MacroAssemblerX64::handleFailureWithHandlerTail load a 32 bits value as 64 bits.

RESOLVED FIXED in Firefox 54

Status

()

Core
JavaScript Engine: JIT
P1
normal
RESOLVED FIXED
11 months ago
11 months ago

People

(Reporter: nbp, Assigned: h4writer, Mentored)

Tracking

unspecified
mozilla54
Points:
---

Firefox Tracking Flags

(firefox54 fixed)

Details

Attachments

(1 attachment)

(Reporter)

Description

11 months ago
The issue is located here:

http://searchfox.org/mozilla-central/rev/225ab0637ed51b8b3f9f4ee2f9c339a37a65b626/js/src/jit/x64/MacroAssembler-x64.cpp#314

We should do a load32 instead of loadPtr, as ResumeFromException::kind is only 4 bytes long.

Fortunately, this is not a security issue as the only uses are in the branch32 functions.
(Assignee)

Updated

11 months ago
Priority: -- → P1
(Assignee)

Comment 1

11 months ago
Created attachment 8830253 [details] [diff] [review]
Patch
Assignee: nobody → hv1989
Attachment #8830253 - Flags: review?(nicolas.b.pierron)
(Reporter)

Updated

11 months ago
Attachment #8830253 - Flags: review?(nicolas.b.pierron) → review+

Comment 2

11 months ago
Pushed by hv1989@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/30581ce4c956
IonMonkey: Only load 32bits for ResumeFromException::kind instead of 64bits on x64, r=nbp

Comment 3

11 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/30581ce4c956
Status: NEW → RESOLVED
Last Resolved: 11 months ago
status-firefox54: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla54
You need to log in before you can comment on or make changes to this bug.