Commit e3b27b4a authored by Michael Lippautz's avatar Michael Lippautz Committed by Commit Bot

[heap] Remove DCHECKs when clearning on-stack handles

The DCHECKs ensured that all on-stack handles removed when the embedder
notifies V8 of an empty stack are indeed below the current stack limit.

This is brittle, as the calls that are guaranteed to have no stack
above, e.g., non-nestable tasks executing GC, sometimes have larger
stack depth then previously registered on-stack handles. Resetting the
slot to avoid UAF is not possible/needed as it is guaranteed in such
cases that the stack is indeed different from the stack that was used
when registering an on-stack handle.

This CL removes the DCHECKs and trust the embedder on such calls,
similar to when the embedder tells V8 that there's no interesting C++
stack on top of a call to avoid conservative stack scanning.

Bug: chromium:1040038
Change-Id: I2e8c77d8080f2d888f773984646998bede59e19c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000753Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65786}
parent 8364fc74
......@@ -789,12 +789,6 @@ uintptr_t GlobalHandles::OnStackTracedNodeSpace::GetStackAddressForSlot(
}
void GlobalHandles::OnStackTracedNodeSpace::NotifyEmptyEmbedderStack() {
#ifdef DEBUG
uintptr_t current = GetCurrentStackPosition();
for (const auto it : on_stack_nodes_) {
DCHECK_LT(current, it.first);
}
#endif // DEBUG
on_stack_nodes_.clear();
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment