1743234 - Null check from BoxValue_AnyRef must consider the whole pointer

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P3)

Description

[Lars T Hansen [:lth]]

If the boxing succeeds but the box is allocated on a 4GB address boundary on a 64-bit system, we will erroneously jump to the throw label because the null check considers only the low 32 bits of the return value. No error will have been reported, so we may end up reporting OOM (uncertain). This is way obscure and was found by inspection in the aftermath of another problem, see eg bug 1742053 comment 26.

Comment 1

[Lars T Hansen [:lth]]

Attachment: Bug 1743234 - Null pointer test must check the whole pointer. r?rhunt

The return value of the boxing is a pointer, not a 32-bit value, and
we must check the whole pointer for null.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/54664793b10f
Null pointer test must check the whole pointer. r=rhunt

Comment 3

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/54664793b10f