f53dfd934d
The idea is to mark all the branches and loads participating in array bounds checks, and let them contribute-to/use the poisoning register. In the code, the marks for array indexing operations now contain "Critical" in their name. By default (--untrusted-code-mitigations), we only instrument the "critical" operations with poisoning. With that in place, we also remove the array masking approach based on arithmetic. Since we do not propagate the poison through function calls, we introduce a node for poisoning an index that is passed through function call - the typical example is the bounds-checked index that is passed to the CharCodeAt builtin. Most of the code in this CL is threads through the three levels of protection (safe, critical, unsafe) for loads, branches and flags. Bug: chromium:798964 Change-Id: Ief68e2329528277b3ba9156115b2a6dcc540d52b Reviewed-on: https://chromium-review.googlesource.com/995413 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#52883}
73 lines
2.3 KiB
C++
73 lines
2.3 KiB
C++
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#include "test/unittests/code-stub-assembler-unittest.h"
|
|
|
|
#include "src/code-factory.h"
|
|
#include "src/compiler/node.h"
|
|
#include "src/interface-descriptors.h"
|
|
#include "src/isolate.h"
|
|
#include "src/objects-inl.h"
|
|
#include "test/unittests/compiler/compiler-test-utils.h"
|
|
#include "test/unittests/compiler/node-test-utils.h"
|
|
|
|
using ::testing::_;
|
|
using v8::internal::compiler::Node;
|
|
|
|
namespace c = v8::internal::compiler;
|
|
|
|
namespace v8 {
|
|
namespace internal {
|
|
|
|
#ifdef ENABLE_VERIFY_CSA
|
|
#define IS_BITCAST_WORD_TO_TAGGED_SIGNED(x) IsBitcastWordToTaggedSigned(x)
|
|
#define IS_BITCAST_TAGGED_TO_WORD(x) IsBitcastTaggedToWord(x)
|
|
#else
|
|
#define IS_BITCAST_WORD_TO_TAGGED_SIGNED(x) (x)
|
|
#define IS_BITCAST_TAGGED_TO_WORD(x) (x)
|
|
#endif
|
|
|
|
CodeStubAssemblerTestState::CodeStubAssemblerTestState(
|
|
CodeStubAssemblerTest* test)
|
|
: compiler::CodeAssemblerState(
|
|
test->isolate(), test->zone(), VoidDescriptor(test->isolate()),
|
|
Code::STUB, "test", PoisoningMitigationLevel::kPoisonCriticalOnly) {}
|
|
|
|
TARGET_TEST_F(CodeStubAssemblerTest, SmiTag) {
|
|
CodeStubAssemblerTestState state(this);
|
|
CodeStubAssemblerForTest m(&state);
|
|
Node* value = m.Int32Constant(44);
|
|
EXPECT_THAT(m.SmiTag(value),
|
|
IS_BITCAST_WORD_TO_TAGGED_SIGNED(c::IsIntPtrConstant(
|
|
static_cast<intptr_t>(44) << (kSmiShiftSize + kSmiTagSize))));
|
|
EXPECT_THAT(m.SmiUntag(value),
|
|
c::IsIntPtrConstant(static_cast<intptr_t>(44) >>
|
|
(kSmiShiftSize + kSmiTagSize)));
|
|
}
|
|
|
|
TARGET_TEST_F(CodeStubAssemblerTest, IntPtrMax) {
|
|
CodeStubAssemblerTestState state(this);
|
|
CodeStubAssemblerForTest m(&state);
|
|
{
|
|
Node* a = m.IntPtrConstant(100);
|
|
Node* b = m.IntPtrConstant(1);
|
|
Node* z = m.IntPtrMax(a, b);
|
|
EXPECT_THAT(z, c::IsIntPtrConstant(100));
|
|
}
|
|
}
|
|
|
|
TARGET_TEST_F(CodeStubAssemblerTest, IntPtrMin) {
|
|
CodeStubAssemblerTestState state(this);
|
|
CodeStubAssemblerForTest m(&state);
|
|
{
|
|
Node* a = m.IntPtrConstant(100);
|
|
Node* b = m.IntPtrConstant(1);
|
|
Node* z = m.IntPtrMin(a, b);
|
|
EXPECT_THAT(z, c::IsIntPtrConstant(1));
|
|
}
|
|
}
|
|
|
|
} // namespace internal
|
|
} // namespace v8
|