From e62a3f038d35180502f4a33b979fabb8b4668d07 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Samuel=20Gro=C3=9F?= Date: Wed, 26 Jan 2022 11:07:45 +0100 Subject: [PATCH] [sandbox] Remove SandboxedExternalPointer turbofan type MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This type is no longer required: all ExternalPointers are now sandboxified in turbofan, so we use that type instead. Bug: v8:10391 Change-Id: Ia2bd261bfe3cfd5c7d9c350ba0e553e57a596a42 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3359632 Reviewed-by: Igor Sheludko Reviewed-by: Jakob Gruber Commit-Queue: Samuel Groß Cr-Commit-Position: refs/heads/main@{#78802} --- src/compiler/access-builder.cc | 3 +-- src/compiler/memory-lowering.cc | 18 +++++++----------- src/compiler/simplified-lowering.cc | 1 - src/compiler/types.h | 6 +----- src/objects/turbofan-types.tq | 1 - 5 files changed, 9 insertions(+), 20 deletions(-) diff --git a/src/compiler/access-builder.cc b/src/compiler/access-builder.cc index 3acac769b2..2c437d3535 100644 --- a/src/compiler/access-builder.cc +++ b/src/compiler/access-builder.cc @@ -756,8 +756,7 @@ FieldAccess AccessBuilder::ForExternalStringResourceData() { ExternalString::kResourceDataOffset, Handle(), MaybeHandle(), - V8_SANDBOXED_EXTERNAL_POINTERS_BOOL ? Type::SandboxedExternalPointer() - : Type::ExternalPointer(), + Type::ExternalPointer(), MachineType::Pointer(), kNoWriteBarrier, ConstFieldInfo::None(), diff --git a/src/compiler/memory-lowering.cc b/src/compiler/memory-lowering.cc index 83d91ff041..99e4515c5a 100644 --- a/src/compiler/memory-lowering.cc +++ b/src/compiler/memory-lowering.cc @@ -472,30 +472,27 @@ Reduction MemoryLowering::ReduceLoadField(Node* node) { node->InsertInput(graph_zone(), 1, offset); MachineType type = access.machine_type; if (V8_SANDBOXED_EXTERNAL_POINTERS_BOOL && - access.type.Is(Type::SandboxedExternalPointer())) { + access.type.Is(Type::ExternalPointer())) { // External pointer table indices are stored as 32-bit numbers type = MachineType::Uint32(); } if (type.IsMapWord()) { - DCHECK(!access.type.Is(Type::SandboxedExternalPointer())); + DCHECK(!access.type.Is(Type::ExternalPointer())); return ReduceLoadMap(node); } NodeProperties::ChangeOp(node, machine()->Load(type)); - if (V8_SANDBOXED_EXTERNAL_POINTERS_BOOL && - access.type.Is(Type::SandboxedExternalPointer())) { #ifdef V8_SANDBOXED_EXTERNAL_POINTERS + if (access.type.Is(Type::ExternalPointer())) { ExternalPointerTag tag = access.external_pointer_tag; -#else - ExternalPointerTag tag = kExternalPointerNullTag; -#endif + DCHECK_NE(kExternalPointerNullTag, tag); node = DecodeExternalPointer(node, tag); return Replace(node); - } else { - DCHECK(!access.type.Is(Type::SandboxedExternalPointer())); } +#endif + return Changed(node); } @@ -542,8 +539,7 @@ Reduction MemoryLowering::ReduceStoreField(Node* node, FieldAccess const& access = FieldAccessOf(node->op()); // External pointer must never be stored by optimized code. DCHECK_IMPLIES(V8_SANDBOXED_EXTERNAL_POINTERS_BOOL, - !access.type.Is(Type::ExternalPointer()) && - !access.type.Is(Type::SandboxedExternalPointer())); + !access.type.Is(Type::ExternalPointer())); // SandboxedPointers are not currently stored by optimized code. DCHECK(!access.type.Is(Type::SandboxedPointer())); MachineType machine_type = access.machine_type; diff --git a/src/compiler/simplified-lowering.cc b/src/compiler/simplified-lowering.cc index 0e2659e407..d580c31e04 100644 --- a/src/compiler/simplified-lowering.cc +++ b/src/compiler/simplified-lowering.cc @@ -1074,7 +1074,6 @@ class RepresentationSelector { } else if (type.Is(Type::BigInt()) && use.IsUsedAsWord64()) { return MachineRepresentation::kWord64; } else if (type.Is(Type::ExternalPointer()) || - type.Is(Type::SandboxedExternalPointer()) || type.Is(Type::SandboxedPointer())) { return MachineType::PointerRepresentation(); } diff --git a/src/compiler/types.h b/src/compiler/types.h index 9c08f3bbac..c809c5d63f 100644 --- a/src/compiler/types.h +++ b/src/compiler/types.h @@ -133,10 +133,7 @@ namespace compiler { // We split the macro list into two parts because the Torque equivalent in // turbofan-types.tq uses two 32bit bitfield structs. #define PROPER_ATOMIC_BITSET_TYPE_HIGH_LIST(V) \ - /* TODO(v8:10391): Remove this type once all ExternalPointer usages are */ \ - /* sandbox-ready. */ \ - V(SandboxedExternalPointer, uint64_t{1} << 32) \ - V(SandboxedPointer, uint64_t{1} << 33) + V(SandboxedPointer, uint64_t{1} << 32) #define PROPER_BITSET_TYPE_LIST(V) \ V(None, uint64_t{0}) \ @@ -210,7 +207,6 @@ namespace compiler { V(Unique, kBoolean | kUniqueName | kNull | \ kUndefined | kHole | kReceiver) \ V(Internal, kHole | kExternalPointer | \ - kSandboxedExternalPointer | \ kSandboxedPointer | kOtherInternal) \ V(NonInternal, kPrimitive | kReceiver) \ V(NonBigInt, kNonBigIntPrimitive | kReceiver) \ diff --git a/src/objects/turbofan-types.tq b/src/objects/turbofan-types.tq index 6e694ac2d2..f1cab8c491 100644 --- a/src/objects/turbofan-types.tq +++ b/src/objects/turbofan-types.tq @@ -48,7 +48,6 @@ bitfield struct TurbofanTypeLowBits extends uint32 { } bitfield struct TurbofanTypeHighBits extends uint32 { - sandboxed_external_pointer: bool: 1 bit; sandboxed_pointer: bool: 1 bit; }