Fix JITOperationList::addPointers() to support JIT_OPERATION_VALIDATION_ASSERT_ENABLED.

https://bugs.webkit.org/show_bug.cgi?id=237504
<rdar://problem/89770507>

Reviewed by Saam Barati.

According to tagJSCCodePtrImpl(), we will only use an operation's validation entry
if Options::useJITCage().  Make JITOperationList::addPointers() conform to this.

* assembler/JITOperationList.cpp:
(JSC::JITOperationList::addPointers):



Canonical link: https://commits.webkit.org/248104@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290873 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Author: Mark Lam

Source/JavaScriptCore/ChangeLog

@@ -1,3 +1,17 @@
+2022-03-05  Mark Lam  <mark.lam@apple.com>
+
+        Fix JITOperationList::addPointers() to support JIT_OPERATION_VALIDATION_ASSERT_ENABLED.
+        https://bugs.webkit.org/show_bug.cgi?id=237504
+        <rdar://problem/89770507>
+
+        Reviewed by Saam Barati.
+
+        According to tagJSCCodePtrImpl(), we will only use an operation's validation entry
+        if Options::useJITCage().  Make JITOperationList::addPointers() conform to this.
+
+        * assembler/JITOperationList.cpp:
+        (JSC::JITOperationList::addPointers):
+
 2022-03-05  Mark Lam  <mark.lam@apple.com>
 
         Optimize VMTraps::maybeNeedHandling().

Source/JavaScriptCore/assembler/JITOperationList.cpp

@@ -66,11 +66,11 @@ SUPPRESS_ASAN ALWAYS_INLINE void JITOperationList::addPointers(const JITOperatio
         return;
     }
 #endif
-    if constexpr (ASSERT_ENABLED) {
+    if constexpr (JIT_OPERATION_VALIDATION_ASSERT_ENABLED) {
         for (const auto* current = begin; current != end; ++current) {
             void* operation = removeCodePtrTag(current->operation);
             if (operation) {
-                void* validator = removeCodePtrTag(current->operationWithValidation);
+                void* validator = removeCodePtrTag(Options::useJITCage() ? current->operationWithValidation : current->operation);
                 validator = WTF::tagNativeCodePtrImpl<OperationPtrTag>(validator);
                 map.add(operation, validator);
                 JSC_REGISTER_INVERSE_JIT_CAGED_POINTER_FOR_DEBUG(validator, operation);