{

bool jitEnabled = !g_jscConfig.jitDisabled;

#if HAVE(IOS_JIT_RESTRICTIONS)

jitEnabled = jitEnabled && (processHasEntitlement("dynamic-codesigning"_s) || processHasEntitlement("com.apple.developer.cs.allow-jit"_s));

#elif HAVE(MAC_JIT_RESTRICTIONS) && USE(APPLE_INTERNAL_SDK)

jitEnabled = jitEnabled && processHasEntitlement("com.apple.security.cs.allow-jit"_s);

#endif

return jitEnabled;

{

ASSERT(!g_jscConfig.fixedVMPoolExecutableAllocator);

if (g_jscConfig.jitDisabled) {

RELEASE_ASSERT(!Options::useJIT());

return;

}

g_jscConfig.jitDisabled = true;

Options::useJIT() = false;

#if HAVE(IOS_JIT_RESTRICTIONS) || HAVE(MAC_JIT_RESTRICTIONS) && USE(APPLE_INTERNAL_SDK)

#if HAVE(IOS_JIT_RESTRICTIONS)

bool shouldDisableJITMemory = processHasEntitlement("dynamic-codesigning"_s) || processHasEntitlement("com.apple.developer.cs.allow-jit"_s);

#else

bool shouldDisableJITMemory = processHasEntitlement("com.apple.security.cs.allow-jit"_s) && !isKernOpenSource();

#endif

if (shouldDisableJITMemory) {

#if PLATFORM(MAC)

RELEASE_ASSERT(processHasEntitlement("com.apple.private.verified-jit"));

RELEASE_ASSERT(processHasEntitlement("com.apple.security.cs.single-jit"));

#endif

// Because of an OS quirk, even after the JIT region has been unmapped,

// the OS thinks that region is reserved, and as such, can cause Gigacage

// allocation to fail. We work around this by initializing the Gigacage

// first.

// Note: when called, disableJIT() is always called extra early in the

// process bootstrap. Under normal operation (when disableJIT() isn't

// called at all), we will naturally initialize the Gigacage before we

// allocate the JIT region. Hence, this workaround is merely ensuring the

// same behavior of allocation ordering.

Gigacage::ensureGigacage();

constexpr size_t size = 1;

constexpr int protection = PROT_READ | PROT_WRITE | PROT_EXEC;

constexpr int fd = OSAllocator::JSJITCodePages;

int flags = MAP_PRIVATE | MAP_ANON | (Options::useJITCage() ? MAP_EXECUTABLE_FOR_JIT_WITH_JIT_CAGE : MAP_EXECUTABLE_FOR_JIT);

void* allocation = mmap(nullptr, size, protection, flags, fd, 0);

const void* executableMemoryAllocationFailure = reinterpret_cast<void*>(-1);

RELEASE_ASSERT_WITH_MESSAGE(allocation && allocation != executableMemoryAllocationFailure, "We should not have allocated executable memory before disabling the JIT.");

RELEASE_ASSERT_WITH_MESSAGE(!munmap(allocation, size), "Unmapping executable memory should succeed so we do not have any executable memory in the address space");

RELEASE_ASSERT_WITH_MESSAGE(mmap(nullptr, size, protection, flags, fd, 0) == executableMemoryAllocationFailure, "Allocating executable memory should fail after disableJIT() is called.");

}

#endif

{

WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN

memcpy((void*)(g_jscConfig.startOfFixedWritableMemoryPool + offset), data, dataSize);

WTF_ALLOW_UNSAFE_BUFFER_USAGE_END

{

g_jscConfig.startOfFixedWritableMemoryPool = reinterpret_cast<uintptr_t>(address);

void* function = reinterpret_cast<void*>(&genericWriteToJITRegion);

#if CPU(ARM_THUMB2)

// Handle thumb offset

uintptr_t functionAsInt = reinterpret_cast<uintptr_t>(function);

functionAsInt -= 1;

function = reinterpret_cast<void*>(functionAsInt);

#endif

auto codePtr = CodePtr<JITThunkPtrTag>(tagCFunctionPtr<JITThunkPtrTag>(function));

return MacroAssemblerCodeRef<JITThunkPtrTag>::createSelfManagedCodeRef(codePtr);

{

auto exitScope = makeScopeExit([] {

RELEASE_ASSERT(!g_jscConfig.useFastJITPermissions);

});

mach_vm_address_t writableAddr = 0;

// Create a second mapping of the JIT region at a random address.

vm_prot_t cur, max;

int remapFlags = VM_FLAGS_ANYWHERE;

#if defined(VM_FLAGS_RANDOM_ADDR)

remapFlags |= VM_FLAGS_RANDOM_ADDR;

#endif

kern_return_t ret = mach_vm_remap(mach_task_self(), &writableAddr, jitSize, 0,

remapFlags,

mach_task_self(), (mach_vm_address_t)jitBase, FALSE,

&cur, &max, VM_INHERIT_DEFAULT);

bool remapSucceeded = (ret == KERN_SUCCESS);

if (!remapSucceeded)

return;

// Assemble a thunk that will serve as the means for writing into the JIT region.

