2000640 - WeakMap::Ptr may allow bypassing barriers

Status: RESOLVED FIXED

(Core :: JavaScript: GC, task, P3)

Description

[Jon Coppeard (:jonco)]

I don't think this happens anywhere but right now you can lookup a key in a WeakMap to get a Ptr and this gives you mutable access to the underlying hash table entry. This potentially allows code to bypass the barrier that maintains information about which keys and values are in the nursery.

We should restrict this API to make this impossible.

Comment 1

[Jon Coppeard (:jonco)]

Attachment: Bug 2000640 - Restrict mutable access to weak map hash table entries maps via use of Ptr/AddPtr r?#spidermonkey-reviewers

Currently it's possible to modify the hash table entry and bypass the barriers
we rely on for correctness.

This patch wraps the raw Ptr/AddPtrs from the hash map in versions that only
return const references to the hash table entries.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/600e9b0e54b1
https://hg.mozilla.org/integration/autoland/rev/941aff9e24f1
Restrict mutable access to weak map hash table entries maps via use of Ptr/AddPtr r=spidermonkey-reviewers,sfink

Comment 3

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/941aff9e24f1