1308193 - IonBuilder::computeHeapType can return stack memory

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Gregory Szorc [:gps]]

According to clang's static analysis, https://hg.mozilla.org/mozilla-central/file/da986c9f1f72/js/src/jit/IonBuilder.cpp#l9741 appears to return stack-allocated memory.

nbp says this is a false positive because "basically TypeSet::unionSets allocates a new TemporaryTypeSet, and the guards above the acc are guarding that we enter the loop."

Since this is identified as a severe vulnerability by static analysis, it would be great if the code could be rewritten to avoid the false positive.

Comment 1

[Hannes Verschore [:h4writer]]

Might indeed be good to get this fixed. I think it should be straight forward to fix? Let's do it. Putting this as P2 to get it this or next release.

Comment 2

[Sean Stangl [:sstangl]]

Attachment: 0001-Reorganize-code-that-looks-like-it-could-return-a-st.patch

Browsing through old bugs.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8e1e06adf80f
Reorganize code that looks like it could return a stack address. r=nbp

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/8e1e06adf80f