MacroAssemblerCodeRef<JITThunkPtrTag> writeThunk = jitWriteThunkGenerator(reinterpret_cast<void*>(writableAddr), stubBase, stubSize);

int result = 0;

#if USE(EXECUTE_ONLY_JIT_WRITE_FUNCTION)

// Prevent reading the write thunk code.

result = vm_protect(mach_task_self(), reinterpret_cast<vm_address_t>(stubBase), stubSize, true, VM_PROT_EXECUTE);

RELEASE_ASSERT(!result);

#endif

// Prevent writing into the executable JIT mapping.

result = vm_protect(mach_task_self(), reinterpret_cast<vm_address_t>(jitBase), jitSize, true, VM_PROT_READ | VM_PROT_EXECUTE);

RELEASE_ASSERT(!result);

// Prevent execution in the writable JIT mapping.

result = vm_protect(mach_task_self(), static_cast<vm_address_t>(writableAddr), jitSize, true, VM_PROT_READ | VM_PROT_WRITE);

RELEASE_ASSERT(!result);

WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN

// Zero out writableAddr to avoid leaking the address of the writable mapping.

memset_s(&writableAddr, sizeof(writableAddr), 0, sizeof(writableAddr));

WTF_ALLOW_UNSAFE_BUFFER_USAGE_END

#if ENABLE(SEPARATED_WX_HEAP)

g_jscConfig.jitWriteSeparateHeaps = reinterpret_cast<JITWriteSeparateHeapsFunction>(writeThunk.code().taggedPtr());

#endif

PageReservation pageReservation;

void* base { nullptr };

size_t size { 0 };

{

JITReservation reservation;

if (!isJITEnabled())

return reservation;

#if OS(DARWIN)

// Call pageSize() to run its assertions to enforce invariants that executablePageSize() relies on.

WTF::pageSize();

#endif

reservation.size = fixedExecutableMemoryPoolSize;

if (Options::jitMemoryReservationSize()) {

reservation.size = Options::jitMemoryReservationSize();

#if ENABLE(LIBPAS_JIT_HEAP)

if (reservation.size * executablePoolReservationFraction < minimumExecutablePoolReservationSize)

reservation.size += minimumExecutablePoolReservationSize;

#endif

}

reservation.size = std::max(roundUpToMultipleOf(executablePageSize(), reservation.size), executablePageSize() * 2);

#if !ENABLE(JUMP_ISLANDS)

RELEASE_ASSERT(reservation.size <= MacroAssembler::nearJumpRange, "Executable pool size is too large for near jump/call without JUMP_ISLANDS");

#endif

#if ENABLE(LIBPAS_JIT_HEAP)

if (reservation.size < minimumPoolSizeForSegregatedHeap)

jit_heap_runtime_config.max_segregated_object_size = 0;

#endif

auto tryCreatePageReservation = [] (size_t reservationSize, void* hintAddress) {

#if OS(LINUX)

// On Linux, if we use uncommitted reservation, mmap operation is recorded with small page size in perf command's output.

// This makes the following JIT code logging broken and some of JIT code is not recorded correctly.

// To avoid this problem, we use committed reservation if we need perf JITDump logging.

if (Options::useJITDump())

return PageReservation::tryReserveWithGuardPages(reservationSize, OSAllocator::JSJITCodePages, hintAddress, EXECUTABLE_POOL_WRITABLE, true, true, false);

#endif

if (Options::useJITCage() && JSC_ALLOW_JIT_CAGE_SPECIFIC_RESERVATION)

return PageReservation::tryReserve(reservationSize, OSAllocator::JSJITCodePages, hintAddress, EXECUTABLE_POOL_WRITABLE, true, false, Options::useJITCage());

return PageReservation::tryReserveWithGuardPages(reservationSize, OSAllocator::JSJITCodePages, hintAddress, EXECUTABLE_POOL_WRITABLE, true, false, false);

};

void* addressHint = reinterpret_cast<void*>(Options::jitMemoryReservationAddress());

reservation.pageReservation = tryCreatePageReservation(reservation.size, addressHint);

if (addressHint)

