• Clemens Hammacher's avatar
    [wasm][gc] Deregister foreground task in destructor · 3ea51d46
    Clemens Hammacher authored
    The platform is allowed to remove the foreground task without ever
    executing it if the isolate is shutting down. This can happen
    immediately when spawning the task. This would leave a stale pointer to
    the deleted task in the engine, and can lead to UAF.
    Thus deregister the task also from the destructor. At that point, we do
    not need to report back any live code for that isolate.
    
    R=ahaas@chromium.org
    
    Bug: v8:8217, chromium:971293
    Change-Id: I7081efde8f306649d08956e758254a8875db8271
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669694Reviewed-by: 's avatarAndreas Haas <ahaas@chromium.org>
    Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#62312}
    3ea51d46
wasm-engine.cc 37 KB