tree 422b9c742fb5ad7558c2a8aeec5fa8a1425780ef
parent bdf8779031c7c49a804e94641ffb5f66d2b59362
author mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1586075683 +0000
committer mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1586075683 +0000

Add some structureID integrity checks to various runtime functions.
https://bugs.webkit.org/show_bug.cgi?id=210015
<rdar://problem/58116514>

Reviewed by Keith Miller.

Specifically, implementations of toString(), toValue(), and a few others.
I also moved the HeapCell version of ensureStillAliveHere() into the new
EnsureStillAliveHere.h/cpp since it's useful for any pointers, not just HeapCells.

This change is performance neutral on JetStream 2.0, Speedometer-2, and PLT5.

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* heap/HeapCell.cpp:
(JSC::ensureStillAliveHere): Deleted.
* heap/HeapCell.h:
(JSC::ensureStillAliveHere): Deleted.
* heap/SlotVisitor.cpp:
(JSC::SlotVisitor::appendJSCellOrAuxiliary):
* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncToString):
* runtime/BigIntPrototype.cpp:
(JSC::bigIntProtoFuncToStringImpl):
(JSC::bigIntProtoFuncValueOf):
* runtime/BooleanPrototype.cpp:
(JSC::booleanProtoFuncToString):
(JSC::booleanProtoFuncValueOf):
* runtime/DatePrototype.cpp:
(JSC::formatLocaleDate):
(JSC::formateDateInstance):
(JSC::dateProtoFuncToISOString):
(JSC::dateProtoFuncToPrimitiveSymbol):
* runtime/EnsureStillAliveHere.cpp: Added.
(JSC::ensureStillAliveHere):
* runtime/EnsureStillAliveHere.h: Added.
(JSC::ensureStillAliveHere):
* runtime/ErrorInstance.cpp:
(JSC::ErrorInstance::sanitizedToString):
* runtime/ErrorPrototype.cpp:
(JSC::errorProtoFuncToString):
* runtime/FunctionPrototype.cpp:
(JSC::functionProtoFuncToString):
* runtime/JSCell.cpp:
(JSC::JSCell::toObjectSlow const):
* runtime/NumberPrototype.cpp:
(JSC::toThisNumber):
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncValueOf):
(JSC::objectProtoFuncToString):
* runtime/RegExpPrototype.cpp:
(JSC::regExpProtoFuncToString):
* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncToString):
* runtime/StructureIDTable.h:
(JSC::StructureIDTable::validate):
(JSC::StructureIDTable::isValid): Deleted.
* runtime/SymbolPrototype.cpp:
(JSC::symbolProtoGetterDescription):
(JSC::symbolProtoFuncToString):
(JSC::symbolProtoFuncValueOf):
* tools/Integrity.h:
* tools/IntegrityInlines.h:
(JSC::Integrity::auditStructureID):
* wasm/js/WebAssemblyGlobalPrototype.cpp:
(JSC::getGlobal):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@259547 268f45cc-cd09-0410-ab3c-d52691b4dbfc