• Samuel Groß's avatar
    [sandbox] Forbid double-initialization of ExternalPointerSlots · a31e8f24
    Samuel Groß authored
    Double initialization may cause the ExternalPointerTable compaction
    algorithm to behave non-optimally: Consider the case of an Entry E1 that
    is owned by a HeapObject O and is marked for evacuation during GC
    marking. In that case, a new entry E2 is allocated for it, and during
    sweeping, E1 will be evacuated into E2 and the Handle in O updated to
    point to E2. However, if a new entry E3 for O is allocated before
    sweeping, then during sweeping E3 (instead of E1) will be moved into E2.
    This may then violate the invariant that the compaction algorithms
    always evacuates an entry out of the evacuation area.
    
    This CL therefore forbids double initializaiton of external pointer
    slots and adds DCHECKs to attempt to catch these in debug builds.
    
    Bug: v8:10391
    Change-Id: I128dc930e8b3f863dab18ba648f34d68d8cb276b
    Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3856563Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
    Commit-Queue: Samuel Groß <saelo@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#82729}
    a31e8f24
slots-inl.h 9.57 KB