[go: nahoru, domu]

Closed Bug 1285035 Opened 8 years ago Closed 5 years ago

Fix undefined behavior from misaligned writes in the assembler

Categories

(Core :: JavaScript Engine: JIT, defect, P5)

defect

Tracking

()

RESOLVED DUPLICATE of bug 1260660
Tracking Status
firefox50 --- affected

People

(Reporter: terrence, Unassigned)

References

(Blocks 1 open bug)

Details

I'm not sure if any of the following reports are particularly dangerous, but they looks simple enough to make well defined. Jan, could you take a look? 0x7ffce7f12d3d: note: pointer points here 3b e0 0f 84 00 00 00 00 2e f1 e7 fc 7f 00 00 38 2e f1 e7 fc 7f 00 00 e0 37 f1 e7 fc 7f 00 00 e0 ^ /home/terrence/moz/branch/w/js/src/jit/x86-shared/Patching-x86-shared.h:36:12: runtime error: load of misaligned address 0x7ffce7f12dd3 for type 'const int32_t' (aka 'const int'), which requires 4 byte alignment 0x7ffce7f12dd3: note: pointer points here c4 0f 0f 84 ff ff ff ff cc c1 08 cf 00 00 00 00 00 20 31 f1 e7 fc 7f 00 00 f0 c5 0e 0a 00 00 00 ^ /home/terrence/moz/branch/w/js/src/jit/x86-shared/Assembler-x86-shared.h:3557:9: runtime error: load of misaligned address 0x7fab88a2f72a for type 'uintptr_t' (aka 'unsigned long'), which requires 8 byte alignment 0x7fab88a2f72a: note: pointer points here 0d 0a 49 bb ff ff ff ff ff ff ff ff 41 53 6a 00 85 c0 0f 84 37 00 00 00 83 f8 01 0f 84 0c 01 00 ^ /home/terrence/moz/branch/w/js/src/jit/x86-shared/Assembler-x86-shared.h:3558:9: runtime error: store to misaligned address 0x7fab88a2f72a for type 'uintptr_t' (aka 'unsigned long'), which requires 8 byte alignment 0x7fab88a2f72a: note: pointer points here 0d 0a 49 bb ff ff ff ff ff ff ff ff 41 53 6a 00 85 c0 0f 84 37 00 00 00 83 f8 01 0f 84 0c 01 00 ^ /home/terrence/moz/branch/w/js/src/jit/x86-shared/Patching-x86-shared.h:30:5: runtime error: store to misaligned address 0x7fab88a2fcf5 for type 'const void *', which requires 8 byte alignment 0x7fab88a2fcf5: note: pointer points here 55 10 48 b8 00 00 00 00 00 00 00 00 50 55 48 83 ec 30 48 8b ec 48 8b da c1 e3 03 48 2b e3 48 83 ^
Jan says report probably originates from ASAN. For the x86 assembler this should be both innocuous and expected (backpatching).
Priority: -- → P5
The problem is that this is still undefined behavior (correct C++ is to use a `memcpy`)

It looks like these were addressed by bug 1260660.

Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.