OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2010 Google Inc. All rights reserved. | 2 * Copyright (C) 2010 Google Inc. All rights reserved. |
3 * | 3 * |
4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
6 * met: | 6 * met: |
7 * | 7 * |
8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
(...skipping 13 matching lines...) Expand all Loading... |
24 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | 24 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
28 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 28 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
29 */ | 29 */ |
30 | 30 |
31 #ifndef ScriptWrappable_h | 31 #ifndef ScriptWrappable_h |
32 #define ScriptWrappable_h | 32 #define ScriptWrappable_h |
33 | 33 |
| 34 #include "bindings/v8/UnsafePersistent.h" |
34 #include "bindings/v8/V8Utilities.h" | 35 #include "bindings/v8/V8Utilities.h" |
35 #include "bindings/v8/WrapperTypeInfo.h" | 36 #include "bindings/v8/WrapperTypeInfo.h" |
36 #include "core/dom/WebCoreMemoryInstrumentation.h" | 37 #include "core/dom/WebCoreMemoryInstrumentation.h" |
37 #include <v8.h> | 38 #include <v8.h> |
38 | 39 |
39 namespace WebCore { | 40 namespace WebCore { |
40 | 41 |
41 class ScriptWrappable : public MemoryReporterTag { | 42 class ScriptWrappable : public MemoryReporterTag { |
42 friend class WeakHandleListener<ScriptWrappable>; | 43 friend class WeakHandleListener<ScriptWrappable>; |
43 public: | 44 public: |
(...skipping 101 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
145 } | 146 } |
146 | 147 |
147 protected: | 148 protected: |
148 ~ScriptWrappable() | 149 ~ScriptWrappable() |
149 { | 150 { |
150 ASSERT(m_maskedStorage); // Assert initialization via init() even if no
t subsequently wrapped. | 151 ASSERT(m_maskedStorage); // Assert initialization via init() even if no
t subsequently wrapped. |
151 m_maskedStorage = 0; // Break UAF attempts to wrap. | 152 m_maskedStorage = 0; // Break UAF attempts to wrap. |
152 } | 153 } |
153 | 154 |
154 private: | 155 private: |
| 156 friend class MinorGCWrapperVisitor; // For calling unsafePersistent. |
| 157 |
| 158 UnsafePersistent<v8::Object> unsafePersistent() const |
| 159 { |
| 160 ASSERT(containsWrapper()); |
| 161 return UnsafePersistent<v8::Object>(reinterpret_cast<v8::Object*>(maskOr
UnmaskValue(m_maskedStorage))); |
| 162 } |
| 163 |
155 inline bool containsWrapper() const { return (m_maskedStorage & 1) == 1; } | 164 inline bool containsWrapper() const { return (m_maskedStorage & 1) == 1; } |
156 inline bool containsTypeInfo() const { return m_maskedStorage && ((m_maskedS
torage & 1) == 0); } | 165 inline bool containsTypeInfo() const { return m_maskedStorage && ((m_maskedS
torage & 1) == 0); } |
157 | 166 |
158 static inline uintptr_t maskOrUnmaskValue(uintptr_t value) | 167 static inline uintptr_t maskOrUnmaskValue(uintptr_t value) |
159 { | 168 { |
160 // Entropy via ASLR, bottom bit set to always toggle the bottom bit in t
he result. Since masking is only | 169 // Entropy via ASLR, bottom bit set to always toggle the bottom bit in t
he result. Since masking is only |
161 // applied to wrappers, not wrapper type infos, and these are aligned po
itners with zeros in the bottom | 170 // applied to wrappers, not wrapper type infos, and these are aligned po
itners with zeros in the bottom |
162 // bit(s), this automatically set the wrapper flag in the bottom bit upo
n encoding. Simiarlry,this | 171 // bit(s), this automatically set the wrapper flag in the bottom bit upo
n encoding. Simiarlry,this |
163 // automatically zeros out the bit upon decoding. Additionally, since se
tWrapper() now performs an explicit | 172 // automatically zeros out the bit upon decoding. Additionally, since se
tWrapper() now performs an explicit |
164 // null test, and wrapper() requires the bottom bit to be set, there is
no need to preserve null here. | 173 // null test, and wrapper() requires the bottom bit to be set, there is
no need to preserve null here. |
(...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
197 key->disposeWrapper(value, isolate, info); | 206 key->disposeWrapper(value, isolate, info); |
198 // FIXME: I noticed that 50%~ of minor GC cycle times can be consumed | 207 // FIXME: I noticed that 50%~ of minor GC cycle times can be consumed |
199 // inside key->deref(), which causes Node destructions. We should | 208 // inside key->deref(), which causes Node destructions. We should |
200 // make Node destructions incremental. | 209 // make Node destructions incremental. |
201 info->derefObject(object); | 210 info->derefObject(object); |
202 } | 211 } |
203 | 212 |
204 } // namespace WebCore | 213 } // namespace WebCore |
205 | 214 |
206 #endif // ScriptWrappable_h | 215 #endif // ScriptWrappable_h |
OLD | NEW |