Bug 22974

Summary: Fix rounding / bounds / signed comparison bug in ExecutableAllocator.
Product: WebKit Reporter: Gavin Barraclough <barraclough>
Component: JavaScriptCoreAssignee: Gavin Barraclough <barraclough>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: OS X 10.5   
Attachments:
Description Flags
The patch oliver: review+

Gavin Barraclough
Reported 2008-12-22 22:05:56 PST
ExecutableAllocator ::alloc assumed that m_freePtr would be aligned. This was not always true, since the first allocation from an additional pool would not be rounded up. Subsequent allocations would be unaligned, and too much memory could be erroneously allocated from the pool, when the size requested was available, but the size rounded up to word granularity was not available in the pool. This may result in the value of m_freePtr being greater than m_end. Under these circumstances, the unsigned check for space will always pass, resulting in pointers to memory outside of the arena being returned, and ultimately segfaulty goodness when attempting to memcpy the hot freshly jitted code from the AssemblerBuffer.
Attachments
The patch (4.01 KB, patch)
2008-12-22 22:11 PST, Gavin Barraclough 		oliver: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Gavin Barraclough
Comment 1 2008-12-22 22:11:44 PST
Created attachment 26224 [details] The patch
Oliver Hunt
Comment 2 2008-12-22 22:18:19 PST
Comment on attachment 26224 [details] The patch ASSERT(m_freePtr < m_end); should be ASSERT(m_freePtr <= m_end);
Gavin Barraclough
Comment 3 2008-12-22 23:09:18 PST
Sending JavaScriptCore/ChangeLog Sending JavaScriptCore/jit/ExecutableAllocator.h Transmitting file data .. Committed revision 39450.
Note You need to log in before you can comment on or make changes to this bug.