RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 21:08:12 +00:00
Code Issues Activity Actions

AK+LibJS: Handle NaN-boxing pointers on AArch64

Browse source 
JS::Value stores 48 bit pointers to separately allocated objects in its
payload. On x86-64, canonical addresses have their top 16 bits set to
the same value as bit 47, effectively meaning that the value has to be
sign-extended to get the pointer. AArch64, however, expects the topmost
bits to be all zeros.

This commit gates sign extension behind `#if ARCH(X86_64)`, and adds an
`#error` for unsupported architectures, so that we do not forget to
think about pointer handling when porting to a new architecture.

Fixes #15290
Fixes SerenityOS/ladybird#56
This commit is contained in:
Daniel Bertalan 2022-09-20 18:09:33 +02:00 • committed by Andreas Kling
parent 62fed2a31d
commit 2b69af2dfe
4 changed files with 42 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Userland/Libraries/LibJS/Heap/Heap.cpp
View file

@ -142,7 +142,7 @@ __attribute__((no_sanitize("address"))) void Heap::gather_conservative_roots(Has
// match any pointer-backed tag, in that case we have to extract the pointer to its
// canonical form and add that as a possible pointer.
if ((data & SHIFTED_IS_CELL_PATTERN) == SHIFTED_IS_CELL_PATTERN)
possible_pointers.set((u64)(((i64)data << 16) >> 16));
possible_pointers.set(Value::extract_pointer_bits(data));
else
possible_pointers.set(data);
} else {