Closed Bug 406007 Opened 17 years ago Closed 17 years ago

MMGC_GET_STACK_EXENTS doesn't safely stash registers on some platforms

Categories

(Tamarin Graveyard :: Garbage Collection (mmGC), defect)

PowerPC
All
defect
Not set
normal

Tracking

(Not tracked)

VERIFIED FIXED

People

(Reporter: jorendorff, Assigned: jorendorff)

Details

Attachments

(2 files)

On MacIntel, MMGC_GET_STACK_EXENTS looks like this: #define MMGC_GET_STACK_EXENTS(_gc, _stack, _size) \ do { \ volatile auto int save1,save2,save3,save4,save5,save6,save7;\ asm("movl %%eax,%0" : "=r" (save1));\ asm("movl %%ebx,%0" : "=r" (save2));\ ... asm("movl %%esp,%0" : "=r" (_stack));\ _size = (uintptr)_gc->GetStackTop() - (uintptr)_stack; } while (0) Note that all those volatile locals are declared inside the do-while block. Here's how this is used: GCWorkItem item; MMGC_GET_STACK_EXENTS(this, item.ptr, item._size); ... PushWorkItem(work, item); Mark(work); The region of the stack occupied by save1...saveN is included in `item`, but then the variables go out of scope, and that memory could be overwritten (in fact it seems quite likely) before Mark() gets to them.
Attachment #290691 - Flags: review?(treilly)
Assignee: general → nobody
Component: JavaScript Engine → Garbage Collection (mmGC)
Product: Core → Tamarin
QA Contact: general → gc
Version: Other Branch → unspecified
Incidentally, is there a reason EXENTS is spelled that way? Can I change it to EXTENTS?
nice find! sure, s/EXENTS/EXTENTS sounds right on.
nice, I'm wondering where the do {} whiles came from in the first place, maybe there was a reason for it? Maybe somebody tried to use the macro twice in one function and made this change to allow that? Anyway, should be removed.
Attachment #290691 - Flags: review?(treilly) → review+
Attached patch rename EXENTS to EXTENTS (deleted) — Splinter Review
Pushed v1 and this patch.
Assignee: nobody → jorendorff
Status: NEW → ASSIGNED
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: