998129 - Do not read from the main heap while running off the main thread

Status: RESOLVED DUPLICATE of bug 1181255

(Core :: JavaScript Engine: JIT, defect)

Description

[Terrence Cole [:terrence]]

In bug 995649, I am attempting to implement a diagnostic where we mprotect the full gc heap with PROT_NONE any time we leave a request. The goal here is to quickly identify any places in the browser that accidentally scribble over our memory, resulting in GC crashes.

Unfortunately, this has identified a number of places where we access the heap from  background compilation. Luckily, these all seem to be safe accesses to constants in the compiling script or the runtime, so are not vulnerable.

Comment 1

[Luke Wagner [:luke]]

If you want to catch scribbling, could you use PROT_READ?

Comment 2

[Terrence Cole [:terrence]]

(In reply to Luke Wagner [:luke] from comment #1)
> If you want to catch scribbling, could you use PROT_READ?

I was also hoping to catch improper reads as a side-effect -- you're right though, we could use PROT_READ to ship most of the protection right now and clean up these innocuous reads later

Comment 3

[Terrence Cole [:terrence]]

The correct solution here is to get TSAN running on try.