Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix unsafe AtomicRefCell<T> transmutes in Layout component #16833

Merged
merged 1 commit into from May 13, 2017

Conversation

MortimerGoro
Copy link
Contributor

@MortimerGoro MortimerGoro commented May 12, 2017

Fixes unsafe transmute between AtomicRefCell<PersistentLayoutData> and AtomicRefCell<PartialPersistentLayoutData> which have different memory alignment in 32 bit archs leading to SEGV crashes. See #16817 and #16816

mem::align_of values in 32 bit archs (e.g. Android):

PersistentLayoutData 8
PersistentLayoutData 4
AtomicRefCell<PersistentLayoutData> 8
AtomicRefCell<PartialPersistentLayoutData> 4

mem::align_of values in 64 bit archs

PersistentLayoutData 8
PersistentLayoutData 8
AtomicRefCell<PersistentLayoutData> 8
AtomicRefCell<PartialPersistentLayoutData> 8

  • There are tests for these changes OR
  • These changes do not require tests because _____

This change is Reviewable

@highfive
Copy link

Heads up! This PR modifies the following files:

  • @KiChjang: components/script_layout_interface/lib.rs
  • @fitzgen: components/script_layout_interface/lib.rs
  • @emilio: components/layout/lib.rs

@highfive highfive added the S-awaiting-review There is new code that needs to be reviewed. label May 12, 2017

// Required alignment in 32 bit architectures for safe
// transmute between PersistentLayoutData and PartialPersistentLayoutData.
#[cfg(target_pointer_width = "32")] _align: u64
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not have this dummy field unconditionally?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Or, better yet, make it a [u64; 0], which affects alignment without size penalties.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did that way as a size optimization. Do you think that it isn't worth it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@emilio nice! I didn't know that

@SimonSapin
Copy link
Member

Nice one @emilio, for [u64; 0] :)

@bors-servo r+

@bors-servo
Copy link
Contributor

📌 Commit 593e890 has been approved by SimonSapin

@highfive highfive assigned SimonSapin and unassigned nox May 12, 2017
@highfive highfive added S-awaiting-merge The PR is in the process of compiling and running tests on the automated CI. and removed S-awaiting-review There is new code that needs to be reviewed. labels May 12, 2017
@bors-servo
Copy link
Contributor

⌛ Testing commit 593e890 with merge 47e4c48...

bors-servo pushed a commit that referenced this pull request May 13, 2017
Fix unsafe AtomicRefCell<T>  transmutes in Layout component

<!-- Please describe your changes on the following line: -->

Fixes unsafe transmute between `AtomicRefCell<PersistentLayoutData>` and `AtomicRefCell<PartialPersistentLayoutData>` which have different memory alignment in 32 bit archs leading to SEGV crashes. See #16817 and #16816

mem::align_of values in 32 bit archs (e.g. Android):
```
PersistentLayoutData 8
PersistentLayoutData 4
AtomicRefCell<PersistentLayoutData> 8
AtomicRefCell<PartialPersistentLayoutData> 4
```
mem::align_of values in 64 bit archs
```
PersistentLayoutData 8
PersistentLayoutData 8
AtomicRefCell<PersistentLayoutData> 8
AtomicRefCell<PartialPersistentLayoutData> 8
```

---
<!-- Thank you for contributing to Servo! Please replace each `[ ]` by `[X]` when the step is complete, and replace `__` with appropriate data: -->
- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] These changes fix #16817 (github issue number if applicable).

<!-- Either: -->
- [x] There are tests for these changes OR
- [ ] These changes do not require tests because _____

<!-- Also, please make sure that "Allow edits from maintainers" checkbox is checked, so that we can help you if you get stuck somewhere along the way.-->

<!-- Pull requests that do not address these steps are welcome, but they will require additional verification as part of the review process. -->

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/16833)
<!-- Reviewable:end -->
@bors-servo
Copy link
Contributor

☀️ Test successful - android, arm32, arm64, linux-dev, linux-rel-css, linux-rel-wpt, mac-dev-unit, mac-rel-css, mac-rel-wpt1, mac-rel-wpt2, windows-msvc-dev
Approved by: SimonSapin
Pushing 47e4c48 to master...

@bors-servo bors-servo merged commit 593e890 into servo:master May 13, 2017
@highfive highfive removed the S-awaiting-merge The PR is in the process of compiling and running tests on the automated CI. label May 13, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Unsafe AtomicRefCell<T> transmute in Layout component
6 participants