This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch base-browser-102.5.0esr-12.0-1 in repository tor-browser.
commit bdedfc85a7b1ce23a09ca0a021643e7198231f90 Author: Jon Coppeard jcoppeard@mozilla.com AuthorDate: Mon Oct 17 17:09:07 2022 +0000
Bug 1791975 - Don't sweep realms that were allocated during incremental GC r=jandem, a=dmeehan
When marking a BaseShape we mark its global, and we read the pointer to that global from the realm. If a realm doesn't have a live global we can sweep the realm but there may still be pointers to it in base shapes and these are left dangling.
This happens when we hit OOM while creating a global during an incremental GC. The BaseShape survives because it was allocated after the start of the GC. The global itself is never successfully created and so the realm doesn't have a live global and is swept. In this case, we trigger UAF when we try to compact the heap and trace the base shape.
The patch adds an extra case for keeping a realm alive if it was created during an incremental GC. This matches the way that GC things are not collected if they are allocated after the start of a GC.
Differential Revision: https://phabricator.services.mozilla.com/D158022 --- js/src/gc/GC.cpp | 3 +++ js/src/vm/Realm-inl.h | 11 ++++++++--- js/src/vm/Realm.cpp | 2 ++ js/src/vm/Realm.h | 2 ++ 4 files changed, 15 insertions(+), 3 deletions(-)
diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp index 704b93675e0d..d0865f5018fc 100644 --- a/js/src/gc/GC.cpp +++ b/js/src/gc/GC.cpp @@ -2802,6 +2802,9 @@ void GCRuntime::finishCollection() { for (GCZonesIter zone(this); !zone.done(); zone.next()) { zone->changeGCState(Zone::Finished, Zone::NoGC); zone->notifyObservingDebuggers(); + for (RealmsInZoneIter realm(zone); !realm.done(); realm.next()) { + realm->clearAllocatedDuringGC(); + } }
#ifdef JS_GC_ZEAL diff --git a/js/src/vm/Realm-inl.h b/js/src/vm/Realm-inl.h index bc7c44f10a2e..a4d16fe76256 100644 --- a/js/src/vm/Realm-inl.h +++ b/js/src/vm/Realm-inl.h @@ -36,9 +36,14 @@ inline bool JS::Realm::hasLiveGlobal() const { }
inline bool JS::Realm::marked() const { - // Preserve this Realm if it has a live global or if it has been entered (to - // ensure we don't destroy the Realm while we're allocating its global). - return hasLiveGlobal() || hasBeenEnteredIgnoringJit(); + // The Realm survives in the following cases: + // - its global is live + // - it has been entered (to ensure we don't destroy the Realm while we're + // allocating its global) + // - it was allocated after the start of an incremental GC (as there may be + // pointers to it from other GC things) + return hasLiveGlobal() || hasBeenEnteredIgnoringJit() || + allocatedDuringIncrementalGC_; }
/* static */ inline js::ObjectRealm& js::ObjectRealm::get(const JSObject* obj) { diff --git a/js/src/vm/Realm.cpp b/js/src/vm/Realm.cpp index 006c29677c44..597d0a2ef898 100644 --- a/js/src/vm/Realm.cpp +++ b/js/src/vm/Realm.cpp @@ -61,6 +61,8 @@ Realm::Realm(Compartment* comp, const JS::RealmOptions& options) objects_(zone_), randomKeyGenerator_(runtime_->forkRandomKeyGenerator()), debuggers_(zone_), + allocatedDuringIncrementalGC_(zone_->isGCMarkingOrSweeping() || + zone_->isGCFinished()), wasm(runtime_) { runtime_->numRealms++; } diff --git a/js/src/vm/Realm.h b/js/src/vm/Realm.h index f411d9f8f443..63806cee7b38 100644 --- a/js/src/vm/Realm.h +++ b/js/src/vm/Realm.h @@ -393,6 +393,7 @@ class JS::Realm : public JS::shadow::Realm { friend class js::AutoRestoreRealmDebugMode;
bool isSystem_ = false; + bool allocatedDuringIncrementalGC_;
js::UniquePtrjs::coverage::LCovRealm lcovRealm_ = nullptr;
@@ -590,6 +591,7 @@ class JS::Realm : public JS::shadow::Realm { }
inline bool marked() const; + void clearAllocatedDuringGC() { allocatedDuringIncrementalGC_ = false; }
/* * The principals associated with this realm. Note that the same several