Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-21 01:05:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1552180 - Poison Arena's zone pointer on free r=sfink

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D31494
This commit is contained in:
Jon Coppeard 2019-05-16 17:26:20 +01:00
parent c4cef85c43
commit b485ece003
3 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/gc/Heap-inl.h
View File

@ -15,7 +15,7 @@
inline void js::gc::Arena::init(JS::Zone* zoneArg, AllocKind kind,
const AutoLockGC& lock) {
MOZ_ASSERT(firstFreeSpan.isEmpty());
MOZ_ASSERT(!zone);
MOZ_ASSERT((uintptr_t(zone) & 0xff) == JS_FREED_ARENA_PATTERN);
MOZ_ASSERT(!allocated());
MOZ_ASSERT(!onDelayedMarkingList_);
MOZ_ASSERT(!hasDelayedBlackMarking_);

6
js/src/gc/Heap.h
View File

@ -275,7 +275,11 @@ class Arena {
// previously allocated for some zone, use release() instead.
void setAsNotAllocated() {
firstFreeSpan.initAsEmpty();
zone = nullptr;
// Poison zone pointer to highlight UAF on released arenas in crash data.
AlwaysPoison(&zone, JS_FREED_ARENA_PATTERN, sizeof(zone),
MemCheckKind::MakeUndefined);
allocKind = size_t(AllocKind::LIMIT);
onDelayedMarkingList_ = 0;
hasDelayedBlackMarking_ = 0;

1
js/src/jsutil.h
View File

@ -252,6 +252,7 @@ const uint8_t JS_SWEPT_TENURED_PATTERN = 0x4B;
const uint8_t JS_ALLOCATED_TENURED_PATTERN = 0x4D;
const uint8_t JS_FREED_HEAP_PTR_PATTERN = 0x6B;
const uint8_t JS_FREED_CHUNK_PATTERN = 0x8B;
const uint8_t JS_FREED_ARENA_PATTERN = 0x9B;
const uint8_t JS_SWEPT_TI_PATTERN = 0x6F;
const uint8_t JS_FRESH_MARK_STACK_PATTERN = 0x9F;