters(string, CFRangeMake(0, length), buffer.data());
5454
static_assert(sizeof(UniChar) == sizeof(UChar), "UniChar and UChar must be same size");
55-
return &OpaqueJSString::create(reinterpret_cast<UChar*>(buffer.get()), length).leakRef();
55+
return &OpaqueJSString::create(reinterpret_cast<UChar*>(buffer.data()), length).leakRef();
5656
}
5757

5858
CFStringRef JSStringCopyCFString(CFAllocatorRef allocator, JSStringRef string)

‎Source/JavaScriptCore/ChangeLog‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,50 @@
1+
2018-03-05 Yusuke Suzuki <utatane.tea@gmail.com>
2+
3+
Fix std::make_unique / new[] using system malloc
4+
https://bugs.webkit.org/show_bug.cgi?id=182975
5+
6+
Reviewed by JF Bastien.
7+
8+
Use Vector, FAST_ALLOCATED, or UniqueArray instead.
9+
10+
* API/JSStringRefCF.cpp:
11+
(JSStringCreateWithCFString):
12+
* bytecode/BytecodeKills.h:
13+
* bytecode/BytecodeLivenessAnalysis.cpp:
14+
(JSC::BytecodeLivenessAnalysis::computeKills):
15+
* dfg/DFGDisassembler.cpp:
16+
(JSC::DFG::Disassembler::dumpDisassembly):
17+
* jit/PolymorphicCallStubRoutine.cpp:
18+
(JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
19+
* jit/PolymorphicCallStubRoutine.h:
20+
* jit/Repatch.cpp:
21+
(JSC::linkPolymorphicCall):
22+
* jsc.cpp:
23+
(currentWorkingDirectory):
24+
* llint/LLIntData.cpp:
25+
(JSC::LLInt::initialize):
26+
* llint/LLIntData.h:
27+
* runtime/ArgList.h:
28+
* runtime/StructureChain.h:
29+
* runtime/StructureIDTable.cpp:
30+
(JSC::StructureIDTable::StructureIDTable):
31+
(JSC::StructureIDTable::resize):
32+
* runtime/StructureIDTable.h:
33+
* runtime/TypeProfilerLog.cpp:
34+
(JSC::TypeProfilerLog::TypeProfilerLog):
35+
(JSC::TypeProfilerLog::initializeLog): Deleted.
36+
* runtime/TypeProfilerLog.h:
37+
(JSC::TypeProfilerLog::TypeProfilerLog): Deleted.
38+
* runtime/VM.cpp:
39+
(JSC::VM::~VM):
40+
(JSC::VM::acquireRegExpPatternContexBuffer):
41+
* runtime/VM.h:
42+
* testRegExp.cpp:
43+
(runFromFiles):
44+
* tools/HeapVerifier.cpp:
45+
(JSC::HeapVerifier::HeapVerifier):
46+
* tools/HeapVerifier.h:
47+
148
2018-03-05 Mark Lam <mark.lam@apple.com>
249

350
JITThunk functions should only be called when the JIT is enabled.

‎Source/JavaScriptCore/bytecode/BytecodeKills.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
#pragma once
2727

2828
#include "CodeBlock.h"
29+
#include <wtf/UniqueArray.h>
2930

3031
namespace JSC {
3132

@@ -74,6 +75,7 @@ class BytecodeKills {
7475
friend class BytecodeLivenessAnalysis;
7576

7677
class KillSet {
78+
WTF_MAKE_FAST_ALLOCATED;
7779
public:
7880
KillSet()
7981
: m_word(0)
@@ -170,7 +172,7 @@ class BytecodeKills {
170172
};
171173

172174
CodeBlock* m_codeBlock;
173-
std::unique_ptr<KillSet[]> m_killSets;
175+
UniqueArray<KillSet> m_killSets;
174176
};
175177

176178
} // namespace JSC

‎Source/JavaScriptCore/bytecode/BytecodeLivenessAnalysis.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ void BytecodeLivenessAnalysis::computeKills(CodeBlock* codeBlock, BytecodeKills&
8989
FastBitVector out;
9090

9191
result.m_codeBlock = codeBlock;
92-
result.m_killSets = std::make_unique<BytecodeKills::KillSet[]>(codeBlock->instructions().size());
92+
result.m_killSets = makeUniqueArray<BytecodeKills::KillSet>(codeBlock->instructions().size());
9393

9494
for (std::unique_ptr<BytecodeBasicBlock>& block : m_graph.basicBlocksInReverseOrder()) {
9595
if (block->isEntryBlock() || block->isExitBlock())

‎Source/JavaScriptCore/dfg/DFGDisassembler.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -159,8 +159,8 @@ void Disassembler::dumpDisassembly(PrintStream& out, const char* prefix, LinkBuf
159159
amountOfNodeWhiteSpace = 0;
160160
else
161161
amountOfNodeWhiteSpace = Graph::amountOfNodeWhiteSpace(context);
162-
auto prefixBuffer = std::make_unique<char[]>(prefixLength + amountOfNodeWhiteSpace + 1);
163-
memcpy(prefixBuffer.get(), prefix, prefixLength);
162+
Vector<char> prefixBuffer(prefixLength + amountOfNodeWhiteSpace + 1);
163+
memcpy(prefixBuffer.data(), prefix, prefixLength);
164164
for (int i = 0; i < amountOfNodeWhiteSpace; ++i)
165165
prefixBuffer[i + prefixLength] = ' ';
166166
prefixBuffer[prefixLength + amountOfNodeWhiteSpace] = 0;
@@ -169,7 +169,7 @@ void Disassembler::dumpDisassembly(PrintStream& out, const char* prefix, LinkBuf
169169
CodeLocationLabel end = linkBuffer.locationOf(currentLabel);
170170
previousLabel = currentLabel;
171171
ASSERT(end.executableAddress<uintptr_t>() >= start.executableAddress<uintptr_t>());
172-
disassemble(start, end.executableAddress<uintptr_t>() - start.executableAddress<uintptr_t>(), prefixBuffer.get(), out);
172+
disassemble(start, end.executableAddress<uintptr_t>() - start.executableAddress<uintptr_t>(), prefixBuffer.data(), out);
173173
}
174174

