Skip to content

Conversation

@Saadnajmi
Copy link
Contributor

Upstreaming an internal change we made to JSCRuntime.cpp that I'm fairly confident in.

--- Original PR notes ---

ASAN stores stack values in a shadow stack separate from the "true" stack of the thread, which prevents JavaScriptCore's GC from finding those values. This can lead to premature freeing of objects and weird crashes.

Thankfully, we don't directly talk to JSC. We only talk to it through JSI which only ever briefly keeps JSC values on the stack, and only in very specific functions/methods. Instead of turning off ASAN or its stack use-after-free checking for the entire process, we can annotate just those few spots in JSI to tell Clang to avoid ASAN instrumentation for them to avoids these GC issues while keeping ASAN on everywhere else.

This change does not impact shipping bits. It uses an #if to ensure only builds with ASAN enabled (i.e., debug) are impacted.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant