-
Samuel Groß authored
This is a reland of commit a31e8f24 Remove the checking logic, which will be addressed in a separate CL. Original change's description: > [sandbox] Forbid double-initialization of ExternalPointerSlots > > Double initialization may cause the ExternalPointerTable compaction > algorithm to behave non-optimally: Consider the case of an Entry E1 that > is owned by a HeapObject O and is marked for evacuation during GC > marking. In that case, a new entry E2 is allocated for it, and during > sweeping, E1 will be evacuated into E2 and the Handle in O updated to > point to E2. However, if a new entry E3 for O is allocated before > sweeping, then during sweeping E3 (instead of E1) will be moved into E2. > This may then violate the invariant that the compaction algorithms > always evacuates an entry out of the evacuation area. > > This CL therefore forbids double initializaiton of external pointer > slots and adds DCHECKs to attempt to catch these in debug builds. > > Bug: v8:10391 > Change-Id: I128dc930e8b3f863dab18ba648f34d68d8cb276b > Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3856563 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Samuel Groß <saelo@chromium.org> > Cr-Commit-Position: refs/heads/main@{#82729} Bug: v8:10391 Change-Id: I6cef79f4adc340fdcdc291ad0f0c2210f5bf48cd Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3857423Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#82744}
32b7b8e9