ion::IonBuilder::getPropTryConstant masks error in Ion Inline Caches

RESOLVED FIXED in mozilla25

Status

()

Core
JavaScript Engine
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: efaust, Assigned: efaust)

Tracking

unspecified
mozilla25
x86_64
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

4 years ago
If you comment out the tryConstant optimization through the TryInlineAccess optimization in jsop_getprop(), you will notice that the jit-test parallel/Array-mapPar-nested.js fails because it gets the wrong value from the IC.

Marking security as I don't know the full repercussions.
(Assignee)

Comment 1

4 years ago
Created attachment 785160 [details] [diff] [review]
fix

The problem actually wasn't in the ICs. When we have a clone at a callsite, and replace the input operand with a constant, we neglect to ensure that the operand that was supposed to be used actually has a use at the callsite, and thus doesn't get removed from the resume point, where it will later be observed on an ill-timed bailout. Though reproducing this bug required commenting out some code (we don't replace constants with undefined in the resume point because it makes little sense), it should still be reproducible with a more complicated testcase.

I do not believe that there are security implications of this bug.
Assignee: general → efaustbmo
Status: NEW → ASSIGNED
Attachment #785160 - Flags: review?(bhackett1024)
Attachment #785160 - Flags: review?(bhackett1024) → review+
Group: core-security
(Assignee)

Comment 2

4 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/25f9ed87069c
https://hg.mozilla.org/mozilla-central/rev/25f9ed87069c
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.