• Leszek Swirski's avatar
    [runtime] Fix sandboxing violation in CopyDataPropertiesWithExclProp · d05a38f9
    Leszek Swirski authored
    The newly optimised CopyDataPropertiesWithExcludedProperties acceses the
    excluded properties directly on the stack, to avoid pushing them twice.
    This meant that we had to pass a stack pointer into the runtime, which
    we couldn't do directly because all arguments to runtime functions
    should be tagged.
    
    We tried to work around this by passing the stack pointer in a Foreign,
    but this violated the V8 sandbox. Fortunately, the stack pointer is
    aligned, so it looks like a Smi to the GC. So, we can pass it directly
    on the stack as a runtime argument but doing a bit of bitcasting.
    
    Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng
    Bug: v8:11614
    Change-Id: I87c4a34a15ae863277142aa29f48b1dd546014e0
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3497745
    Commit-Queue: Leszek Swirski <leszeks@chromium.org>
    Auto-Submit: Leszek Swirski <leszeks@chromium.org>
    Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
    Commit-Queue: Igor Sheludko <ishell@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#79369}
    d05a38f9
builtins-internal-gen.cc 54.3 KB