Closed Bug 1501301 Opened 10 months ago Closed 10 months ago
Enter JIT pushes too many arguments
46 bytes, text/x-phabricator-request
|Details | Review|
This loop https://dxr.mozilla.org/mozilla-central/rev/c291143e24019097d087f9307e59b49facaf90cb/js/src/jit/arm64/Trampoline-arm64.cpp#134 repeats while tmp_argc >= 0, which means we actually push tmp_argc+1 arguments. This leads to crashes on Windows when argv falls exactly at the end of its allocation region and the extra iteration reads from unmapped memory.
The code was looping one too many times.
Pushed by email@example.com: https://hg.mozilla.org/integration/autoland/rev/57e435f97c30 Fix the argv loop in aarch64 generateEnterJIT r=sstangl
You need to log in before you can comment on or make changes to this bug.