Skip to content
Snippets Groups Projects
  1. May 29, 2023
  2. May 10, 2023
  3. May 18, 2023
  4. Apr 25, 2023
  5. Apr 21, 2023
  6. Mar 24, 2023
  7. Apr 18, 2023
  8. Apr 11, 2023
  9. Mar 24, 2023
  10. Mar 27, 2023
  11. Mar 29, 2023
  12. Mar 21, 2023
  13. Mar 15, 2023
  14. Feb 27, 2023
  15. Feb 13, 2023
  16. Feb 14, 2023
  17. Jan 27, 2023
  18. Jan 24, 2023
  19. Oct 18, 2022
  20. Dec 01, 2022
  21. Nov 18, 2022
  22. Nov 19, 2022
  23. Nov 04, 2022
  24. Nov 03, 2022
  25. Nov 02, 2022
  26. Oct 26, 2022
  27. Oct 17, 2022
    • Jon Coppeard's avatar
      Bug 1791975 - Don't sweep realms that were allocated during incremental GC r=jandem, a=dmeehan · bdedfc85
      Jon Coppeard authored
      When marking a BaseShape we mark its global, and we read the pointer to that
      global from the realm. If a realm doesn't have a live global we can sweep the
      realm but there may still be pointers to it in base shapes and these are left
      dangling.
      
      This happens when we hit OOM while creating a global during an incremental GC.
      The BaseShape survives because it was allocated after the start of the GC. The
      global itself is never successfully created and so the realm doesn't have a
      live global and is swept. In this case, we trigger UAF when we try to compact
      the heap and trace the base shape.
      
      The patch adds an extra case for keeping a realm alive if it was created during
      an incremental GC. This matches the way that GC things are not collected if
      they are allocated after the start of a GC.
      
      Differential Revision: https://phabricator.services.mozilla.com/D158022
      bdedfc85
  28. Oct 06, 2022
  29. Sep 21, 2022
  30. Sep 19, 2022
  31. Sep 06, 2022
  32. Jul 28, 2022
  33. Aug 19, 2022
  34. Aug 03, 2022
Loading