Bug 183377

Summary: MarkedArgumentsBuffer should allocate from the JSValue Gigacage
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: ews-watchlist, keith_miller, mark.lam, msaboff, rniwa, saam, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch
msaboff: review+, ews-watchlist: commit-queue-
Archive of layout-test-results from ews106 for mac-sierra-wk2
none
Archive of layout-test-results from ews126 for ios-simulator-wk2
none
patch for landing none

Description Filip Pizlo 2018-03-06 11:50:04 PST
That prevents it from being used to pivot UAF on malloc memory into corruption in the JS heap.
Comment 1 Filip Pizlo 2018-03-06 11:51:36 PST
Created attachment 335121 [details]
the patch
Comment 2 Michael Saboff 2018-03-06 11:52:57 PST
Comment on attachment 335121 [details]
the patch

r=me
Comment 3 EWS Watchlist 2018-03-06 13:03:09 PST
Comment on attachment 335121 [details]
the patch

Attachment 335121 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/6829888

Number of test failures exceeded the failure limit.
Comment 4 EWS Watchlist 2018-03-06 13:03:11 PST
Created attachment 335129 [details]
Archive of layout-test-results from ews106 for mac-sierra-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews106  Port: mac-sierra-wk2  Platform: Mac OS X 10.12.6
Comment 5 EWS Watchlist 2018-03-06 13:15:34 PST
Comment on attachment 335121 [details]
the patch

Attachment 335121 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: http://webkit-queues.webkit.org/results/6830043

Number of test failures exceeded the failure limit.
Comment 6 EWS Watchlist 2018-03-06 13:15:36 PST
Created attachment 335131 [details]
Archive of layout-test-results from ews126 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews126  Port: ios-simulator-wk2  Platform: Mac OS X 10.12.6
Comment 7 Filip Pizlo 2018-03-06 14:24:38 PST
Created attachment 335139 [details]
patch for landing

Pretty sure I fixed all crashes.
Comment 8 Filip Pizlo 2018-03-07 10:14:17 PST
Landed in https://trac.webkit.org/changeset/229366/webkit
Comment 9 Radar WebKit Bug Importer 2018-03-07 10:15:24 PST
<rdar://problem/38225773>