Skip to content

Conversation

@pleath
Copy link
Contributor

@pleath pleath commented Dec 22, 2016

ByteCodeGenerator::StartBindFunction uses a union in a way that allows a ParseableFunctionInfo to be accessed as though it were a FunctionBody. This led to memory corruption when redeferral changed the meaning of a flag that was meant to protect the accesses. Fixed by removing the union and the flag and using IsFunctionBody/GetFunctionBody to guard against illegal access.

…es a union in a way that allows a ParseableFunctionInfo to be accessed as though it were a FunctionBody. This led to memory corruption when redeferral changed the meaning of a flag that was meant to protect the accesses. Fixed by removing the union and the flag and using IsFunctionBody/GetFunctionBody to guard against illegal access.
@pleath
Copy link
Contributor Author

pleath commented Dec 22, 2016

@dotnet-bot please test Windows x86_debug

@pleath
Copy link
Contributor Author

pleath commented Dec 22, 2016

@rajatd, @digitalinfinity can either of you look at this one? (Thanks.)

@chakrabot chakrabot merged commit 7225686 into chakra-core:release/1.4 Dec 22, 2016
chakrabot pushed a commit that referenced this pull request Dec 22, 2016
Merge pull request #2273 from pleath:startbindfunction

ByteCodeGenerator::StartBindFunction uses a union in a way that allows a ParseableFunctionInfo to be accessed as though it were a FunctionBody. This led to memory corruption when redeferral changed the meaning of a flag that was meant to protect the accesses. Fixed by removing the union and the flag and using IsFunctionBody/GetFunctionBody to guard against illegal access.
chakrabot pushed a commit that referenced this pull request Dec 22, 2016
Merge pull request #2273 from pleath:startbindfunction

ByteCodeGenerator::StartBindFunction uses a union in a way that allows a ParseableFunctionInfo to be accessed as though it were a FunctionBody. This led to memory corruption when redeferral changed the meaning of a flag that was meant to protect the accesses. Fixed by removing the union and the flag and using IsFunctionBody/GetFunctionBody to guard against illegal access.
@digitalinfinity
Copy link
Contributor

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants