Closed Bug 1308193 Opened 4 years ago Closed 3 years ago
Builder::compute Heap Type can return stack memory
According to clang's static analysis, https://hg.mozilla.org/mozilla-central/file/da986c9f1f72/js/src/jit/IonBuilder.cpp#l9741 appears to return stack-allocated memory. nbp says this is a false positive because "basically TypeSet::unionSets allocates a new TemporaryTypeSet, and the guards above the acc are guarding that we enter the loop." Since this is identified as a severe vulnerability by static analysis, it would be great if the code could be rewritten to avoid the false positive.
Might indeed be good to get this fixed. I think it should be straight forward to fix? Let's do it. Putting this as P2 to get it this or next release.
Priority: -- → P2
Browsing through old bugs.
Attachment #8888933 - Flags: review?(nicolas.b.pierron)
Attachment #8888933 - Flags: review?(nicolas.b.pierron) → review+
Pushed by firstname.lastname@example.org: https://hg.mozilla.org/integration/mozilla-inbound/rev/8e1e06adf80f Reorganize code that looks like it could return a stack address. r=nbp
You need to log in before you can comment on or make changes to this bug.