Re: speculative buffer overrun in SpiderMonkey

On 16/01/2018 15:16, Luis Longeri wrote:
> I just limit the indexing using a modulo operator, since the MOZ_ASSERT
> check could be delayed by the CPU by a cache miss, I am enforcing a limit
> on the index so if the indexing runs speculatively it will still be within
> limits prior to being discarded. These indexing functions are called from
> places where the index is checked with 'if' statements but those
> evaluations can also be delayed by the CPU allowing for an speculative
> execution of an overflow.

I suspect that you're not testing what you intend to test. By design,
MOZ_ASSERT code is only executed in DEBUG builds, so it's not something
that can be exploited in a Meltdown/Specter scenario.

I *think* that the code you're looking for is actually in
`NativeObject::getSlot`.

Cheers,
 David