Open Bug 1993121 Opened 11 months ago Updated 21 days ago

[meta] Add release-mode bounds checking to Firefox C++ data structures

Categories

(Core :: XPCOM, task)

Product:
Core
Component:
XPCOM
Type:
task

Tracking

()

People

(Reporter: mccr8, Unassigned)

References

(Depends on 3 open bugs, Blocks 1 open bug)

Details

(Keywords: meta)

For better or for worse, Firefox has a lot of custom C++ data structures. Misuse of these data structures can lead to out-of-bounds memory safety problems. Therefore, one of the most efficient ways we have to improve the memory safety of Firefox is to add bounds checking to these data structures. The patches are rather small. The main danger is performance regressions, but clever compilers and powerful modern CPUs can usually deal with these highly predictable and often redundant branches without causing measurable performance regressions. The flagship for this effort, bug 1159244, added release mode bounds checking to nsTArray, and has prevented an untold number of security problems in the years since it was landed.

Blocks: 1993124
Summary: Add release-mode bounds checking to Firefox C++ data structures → [meta] Add release-mode bounds checking to Firefox C++ data structures
Depends on: 1993496
Depends on: 2003278
Depends on: 2028302
Depends on: 2024618
Depends on: 2034522

Release mode checks for discriminated union getters are another effective area for improvements here. I've added a few as blocking this bug.

Depends on: 2064198
You need to log in before you can comment on or make changes to this bug.