691873 - js::types::TypeCompartment::addPending can write off end of pendingArray if OOM

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jim Blandy :jimb]

In TypeCompartment::addPending, we say:

    if (pendingCount == pendingCapacity)
        growPendingArray(cx);

    PendingWork &pending = pendingArray[pendingCount++];
    pending.constraint = constraint;
    pending.source = source;
    pending.type = type;

If growPendingArray fails because of OOM, then the writes to pending's referent's members are writing off the end of the array.

It looks as if, once pendingCount > pendingCapacity, we won't try to call growPendingArray any more, and all subsequent addPending calls will write off the end of that array, so we might be able to reach pretty far.

Comment 1

[Daniel Veditz [:dveditz]]

sg:critical? assuming growPendingArray refers to the kind of array a web script can create and grow to an arbitrary size.

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

Great catch, this was pretty braindead.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1eca7dca8152

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 565074 [details] [diff] [review]
patch

Approved for aurora per today's triage meeting.

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/mozilla-central/rev/1eca7dca8152

(This has been on m-c for several days but the bug wasn't updated).

https://hg.mozilla.org/releases/mozilla-aurora/rev/781ed08803ea

Comment 6

[Johnny Stenback (:jst)]

Fixed in 9 and 10 per previous comment.

Comment 7

[u279076]

Is there something QA can do to verify this fix?