1285035 - Fix undefined behavior from misaligned writes in the assembler

Status: RESOLVED DUPLICATE of bug 1260660

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[Terrence Cole [:terrence]]

I'm not sure if any of the following reports are particularly dangerous, but they looks simple enough to make well defined. Jan, could you take a look?

0x7ffce7f12d3d: note: pointer points here
 3b e0 0f 84 00 00 00  00 2e f1 e7 fc 7f 00 00  38 2e f1 e7 fc 7f 00 00  e0 37 f1 e7 fc 7f 00 00  e0
             ^ 
/home/terrence/moz/branch/w/js/src/jit/x86-shared/Patching-x86-shared.h:36:12: runtime error: load of misaligned address 0x7ffce7f12dd3 for type 'const int32_t' (aka 'const int'), which requires 4 byte alignment
0x7ffce7f12dd3: note: pointer points here
 c4  0f 0f 84 ff ff ff ff cc  c1 08 cf 00 00 00 00 00  20 31 f1 e7 fc 7f 00 00  f0 c5 0e 0a 00 00 00
              ^ 
/home/terrence/moz/branch/w/js/src/jit/x86-shared/Assembler-x86-shared.h:3557:9: runtime error: load of misaligned address 0x7fab88a2f72a for type 'uintptr_t' (aka 'unsigned long'), which requires 8 byte alignment
0x7fab88a2f72a: note: pointer points here
 0d 0a  49 bb ff ff ff ff ff ff  ff ff 41 53 6a 00 85 c0  0f 84 37 00 00 00 83 f8  01 0f 84 0c 01 00
              ^ 
/home/terrence/moz/branch/w/js/src/jit/x86-shared/Assembler-x86-shared.h:3558:9: runtime error: store to misaligned address 0x7fab88a2f72a for type 'uintptr_t' (aka 'unsigned long'), which requires 8 byte alignment
0x7fab88a2f72a: note: pointer points here
 0d 0a  49 bb ff ff ff ff ff ff  ff ff 41 53 6a 00 85 c0  0f 84 37 00 00 00 83 f8  01 0f 84 0c 01 00
              ^ 
/home/terrence/moz/branch/w/js/src/jit/x86-shared/Patching-x86-shared.h:30:5: runtime error: store to misaligned address 0x7fab88a2fcf5 for type 'const void *', which requires 8 byte alignment
0x7fab88a2fcf5: note: pointer points here
 55 10 48 b8 00 00 00  00 00 00 00 00 50 55 48  83 ec 30 48 8b ec 48 8b  da c1 e3 03 48 2b e3 48  83
             ^

Comment 1

[Lars T Hansen [:lth]]

Jan says report probably originates from ASAN.

For the x86 assembler this should be both innocuous and expected (backpatching).

Comment 2

[demiobenour]

The problem is that this is still undefined behavior (correct C++ is to use a `memcpy`)

Comment 3

[(Away)]

It looks like these were addressed by bug 1260660.