Open Bug 1897940 Opened 11 months ago Updated 11 months ago

CodeKind should distinguish code which has no user input.

Categories

(Core :: JavaScript Engine: JIT, enhancement, P3)

Product:
Core
Component:
JavaScript Engine: JIT
Type:
enhancement

Tracking

()

People

(Reporter: nbp, Unassigned)

References

(Blocks 1 open bug)

Details

Currently we have in ExecutableAllocator an enumerated type called CodeKind, which carries the information of what kind of memory the code should be accounted against.

Today CodeKind::Other mostly describes code which is has no variable input, with the exception of JitRuntime::generateEntryTrampolineForScript, which uses a JSScript* as argument, but it does not seems to use it for generating code, only for recording the offsets matching baseline / ion.

One wishful thinking would have been to forbid the creation of CodeKind::Other as soon as the JITRuntime is fully initialized, such that a process can either generate statically known JIT code, or generate user-tainted JIT code.

You need to log in before you can comment on or make changes to this bug.