Technical Analysis of the Pegasus Exploits on iOS

objects, stored within <strong>the</strong> individual PropertyDescriptors in <strong>the</strong> descriptors vector, be individually
marked to ensure that <strong>the</strong>se references to not become stale. To achieve this, a
MarkedArgumentBuffer is used. This class is intended to temporarily prevent <strong>the</strong> values
appended to it from being garbage collected during <strong>the</strong> period for which it is in scope.
To understand how MarkedArgumentBuffers work we must first understand some basics <strong>of</strong>
JavaScriptCore garbage collection. The garbage collector is responsible for deallocating objects
that are no longer referenced and runs at random intervals that increase in frequency as more
memory is used by <strong>the</strong> WebContent process. To determine whe<strong>the</strong>r an object is referenced, <strong>the</strong>
garbage collector walks <strong>the</strong> stack and looks for references to <strong>the</strong> object. References to an
object may also exist on <strong>the</strong> application heap, however, so an alternate mechanism (which will
be explained in detail below) must be used for <strong>the</strong>se cases.
A MarkedArgumentBuffer initially attempts to maintain an inline stack buffer containing each
value. When <strong>the</strong> stack is walked within garbage collection, each value will be noted and <strong>the</strong>
underlying objects will avoid deallocation.
class MarkedArgumentBuffer {
...
private:
static const size_t inlineCapacity = 8;
…
public:
...
MarkedArgumentBuffer()
: m_size(0)
, m_capacity(inlineCapacity)
, m_buffer(m_inlineBuffer)
, m_markSet(0)
{
}
...
void append(JSValue v)
{
if (m_size >= m_capacity)
return slowAppend(v);
slotFor(m_size) = JSValue::encode(v);
++m_size;
}
...
private:
...
int m_size;
int m_capacity;
EncodedJSValue m_inlineBuffer[inlineCapacity];
EncodedJSValue* m_buffer;
ListSet* m_markSet;
The size <strong>of</strong> this inline stack buffer is limited to eight values. When <strong>the</strong> ninth value is added to a
MarkedArgumentBuffer, <strong>the</strong> underlying buffer is moved to <strong>the</strong> heap and <strong>the</strong> capacity is
expanded.
Page 4