RELEASE_ASSERT(reservation.pageReservation.base() == addressHint && "Failed to accomodate JSC_jitMemoryReservationAddress");

if (Options::verboseExecutablePoolAllocation())

dataLog(getpid(), ": Got executable pool reservation at ", RawPointer(reservation.pageReservation.base()), "...", RawPointer(reservation.pageReservation.end()), ", while I'm at ", RawPointer(reinterpret_cast<void*>(initializeJITPageReservation)), "\n");

if (reservation.pageReservation) {

ASSERT(reservation.pageReservation.size() == reservation.size);

reservation.base = reservation.pageReservation.base();

g_jscConfig.useFastJITPermissions = threadSelfRestrictSupported<MemoryRestriction::kRwxToRw>();

if (g_jscConfig.useFastJITPermissions)

threadSelfRestrict<MemoryRestriction::kRwxToRx>();

#if ENABLE(SEPARATED_WX_HEAP)

if (!g_jscConfig.useFastJITPermissions) {

// First page of our JIT allocation is reserved.

ASSERT(reservation.size >= executablePageSize() * 2);

reservation.base = (void*)((uintptr_t)(reservation.base) + executablePageSize());

reservation.size -= executablePageSize();

initializeSeparatedWXHeaps(reservation.pageReservation.base(), executablePageSize(), reservation.base, reservation.size);

}

#endif

void* reservationEnd = static_cast<uint8_t*>(reservation.base) + reservation.size;

g_jscConfig.startExecutableMemory = reservation.base;

g_jscConfig.endExecutableMemory = reservationEnd;

#if !USE(SYSTEM_MALLOC)

static_assert(WebConfig::reservedSlotsForExecutableAllocator >= 2);

constexpr size_t startSlot = WebConfig::startOffsetOfExecutableAllocatorConfig / sizeof(WebConfig::Slot);

WebConfig::g_config[startSlot] = std::bit_cast<uintptr_t>(reservation.base);

WebConfig::g_config[startSlot + 1] = std::bit_cast<uintptr_t>(reservationEnd);

#endif

#if HAVE(KDEBUG_H)

{

uint64_t pid = getCurrentProcessID();

auto uuid = WTF::UUID::createVersion5(jscJITNamespace, std::span { std::bit_cast<const uint8_t*>(&pid), sizeof(pid) });

kdebug_trace(KDBG_CODE(DBG_DYLD, DBG_DYLD_UUID, DBG_DYLD_UUID_MAP_A), std::byteswap(uuid.high()), std::byteswap(uuid.low()), std::bit_cast<uintptr_t>(reservation.base), 0);

}

#elif USE(SYSPROF_CAPTURE)

WTFEmitSignpost(reservation, InitJITPageReservation);

#endif

}

return reservation;

{

#if ENABLE(LIBPAS_JIT_HEAP)

Vector<void*, 0> randomAllocations;

if (Options::useRandomizingExecutableIslandAllocation()) [[unlikely]] {

// Let's fragment the executable memory agressively

auto bytesAllocated = m_bytesAllocated.load(std::memory_order_relaxed);

uint64_t allocationRoom = (m_reservation.size() - bytesAllocated) * 1 / 100 / sizeInBytes;

if (!allocationRoom)

allocationRoom = 1;

int count = cryptographicallyRandomNumber<uint32_t>() % allocationRoom;

randomAllocations.grow(count);

for (int i = 0; i < count; ++i) {

void* result = jit_heap_try_allocate(sizeInBytes);

if (!result) {

// We are running out of memory, so make sure this allocation will succeed.

for (int j = 0; j < i; ++j)

jit_heap_deallocate(randomAllocations[j]);

randomAllocations.shrink(0);

break;

}

randomAllocations[i] = result;

}

}

auto result = ExecutableMemoryHandle::createImpl(sizeInBytes);

if (result) [[likely]]

m_bytesAllocated.fetch_add(result->sizeInBytes(), std::memory_order_relaxed);

if (Options::useRandomizingExecutableIslandAllocation()) [[unlikely]] {

for (unsigned i = 0; i < randomAllocations.size(); ++i)

jit_heap_deallocate(randomAllocations[i]);

}

return result;

#elif ENABLE(JUMP_ISLANDS)

Locker locker { getLock() };

unsigned start = 0;

if (Options::useRandomizingExecutableIslandAllocation()) [[unlikely]]

start = cryptographicallyRandomNumber<uint32_t>() % m_allocators.size();

unsigned i = start;

while (true) {

RegionAllocator& allocator = m_allocators[i];

if (RefPtr<ExecutableMemoryHandle> result = allocator.allocate(locker, sizeInBytes))

return result;

i = (i + 1) % m_allocators.size();

if (i == start)

break;

