Closed Bug 1406815 Opened 7 years ago Closed 7 years ago

stylo: hard-assert more invariants in HashMap

Categories

(Core :: CSS Parsing and Computation, enhancement)

enhancement
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla58
Tracking Status
firefox-esr52 --- unaffected
firefox56 --- disabled
firefox57 --- wontfix
firefox58 --- fixed

People

(Reporter: bholley, Assigned: bholley)

References

(Blocks 1 open bug)

Details

(Keywords: sec-other, Whiteboard: [adv-main58-][post-critsmash-triage])

Attachments

(2 files)

I'm still hoping to catch something interesting with the canaries in bug 1406220. However, while it's still a bit too soon to say, we have some partial indicators that we're crashing on non-poison-valued garbage addresses even after bug 1405879. Having also ruled out external corruption of our buffer via bug 1403397, the only remaining explanation I can think of is that we're somehow accessing memory outside of our buffer. We should be able to detect this with some hard-asserts around RawBucket.
MozReview-Commit-ID: H8jKywUewcZ
Attachment #8916459 - Flags: review?(manishearth)
Attachment #8916459 - Flags: review?(manishearth) → review+
Attached file interdiff
Had to add a few fixes for orange found on try. At least the asserts are thorough. :-)
Attachment #8916494 - Flags: review?(manishearth)
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Keywords: sec-other
Group: core-security → core-security-release
Target Milestone: --- → mozilla58
Attachment #8916494 - Flags: review?(manishearth)
Whiteboard: [adv-main57-]
Whiteboard: [adv-main57-] → [adv-main58-]
Flags: qe-verify-
Whiteboard: [adv-main58-] → [adv-main58-][post-critsmash-triage]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: