Skip to content

Conversation

@bluecataudio
Copy link

I have found a bug in the JIT that crashes the VM when a native function exposed to the scripts both returns a reference or handle value and suspends the execution of the VM: if the execution is not continued before releasing the context, the VM crashes, because the object type register is set random memory.

This is because the JIT does not set the object type during a system call (it only sets the objectRegister). It probably works in standard scenarios because the asBC_STOREOBJ instruction is called right after, but if execution is suspended during the system call, the VM is in an unstable state.

Here is a proposal to fix this issue, simply setting the objectType pointer together with the objectRegister. Tested on Windows only so far, but it is probably not impacting other platforms either.

When calling a function that returns a reference or handle thru a system
call, the objectType field is not set. So if the function that is called
suspends execution, the state of the VM is incomplete (objectType is
garabe). This leads to a crash if the context is cleaned up, unless
execution is continued.
@bluecataudio
Copy link
Author

The fix has now also been validated on Mac (XCode4 and XCode7, 10.7 SDK).

- removed asBC_STR instruction support (deprecated in angelscript 2.32)
- fixed crash when compiling  copy instructions for objects without
addref/release defined
@bluecataudio
Copy link
Author

Added new fixes for Angelscript 2.33.0 compatibility

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant