RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 06:47:34 +00:00
Code Issues Activity Actions

LibJS: Instrument HeapBlock cell allocation for ASAN

Browse source 
Mark the entirety of a heap block's storage poisoned at construction.
Unpoison all of a Cell's memory before allocating it, and re-poison as
much as possible on deallocation. Unfortunately, the entirety of the
FreelistEntry must be kept unpoisoned in order for reallocation to work
correctly.

Decreasing the size of FreelistEntry or adding a larger redzone to Cells
would make the instrumentation even better.
This commit is contained in:
Andrew Kaster 2021-05-29 06:36:18 -06:00 • committed by Linus Groh
parent 81a5dcde84
commit 6aba64b60f
2 changed files with 31 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
Userland/Libraries/LibJS/Heap/HeapBlock.h
View file

@ -7,10 +7,15 @@
#pragma once
#include <AK/IntrusiveList.h>
#include <AK/Platform.h>
#include <AK/Types.h>
#include <LibJS/Forward.h>
#include <LibJS/Heap/Cell.h>
#ifdef HAS_ADDRESS_SANITIZER
# include <sanitizer/asan_interface.h>
#endif
namespace JS {
class HeapBlock {
@ -27,13 +32,18 @@ public:
ALWAYS_INLINE Cell* allocate()
{
Cell* allocated_cell = nullptr;
if (m_freelist) {
VERIFY(is_valid_cell_pointer(m_freelist));
return exchange(m_freelist, m_freelist->next);
allocated_cell = exchange(m_freelist, m_freelist->next);
} else if (has_lazy_freelist()) {
allocated_cell = cell(m_next_lazy_freelist_index++);
}
if (has_lazy_freelist())
return cell(m_next_lazy_freelist_index++);
return nullptr;
if (allocated_cell) {
ASAN_UNPOISON_MEMORY_REGION(allocated_cell, m_cell_size);
}
return allocated_cell;
}
void deallocate(Cell*);