}

return nullptr;

#else

return m_allocator.allocate(sizeInBytes);

#endif

{

#if ENABLE(LIBPAS_JIT_HEAP)

return m_bytesAllocated.load(std::memory_order_relaxed);

#else

size_t result = 0;

forEachAllocator([&] (Allocator& allocator) {

result += allocator.bytesAllocated();

});

return result;

#endif

{

size_t bytesReserved = this->bytesReserved();

#if ENABLE(LIBPAS_JIT_HEAP)

size_t nonAvailableSize = static_cast<size_t>(bytesReserved * executablePoolReservationFraction);

if (nonAvailableSize < minimumExecutablePoolReservationSize)

return bytesReserved - minimumExecutablePoolReservationSize;

return bytesReserved - nonAvailableSize;

#else

return static_cast<size_t>(bytesReserved * (1 - executablePoolReservationFraction));

#endif

{

size_t result = 0;

forEachAllocator([&] (Allocator& allocator) {

result += allocator.bytesCommitted();

});

return result;

{

#if ENABLE(JUMP_ISLANDS)

if (RegionAllocator* allocator = findRegion(std::bit_cast<uintptr_t>(address)))

return allocator->isInAllocatedMemory(locker, address);

return false;

#else

return m_allocator.isInAllocatedMemory(locker, address);

#endif

{

forEachAllocator([&] (Allocator& allocator) {

allocator.dumpProfile();

});

{

size_t startPage = std::bit_cast<uintptr_t>(std::bit_cast<uint8_t*>(start) - std::bit_cast<uint8_t*>(g_jscConfig.startExecutableMemory)) / pageSize;

size_t endPage = WTF::roundUpToMultipleOf(pageSize, std::bit_cast<uintptr_t>(start) - std::bit_cast<uintptr_t>(g_jscConfig.startExecutableMemory) + sizeInBytes) / pageSize;

return { startPage, endPage };

{

size_t pageSize = executablePageSize();

auto [startPage, endPage] = pageRangeForWrittenRegion(start, sizeInBytes, pageSize);

uint8_t* startAddress = std::bit_cast<uint8_t*>(g_jscConfig.startExecutableMemory);

{

Locker locker(m_pageLock);

ssize_t firstFirstWriterPage = -1; // We use this to track runs of pages for which we are the first writer, since this means their mprotect() calls can be batched.

for (size_t i = startPage; i < endPage; i ++) {

if (!(m_pageWriterCounts[i]++)) {

if (firstFirstWriterPage == -1)

firstFirstWriterPage = i;

} else if (firstFirstWriterPage != -1) {

mprotect(startAddress + pageSize * firstFirstWriterPage, (i - firstFirstWriterPage) * pageSize, PROT_READ | PROT_WRITE | PROT_EXEC);

firstFirstWriterPage = -1;

}

}

if (firstFirstWriterPage != -1)

mprotect(startAddress + pageSize * firstFirstWriterPage, (endPage - firstFirstWriterPage) * pageSize, PROT_READ | PROT_WRITE | PROT_EXEC);

}

{

size_t pageSize = executablePageSize();

auto [startPage, endPage] = pageRangeForWrittenRegion(start, sizeInBytes, pageSize);

uint8_t* startAddress = std::bit_cast<uint8_t*>(g_jscConfig.startExecutableMemory);

{

Locker locker(m_pageLock);

ssize_t firstLastWriterPage = -1; // We use this to track runs of pages for which we are the last writer, since this means their mprotect() calls can be batched.

for (size_t i = startPage; i < endPage; i ++) {

if (!--m_pageWriterCounts[i]) {

if (firstLastWriterPage == -1)

firstLastWriterPage = i;

} else if (firstLastWriterPage != -1) {

mprotect(startAddress + pageSize * firstLastWriterPage, (i - firstLastWriterPage) * pageSize, PROT_READ | PROT_EXEC);

firstLastWriterPage = -1;

}

}

if (firstLastWriterPage != -1)

mprotect(startAddress + pageSize * firstLastWriterPage, (endPage - firstLastWriterPage) * pageSize, PROT_READ | PROT_EXEC);

}

{

Locker locker { getLock() };

MetaAllocator::Statistics result { 0, 0, 0 };

forEachAllocator([&] (Allocator& allocator) {

auto allocatorStats = allocator.currentStatistics(locker);

result.bytesAllocated += allocatorStats.bytesAllocated;

result.bytesReserved += allocatorStats.bytesReserved;

result.bytesCommitted += allocatorStats.bytesCommitted;

