1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
|
/*
* Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#pragma once
#include "PropertyStorage.h"
WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
namespace JSC {
class ArrayBuffer;
class Butterfly;
class LLIntOffsetsExtractor;
class Structure;
struct ArrayStorage;
class IndexingHeader {
public:
// Define the maximum storage vector length to be 2^32 / sizeof(JSValue) / 2 to ensure that
// there is no risk of overflow.
static constexpr unsigned maximumLength = 0x10000000;
static constexpr ptrdiff_t offsetOfIndexingHeader() { return -static_cast<ptrdiff_t>(sizeof(IndexingHeader)); }
static constexpr ptrdiff_t offsetOfArrayBuffer() { return OBJECT_OFFSETOF(IndexingHeader, u.typedArray.buffer); }
static constexpr ptrdiff_t offsetOfPublicLength() { return OBJECT_OFFSETOF(IndexingHeader, u.lengths.publicLength); }
static constexpr ptrdiff_t offsetOfVectorLength() { return OBJECT_OFFSETOF(IndexingHeader, u.lengths.vectorLength); }
IndexingHeader()
{
u.lengths.publicLength = 0;
u.lengths.vectorLength = 0;
}
uint32_t vectorLength() const { return u.lengths.vectorLength; }
void setVectorLength(uint32_t length)
{
RELEASE_ASSERT(length <= maximumLength);
u.lengths.vectorLength = length;
}
uint32_t publicLength() const { return u.lengths.publicLength; }
void setPublicLength(uint32_t auxWord) { u.lengths.publicLength = auxWord; }
ArrayBuffer* arrayBuffer() { return u.typedArray.buffer; }
void setArrayBuffer(ArrayBuffer* buffer) { u.typedArray.buffer = buffer; }
static IndexingHeader* from(Butterfly* butterfly)
{
return reinterpret_cast<IndexingHeader*>(butterfly) - 1;
}
static const IndexingHeader* from(const Butterfly* butterfly)
{
return reinterpret_cast<const IndexingHeader*>(butterfly) - 1;
}
static IndexingHeader* from(ArrayStorage* arrayStorage)
{
return const_cast<IndexingHeader*>(from(const_cast<const ArrayStorage*>(arrayStorage)));
}
static const IndexingHeader* from(const ArrayStorage* arrayStorage)
{
return reinterpret_cast<const IndexingHeader*>(arrayStorage) - 1;
}
static IndexingHeader* fromEndOf(PropertyStorage propertyStorage)
{
return reinterpret_cast<IndexingHeader*>(propertyStorage);
}
PropertyStorage propertyStorage()
{
return reinterpret_cast_ptr<PropertyStorage>(this);
}
ConstPropertyStorage propertyStorage() const
{
return reinterpret_cast_ptr<ConstPropertyStorage>(this);
}
ArrayStorage* arrayStorage()
{
return reinterpret_cast<ArrayStorage*>(this + 1);
}
Butterfly* butterfly()
{
return reinterpret_cast<Butterfly*>(this + 1);
}
// These methods are not standalone in the sense that they cannot be
// used on a copy of the IndexingHeader.
size_t preCapacity(Structure*);
size_t indexingPayloadSizeInBytes(Structure*);
private:
friend class LLIntOffsetsExtractor;
union {
struct {
// FIXME: vectorLength should be least significant, so that it's really hard to craft a pointer by
// mucking with the butterfly.
// https://bugs.webkit.org/show_bug.cgi?id=174927
uint32_t publicLength; // The meaning of this field depends on the array type, but for all JSArrays we rely on this being the publicly visible length (array.length).
uint32_t vectorLength; // The length of the indexed property storage. The actual size of the storage depends on this, and the type.
} lengths;
struct {
ArrayBuffer* buffer;
} typedArray;
} u;
};
} // namespace JSC
WTF_ALLOW_UNSAFE_BUFFER_USAGE_END
|
