nanojit StackFilter assumes that all SideExits are VMSideExits

RESOLVED WONTFIX

Status

Core Graveyard
Nanojit
RESOLVED WONTFIX
9 years ago
4 years ago

People

(Reporter: Michael Sullivan, Unassigned)

Tracking

unspecified
Future

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

9 years ago
User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.11) Gecko/2009060309 Ubuntu/9.04 (jaunty) Firefox/3.0.11
Build Identifier: 

The function nanojit::StackFilter::getTop (in jstracer.cpp) gets a SideExit * out of a GuardRecord and then casts it to a (VMSideExit *) and accesses fields only present in VMSideExit. It SideExit is not actually a VMSideExit (as is the case with the regexp compiler or my in-progress inline threading work), this can cause problems.

If a SideExit falls near the end of a page, accessing the field could cause a crash.

Reproducible: Always

Updated

8 years ago
Target Milestone: --- → Future

Updated

8 years ago
Component: JIT Compiler (NanoJIT) → Nanojit
Product: Tamarin → Core
QA Contact: nanojit → nanojit
The only reference to SideExit comes from a jit-test. Closing as nanojit is long gone.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → WONTFIX
(Assignee)

Updated

4 years ago
Component: Nanojit → Nanojit
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.