Skip to content

iOS 16 support - stalker-arm64: Refresh code_available after helper pass#1105

Closed
ignuslabs wants to merge 1 commit intofrida:mainfrom
ignuslabs:fix/stalker-slab-available-refresh
Closed

iOS 16 support - stalker-arm64: Refresh code_available after helper pass#1105
ignuslabs wants to merge 1 commit intofrida:mainfrom
ignuslabs:fix/stalker-slab-available-refresh

Conversation

@ignuslabs
Copy link
Copy Markdown

@oleavr addressing the issue frida/frida#3719 part 1/2

Problem

gum_exec_block_maybe_create_new_code_slabs invokes
gum_exec_ctx_ensure_inline_helpers_reachable after allocating new code
and slow slabs. That helper can advance the code slab cursor, but the
caller continues to use its previously-computed code_available value,
which is now stale. Any subsequent logic that budgets against
code_available will operate on an out-of-date figure.

Fix

Refresh code_available from gum_slab_available(&ctx->code_slab->slab)
immediately after the helper reachability pass, so downstream budgeting
reflects the true remaining space.

Testing

  • Builds clean on macOS arm64 with MACOS_CERTID=- make in the top-level
    frida tree, which drives the full gum + frida-core + gumjs build.
  • The refreshed-value path is exercised by the existing
    stalker-arm64 test suite on arm64 hosts.

  gum_exec_ctx_ensure_inline_helpers_reachable can advance the code
  slab cursor, which leaves the caller's previously-computed
  code_available value stale. Refresh it from the slab so any
  subsequent budgeting reflects the true remaining space.
/* Updating available code space matters if ensure_inline_helpers_reachable
* advances the code slab cursor/size but the caller reuses the previous
* code availability calculation. */
code_available = gum_slab_available (&ctx->code_slab->slab);
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, given that gum_slab_available() has no side-effects, and code_available isn't used after this point in this function, I don't see how this patch helpers. Am I missing something?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like AI slop from testing my bad

@oleavr oleavr closed this May 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants