1285034 - GlobalObject's compartment's global may be null when tracing

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Terrence Cole [:terrence]]

This can happen if we GC at the wrong place in GlobalObject::create. This would be "fine" except that JSCompartment::global() returns a reference. It is undefined behavior to have a nullptr as a reference, so the compiler is allowed to (and probably does) assume that the reference is non-null. Luckily, the only thing we're using the reference for in the case it's null is to compare to |this|. Since the pointer and reference have the same internal representation and the compiler can't use our mistake to optimize the comparison, I think this will not result in incorrect logic, probably. At least not at the moment.

To fix this I've added a new globalForTracing that returns a pointer and made both it an isOwnGlobal take a JSTracer; this should at least make sure the madness stays restricted to the GC.

Comment 1

[Terrence Cole [:terrence]]

Attachment: ubisan-null-reference-v0.diff

Comment 2

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b2354d420c2ca6b8ecef1c8cc7a1ed17cca6e1bf
Bug 1285034 - Do not create a null reference when tracing; r=jonco

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b2354d420c2c