Bug 22974 – Fix rounding / bounds / signed comparison bug in ExecutableAllocator.

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Gavin Barraclough]

ExecutableAllocator ::alloc assumed that m_freePtr would be aligned.  This was not always true, since the first allocation from an additional pool would not be rounded up.  Subsequent allocations would be unaligned, and too much memory could be erroneously allocated from the pool, when the size requested was available, but the size rounded up to word granularity was not available in the pool.  This may result in the value of m_freePtr being greater than m_end.

Under these circumstances, the unsigned check for space will always pass, resulting in pointers to memory outside of the arena being returned, and ultimately segfaulty goodness when attempting to memcpy the hot freshly jitted code from the AssemblerBuffer.

[Gavin Barraclough]

Created attachment 26224 [details]
The patch

[Oliver Hunt]

Comment on attachment 26224 [details]
The patch

ASSERT(m_freePtr < m_end); should be ASSERT(m_freePtr <= m_end);

[Gavin Barraclough]

Sending        JavaScriptCore/ChangeLog
Sending        JavaScriptCore/jit/ExecutableAllocator.h
Transmitting file data ..
Committed revision 39450.