175175
} } // namespace JSC::DFG

‎Source/JavaScriptCore/jit/PolymorphicCallStubRoutine.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ void PolymorphicCallCase::dump(PrintStream& out) const
7171
PolymorphicCallStubRoutine::PolymorphicCallStubRoutine(
7272
const MacroAssemblerCodeRef& codeRef, VM& vm, const JSCell* owner, ExecState* callerFrame,
7373
CallLinkInfo& info, const Vector<PolymorphicCallCase>& cases,
74-
std::unique_ptr<uint32_t[]> fastCounts)
74+
UniqueArray<uint32_t>&& fastCounts)
7575
: GCAwareJITStubRoutine(codeRef, vm)
7676
, m_fastCounts(WTFMove(fastCounts))
7777
{

‎Source/JavaScriptCore/jit/PolymorphicCallStubRoutine.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
#include "CallVariant.h"
3232
#include "GCAwareJITStubRoutine.h"
3333
#include <wtf/Noncopyable.h>
34+
#include <wtf/UniqueArray.h>
3435
#include <wtf/Vector.h>
3536

3637
namespace JSC {
@@ -84,7 +85,7 @@ class PolymorphicCallStubRoutine : public GCAwareJITStubRoutine {
8485
PolymorphicCallStubRoutine(
8586
const MacroAssemblerCodeRef&, VM&, const JSCell* owner,
8687
ExecState* callerFrame, CallLinkInfo&, const Vector<PolymorphicCallCase>&,
87-
std::unique_ptr<uint32_t[]> fastCounts);
88+
UniqueArray<uint32_t>&& fastCounts);
8889

8990
virtual ~PolymorphicCallStubRoutine();
9091

@@ -100,7 +101,7 @@ class PolymorphicCallStubRoutine : public GCAwareJITStubRoutine {
100101

101102
private:
102103
Vector<WriteBarrier<JSCell>, 2> m_variants;
103-
std::unique_ptr<uint32_t[]> m_fastCounts;
104+
UniqueArray<uint32_t> m_fastCounts;
104105
Bag<PolymorphicCallNode> m_callNodes;
105106
};
106107

‎Source/JavaScriptCore/jit/Repatch.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -944,10 +944,10 @@ void linkPolymorphicCall(
944944

945945
Vector<int64_t> caseValues(callCases.size());
946946
Vector<CallToCodePtr> calls(callCases.size());
947-
std::unique_ptr<uint32_t[]> fastCounts;
947+
UniqueArray<uint32_t> fastCounts;
948948

949949
if (!isWebAssembly && callerCodeBlock->jitType() != JITCode::topTierJIT())
950-
fastCounts = std::make_unique<uint32_t[]>(callCases.size());
950+
fastCounts = makeUniqueArray<uint32_t>(callCases.size());
951951

952952
for (size_t i = 0; i < callCases.size(); ++i) {
953953
if (fastCounts)

‎Source/JavaScriptCore/jsc.cpp‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -718,17 +718,17 @@ static std::optional<DirectoryName> currentWorkingDirectory()
718718
// In Windows, wchar_t is the UTF-16LE.
719719
// https://msdn.microsoft.com/en-us/library/dd374081.aspx
720720
// https://msdn.microsoft.com/en-us/library/windows/desktop/ff381407.aspx
721-
auto buffer = std::make_unique<wchar_t[]>(bufferLength);
722-
DWORD lengthNotIncludingNull = ::GetCurrentDirectoryW(bufferLength, buffer.get());
723-
String directoryString = wcharToString(buffer.get(), lengthNotIncludingNull);
721+
Vector<wchar_t> buffer(bufferLength);
722+
DWORD lengthNotIncludingNull = ::GetCurrentDirectoryW(bufferLength, buffer.data());
723+
String directoryString = wcharToString(buffer.data(), lengthNotIncludingNull);
724724
// We don't support network path like \\host\share\<path name>.
725725
if (directoryString.startsWith("\\\\"))
726726
return std::nullopt;
727727
#else
728-
auto buffer = std::make_unique<char[]>(PATH_MAX);
729-
if (!getcwd(buffer.get(), PATH_MAX))
728+
Vector<char> buffer(PATH_MAX);
729+
if (!getcwd(buffer.data(), PATH_MAX))
730730
return std::nullopt;
731-
String directoryString = String::fromUTF8(buffer.get());
731+
String directoryString = String::fromUTF8(buffer.data());
732732
#endif
733733
if (directoryString.isEmpty())
734734
return std::nullopt;

‎Source/JavaScriptCore/llint/LLIntData.cpp‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747

4848
namespace JSC { namespace LLInt {
4949

50-
Instruction* Data::s_exceptionInstructions = 0;
50+
Instruction Data::s_exceptionInstructions[maxOpcodeLength + 1] = { };
5151
Opcode Data::s_opcodeMap[numOpcodeIDs] = { };
5252
OpcodeStatsArray* Data::s_opcodeStatsArray = nullptr;
5353

@@ -57,8 +57,6 @@ extern "C" void llint_entry(void*);
5757

5858
void initialize()
5959
{
60-
Data::s_exceptionInstructions = new Instruction[maxOpcodeLength + 1];
61-
6260
#if !ENABLE(JIT)
6361
CLoop::initialize();
6462

0 commit comments

Comments
 (0)