[tbb-commits] [tor-browser] 27/46: Bug 1791975 - Don't sweep realms that were allocated during incremental GC r=jandem, a=dmeehan

[gitolite role]

This is an automated email from the git hooks/post-receive script.

richard pushed a commit to branch base-browser-102.5.0esr-12.0-1
in repository tor-browser.

commit bdedfc85a7b1ce23a09ca0a021643e7198231f90
Author: Jon Coppeard <jcoppeard at mozilla.com>
AuthorDate: Mon Oct 17 17:09:07 2022 +0000

    Bug 1791975 - Don't sweep realms that were allocated during incremental GC r=jandem, a=dmeehan
    
    When marking a BaseShape we mark its global, and we read the pointer to that
    global from the realm. If a realm doesn't have a live global we can sweep the
    realm but there may still be pointers to it in base shapes and these are left
    dangling.
    
    This happens when we hit OOM while creating a global during an incremental GC.
    The BaseShape survives because it was allocated after the start of the GC. The
    global itself is never successfully created and so the realm doesn't have a
    live global and is swept. In this case, we trigger UAF when we try to compact
    the heap and trace the base shape.
    
    The patch adds an extra case for keeping a realm alive if it was created during
    an incremental GC. This matches the way that GC things are not collected if
    they are allocated after the start of a GC.
    
    Differential Revision: https://phabricator.services.mozilla.com/D158022
---
 js/src/gc/GC.cpp      |  3 +++
 js/src/vm/Realm-inl.h | 11 ++++++++---
 js/src/vm/Realm.cpp   |  2 ++
 js/src/vm/Realm.h     |  2 ++
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
index 704b93675e0d..d0865f5018fc 100644
--- a/js/src/gc/GC.cpp
+++ b/js/src/gc/GC.cpp
@@ -2802,6 +2802,9 @@ void GCRuntime::finishCollection() {
   for (GCZonesIter zone(this); !zone.done(); zone.next()) {
     zone->changeGCState(Zone::Finished, Zone::NoGC);
     zone->notifyObservingDebuggers();
+    for (RealmsInZoneIter realm(zone); !realm.done(); realm.next()) {
+      realm->clearAllocatedDuringGC();
+    }
   }
 
 #ifdef JS_GC_ZEAL
diff --git a/js/src/vm/Realm-inl.h b/js/src/vm/Realm-inl.h
index bc7c44f10a2e..a4d16fe76256 100644
--- a/js/src/vm/Realm-inl.h
+++ b/js/src/vm/Realm-inl.h
@@ -36,9 +36,14 @@ inline bool JS::Realm::hasLiveGlobal() const {
 }
 
 inline bool JS::Realm::marked() const {
-  // Preserve this Realm if it has a live global or if it has been entered (to
-  // ensure we don't destroy the Realm while we're allocating its global).
-  return hasLiveGlobal() || hasBeenEnteredIgnoringJit();
+  // The Realm survives in the following cases:
+  //  - its global is live
+  //  - it has been entered (to ensure we don't destroy the Realm while we're
+  //    allocating its global)
+  //  - it was allocated after the start of an incremental GC (as there may be
+  //    pointers to it from other GC things)
+  return hasLiveGlobal() || hasBeenEnteredIgnoringJit() ||
+         allocatedDuringIncrementalGC_;
 }
 
 /* static */ inline js::ObjectRealm& js::ObjectRealm::get(const JSObject* obj) {
diff --git a/js/src/vm/Realm.cpp b/js/src/vm/Realm.cpp
index 006c29677c44..597d0a2ef898 100644
--- a/js/src/vm/Realm.cpp
+++ b/js/src/vm/Realm.cpp
@@ -61,6 +61,8 @@ Realm::Realm(Compartment* comp, const JS::RealmOptions& options)
       objects_(zone_),
       randomKeyGenerator_(runtime_->forkRandomKeyGenerator()),
       debuggers_(zone_),
+      allocatedDuringIncrementalGC_(zone_->isGCMarkingOrSweeping() ||
+                                    zone_->isGCFinished()),
       wasm(runtime_) {
   runtime_->numRealms++;
 }
diff --git a/js/src/vm/Realm.h b/js/src/vm/Realm.h
index f411d9f8f443..63806cee7b38 100644
--- a/js/src/vm/Realm.h
+++ b/js/src/vm/Realm.h
@@ -393,6 +393,7 @@ class JS::Realm : public JS::shadow::Realm {
   friend class js::AutoRestoreRealmDebugMode;
 
   bool isSystem_ = false;
+  bool allocatedDuringIncrementalGC_;
 
   js::UniquePtr<js::coverage::LCovRealm> lcovRealm_ = nullptr;
 
@@ -590,6 +591,7 @@ class JS::Realm : public JS::shadow::Realm {
   }
 
   inline bool marked() const;
+  void clearAllocatedDuringGC() { allocatedDuringIncrementalGC_ = false; }
 
   /*
    * The principals associated with this realm. Note that the same several

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.