Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Bindings integrity logic depends on incorrect behavior of constexpr if
https://bugs.webkit.org/show_bug.cgi?id=274202 rdar://128006867 Reviewed by Chris Dumez. The existing code from generated for the bindings attempts to use `if constexpr (std::is_polymorphic_v<Type>)` to gate access to an object's vtable pointer if the object does not have a vtable. Due to a bug in clang this was historically allowed. However the actual spec behavior of `if constexpr` requires that all contained code that does not make use of a dependent type or value be semantically valid regardless of whether the condition is true or false. e.g. void *v = nullptr; if constexpr (false) { v++; } is invalid even though the body is never evaluated. To deal with this particular issue what this patch does is have codegen introduce a new `verifyVTable` function of the form template <typename T> void verifyVTable(const ImplType *) { if constexpr (std::is_polymorphic_v<T>) { ... } } That is then called from the toJS functions as verifyVTable<ImplType>(impl.get()); This code obviously appears silly as we will only ever be evaluating `void verifyVTable(const ImplType *)` with T==ImplType, but it satisfies the requirement that the constexpr evaluation involves a dependent type or value. In an ideal world there would be a mechanism to get the vtable for a type, which would allow us to have a single generic function, but alas there is not, so we cannot. * Source/WTF/wtf/PointerPreparations.h: (WTF::getVTablePointer): Add enable_if guards on the getVTablePointer functions so that the same ensuring the `if constexpr` path fails in existing compilers * Source/WebCore/bindings/scripts/CodeGeneratorJS.pm: (GenerateImplementation): Change the codegen to introduce and call the intermediate verifyVTable function. * Source/WebCore/bindings/scripts/test/JS/JSExposedStar.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSExposedToWorkerAndWindow.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestAsyncIterable.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestAsyncKeyValueIterable.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestConditionalIncludes.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestConditionallyReadWrite.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSON.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONFilteredByExposed.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestDelegateToSharedSyntheticAttribute.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestDomainSecurity.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestEnabledBySetting.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestGenerateAddOpaqueRoot.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestLegacyFactoryFunction.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestLegacyNoInterfaceObject.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestLegacyOverrideBuiltIns.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestMapLike.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestMapLikeWithOverriddenOperations.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyOverrideBuiltIns.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestOperationConditional.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestReadOnlyMapLike.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestReadOnlySetLike.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestReportExtraMemoryCost.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestScheduledAction.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestSetLike.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestSetLikeWithOverriddenOperations.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestStringContext.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestStringifier.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestTaggedWrapper.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): * Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp: (WebCore::verifyVTable): (WebCore::toJSNewlyCreated): Canonical link: https://commits.webkit.org/278886@main
- Loading branch information