• Clemens Backes's avatar
    [wasm][debug] Avoid use-after-free on tier down · 0816423d
    Clemens Backes authored
    When tiering down (or up), we first get a list of all native modules
    (under a lock), then tier them down/up without holding the lock. Since
    we don't hold (shared) ownership of the native module, it could die
    in-between.
    This CL fixes this by keeping weak pointers to the native modules, and
    re-gaining a shared pointer before putting the module in the list of
    modules to be tiered down/up.
    
    R=thibaudm@chromium.org
    
    Bug: v8:10588
    Change-Id: I2891c3729f42f26d4026f3e2448e124863b95122
    Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel
    Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228515
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Reviewed-by: 's avatarThibaud Michaud <thibaudm@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#68145}
    0816423d
wasm-engine.cc 53.9 KB