});

return result;

{

m_bytesAllocated.fetch_sub(sizeInBytes, std::memory_order_relaxed);

#if ENABLE(JUMP_ISLANDS)

if (m_islandsForJumpSourceLocation.isEmpty())

return;

Locker locker { getLock() };

handleWillBeReleased(locker, handle);

#else // ENABLE(JUMP_ISLANDS) -> so !ENABLE(JUMP_ISLANDS)

UNUSED_PARAM(handle);

#endif // ENABLE(JUMP_ISLANDS) -> so end of !ENABLE(JUMP_ISLANDS)

{

if (m_islandsForJumpSourceLocation.isEmpty())

return;

Vector<Islands*, 16> toRemove;

void* start = handle.start().untaggedPtr();

void* end = handle.end().untaggedPtr();

m_islandsForJumpSourceLocation.iterate([&] (Islands& islands, bool& visitLeft, bool& visitRight) {

if (start <= islands.key() && islands.key() < end)

toRemove.append(&islands);

if (islands.key() > start)

visitLeft = true;

if (islands.key() < end)

visitRight = true;

});

SUPPRESS_UNCHECKED_LOCAL for (Islands* islands : toRemove)

freeIslands(locker, islands);

if (ASSERT_ENABLED) {

m_islandsForJumpSourceLocation.iterate([&] (Islands& islands, bool& visitLeft, bool& visitRight) {

if (start <= islands.key() && islands.key() < end) {

dataLogLn("did not remove everything!");

RELEASE_ASSERT_NOT_REACHED();

}

visitLeft = true;

visitRight = true;

});

}

{

for (CodeLocationLabel<ExecutableMemoryPtrTag> jumpIsland : islands->jumpIslands) {

uintptr_t untaggedJumpIsland = std::bit_cast<uintptr_t>(jumpIsland.dataLocation());

RegionAllocator* allocator = findRegion(untaggedJumpIsland);

RELEASE_ASSERT(allocator);

allocator->freeIsland(untaggedJumpIsland);

}

islands->jumpIslands.clear();

{

freeJumpIslands(locker, islands);

m_islandsForJumpSourceLocation.remove(islands);

delete islands;

{

RELEASE_ASSERT(!m_start);

RELEASE_ASSERT(!m_end);

m_start = reinterpret_cast<uintptr_t>(start);

m_end = m_start + sizeInBytes;

jit_heap_add_fresh_memory(pas_range_create(m_start, m_end));

{

uintptr_t addressAsInt = reinterpret_cast<uintptr_t>(address);

return addressAsInt >= m_start && addressAsInt < m_end;

{

// We're operating in a fixed pool, so new allocation is always prohibited.

return nullptr;

using Base = Allocator;

public:

RegionAllocator(FixedVMPoolExecutableAllocator& allocator)

: Base(allocator)

{

RELEASE_ASSERT(!(executablePageSize() % islandSizeInBytes), "Current implementation relies on this");

}

void configure(uintptr_t start, uintptr_t islandBegin, uintptr_t end)

{

RELEASE_ASSERT(start < islandBegin);

RELEASE_ASSERT(islandBegin <= end);

m_start = std::bit_cast<void*>(start);

m_islandBegin = std::bit_cast<void*>(islandBegin);

m_end = std::bit_cast<void*>(end);

RELEASE_ASSERT(!((this->islandBegin() - this->start()) % executablePageSize()));

RELEASE_ASSERT(!((this->end() - this->islandBegin()) % executablePageSize()));

addFreshFreeSpace(std::bit_cast<void*>(this->start()), allocatorSize());

}

// ------------------------------------

// | jit allocations --> <-- islands |

// -------------------------------------

uintptr_t start() { return reinterpret_cast<uintptr_t>(m_start); }

uintptr_t islandBegin() { return reinterpret_cast<uintptr_t>(m_islandBegin); }

uintptr_t end() { return reinterpret_cast<uintptr_t>(m_end); }

size_t maxIslandsInThisRegion() { return (end() - islandBegin()) / islandSizeInBytes; }

uintptr_t allocatorSize()

{

return islandBegin() - start();

}

size_t islandsPerPage()

{

size_t islandsPerPage = executablePageSize() / islandSizeInBytes;

ASSERT(islandsPerPage * islandSizeInBytes == executablePageSize());

ASSERT(isPowerOfTwo(islandsPerPage));

return islandsPerPage;

}

#if !ENABLE(LIBPAS_JIT_HEAP)

void release(const Locker<Lock>& locker, MetaAllocatorHandle& handle) final

{