featurize_policy_update (#18492)

runtime/src/message_processor.rs

@@ -9,7 +9,7 @@ use solana_sdk::{
     account::{AccountSharedData, ReadableAccount, WritableAccount},
     account_utils::StateMut,
     bpf_loader_upgradeable::{self, UpgradeableLoaderState},
-    feature_set::{instructions_sysvar_enabled, FeatureSet},
+    feature_set::{instructions_sysvar_enabled, updated_verify_policy, FeatureSet},
     ic_logger_msg, ic_msg,
     instruction::{CompiledInstruction, Instruction, InstructionError},
     keyed_account::{create_keyed_accounts_unified, keyed_account_at_index, KeyedAccount},
@@ -110,6 +110,7 @@ impl PreAccount {
         post: &AccountSharedData,
         timings: &mut ExecuteDetailsTimings,
         outermost_call: bool,
+        updated_verify_policy: bool,
     ) -> Result<(), InstructionError> {
         let pre = self.account.borrow();
 
@@ -178,9 +179,14 @@ impl PreAccount {
             if !rent.is_exempt(post.lamports(), post.data().len()) {
                 return Err(InstructionError::ExecutableAccountNotRentExempt);
             }
+            let owner = if updated_verify_policy {
+                post.owner()
+            } else {
+                pre.owner()
+            };
             if !is_writable // line coverage used to get branch coverage
                 || pre.executable()
-                || program_id != post.owner()
+                || program_id != owner
             {
                 return Err(InstructionError::ExecutableModified);
             }
@@ -408,6 +414,7 @@ impl<'a> InvokeContext for ThisInvokeContext<'a> {
             write_privileges,
             &mut self.timings,
             logger,
+            self.feature_set.is_active(&updated_verify_policy::id()),
         )
     }
     fn get_caller(&self) -> Result<&Pubkey, InstructionError> {
@@ -991,6 +998,7 @@ impl MessageProcessor {
         rent: &Rent,
         timings: &mut ExecuteDetailsTimings,
         logger: Rc<RefCell<dyn Logger>>,
+        updated_verify_policy: bool,
     ) -> Result<(), InstructionError> {
         // Verify all executable accounts have zero outstanding refs
         Self::verify_account_references(executable_accounts)?;
@@ -1016,6 +1024,7 @@ impl MessageProcessor {
                         &account,
                         timings,
                         true,
+                        updated_verify_policy,
                     )
                     .map_err(|err| {
                         ic_logger_msg!(
@@ -1051,6 +1060,7 @@ impl MessageProcessor {
         write_privileges: &[bool],
         timings: &mut ExecuteDetailsTimings,
         logger: Rc<RefCell<dyn Logger>>,
+        updated_verify_policy: bool,
     ) -> Result<(), InstructionError> {
         // Verify the per-account instruction results
         let (mut pre_sum, mut post_sum) = (0_u128, 0_u128);
@@ -1069,7 +1079,15 @@ impl MessageProcessor {
                         }
                         let account = account.borrow();
                         pre_account
-                            .verify(program_id, is_writable, rent, &account, timings, false)
+                            .verify(
+                                program_id,
+                                is_writable,
+                                rent,
+                                &account,
+                                timings,
+                                false,
+                                updated_verify_policy,
+                            )
                             .map_err(|err| {
                                 ic_logger_msg!(logger, "failed to verify account {}: {}", key, err);
                                 err
@@ -1159,6 +1177,7 @@ impl MessageProcessor {
             &rent_collector.rent,
             timings,
             invoke_context.get_logger(),
+            invoke_context.is_feature_active(&updated_verify_policy::id()),
         )?;
 
         timings.accumulate(&invoke_context.timings);
@@ -1465,6 +1484,7 @@ mod tests {
                 &self.post,
                 &mut ExecuteDetailsTimings::default(),
                 false,
+                true,
             )
         }
     }