Closed
Bug 406007
Opened 17 years ago
Closed 17 years ago
MMGC_GET_STACK_EXENTS doesn't safely stash registers on some platforms
Categories
(Tamarin Graveyard :: Garbage Collection (mmGC), defect)
Tracking
(Not tracked)
VERIFIED
FIXED
People
(Reporter: jorendorff, Assigned: jorendorff)
Details
Attachments
(2 files)
(deleted),
patch
|
treilly
:
review+
|
Details | Diff | Splinter Review |
(deleted),
patch
|
Details | Diff | Splinter Review |
On MacIntel, MMGC_GET_STACK_EXENTS looks like this:
#define MMGC_GET_STACK_EXENTS(_gc, _stack, _size) \
do { \
volatile auto int save1,save2,save3,save4,save5,save6,save7;\
asm("movl %%eax,%0" : "=r" (save1));\
asm("movl %%ebx,%0" : "=r" (save2));\
...
asm("movl %%esp,%0" : "=r" (_stack));\
_size = (uintptr)_gc->GetStackTop() - (uintptr)_stack; } while (0)
Note that all those volatile locals are declared inside the do-while block. Here's how this is used:
GCWorkItem item;
MMGC_GET_STACK_EXENTS(this, item.ptr, item._size);
...
PushWorkItem(work, item);
Mark(work);
The region of the stack occupied by save1...saveN is included in `item`, but then the variables go out of scope, and that memory could be overwritten (in fact it seems quite likely) before Mark() gets to them.
Attachment #290691 -
Flags: review?(treilly)
Assignee | ||
Updated•17 years ago
|
Assignee: general → nobody
Component: JavaScript Engine → Garbage Collection (mmGC)
Product: Core → Tamarin
QA Contact: general → gc
Version: Other Branch → unspecified
Assignee | ||
Comment 1•17 years ago
|
||
Incidentally, is there a reason EXENTS is spelled that way? Can I change it to EXTENTS?
Comment 2•17 years ago
|
||
nice find! sure, s/EXENTS/EXTENTS sounds right on.
Comment 3•17 years ago
|
||
nice, I'm wondering where the do {} whiles came from in the first place, maybe there was a reason for it? Maybe somebody tried to use the macro twice in one function and made this change to allow that? Anyway, should be removed.
Updated•17 years ago
|
Attachment #290691 -
Flags: review?(treilly) → review+
Assignee | ||
Comment 4•17 years ago
|
||
Pushed v1 and this patch.
Assignee: nobody → jorendorff
Status: NEW → ASSIGNED
Assignee | ||
Updated•17 years ago
|
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Updated•15 years ago
|
Status: RESOLVED → VERIFIED
You need to log in
before you can comment on or make changes to this bug.
Description
•