Commit e7bf8110 authored by Samuel Groß's avatar Samuel Groß Committed by V8 LUCI CQ

[sandbox] Sandboxify ExternalString external pointers

Bug: v8:10391
Change-Id: I0f737e5adf6e4fd24f93436fa5680ff20c1536da
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757901
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82958}
parent b804d8d0
...@@ -373,8 +373,8 @@ constexpr uint64_t kAllExternalPointerTypeTags[] = { ...@@ -373,8 +373,8 @@ constexpr uint64_t kAllExternalPointerTypeTags[] = {
#define SHARED_EXTERNAL_POINTER_TAGS(V) \ #define SHARED_EXTERNAL_POINTER_TAGS(V) \
V(kFirstSharedTag, sandboxed, TAG(0)) \ V(kFirstSharedTag, sandboxed, TAG(0)) \
V(kWaiterQueueNodeTag, sandboxed, TAG(0)) \ V(kWaiterQueueNodeTag, sandboxed, TAG(0)) \
V(kExternalStringResourceTag, unsandboxed, TAG(1)) \ V(kExternalStringResourceTag, sandboxed, TAG(1)) \
V(kExternalStringResourceDataTag, unsandboxed, TAG(2)) \ V(kExternalStringResourceDataTag, sandboxed, TAG(2)) \
V(kLastSharedTag, sandboxed, TAG(2)) V(kLastSharedTag, sandboxed, TAG(2))
// External pointers using these tags are kept in a per-Isolate external // External pointers using these tags are kept in a per-Isolate external
......
...@@ -595,13 +595,13 @@ void Serializer::ObjectSerializer::SerializeExternalString() { ...@@ -595,13 +595,13 @@ void Serializer::ObjectSerializer::SerializeExternalString() {
if (serializer_->external_reference_encoder_.TryEncode(resource).To( if (serializer_->external_reference_encoder_.TryEncode(resource).To(
&reference)) { &reference)) {
DCHECK(reference.is_from_api()); DCHECK(reference.is_from_api());
#ifdef V8_SANDBOXED_EXTERNAL_POINTERS #ifdef V8_ENABLE_SANDBOX
uint32_t external_pointer_entry = uint32_t external_pointer_entry =
string->GetResourceRefForDeserialization(); string->GetResourceRefForDeserialization();
#endif #endif
string->SetResourceRefForSerialization(reference.index()); string->SetResourceRefForSerialization(reference.index());
SerializeObject(); SerializeObject();
#ifdef V8_SANDBOXED_EXTERNAL_POINTERS #ifdef V8_ENABLE_SANDBOX
string->SetResourceRefForSerialization(external_pointer_entry); string->SetResourceRefForSerialization(external_pointer_entry);
#else #else
string->set_address_as_resource(isolate(), resource); string->set_address_as_resource(isolate(), resource);
......
...@@ -349,7 +349,7 @@ class ReadStringVisitor : public TqObjectVisitor { ...@@ -349,7 +349,7 @@ class ReadStringVisitor : public TqObjectVisitor {
if (IsExternalStringCached(object)) { if (IsExternalStringCached(object)) {
ExternalPointer_t resource_data = ExternalPointer_t resource_data =
GetOrFinish(object->GetResourceDataValue(accessor_)); GetOrFinish(object->GetResourceDataValue(accessor_));
#ifdef V8_SANDBOXED_EXTERNAL_POINTERS #ifdef V8_ENABLE_SANDBOX
Isolate* isolate = GetIsolateForSandbox( Isolate* isolate = GetIsolateForSandbox(
HeapObject::unchecked_cast(Object(heap_addresses_.any_heap_pointer))); HeapObject::unchecked_cast(Object(heap_addresses_.any_heap_pointer)));
ExternalPointerHandle handle = ExternalPointerHandle handle =
...@@ -359,7 +359,7 @@ class ReadStringVisitor : public TqObjectVisitor { ...@@ -359,7 +359,7 @@ class ReadStringVisitor : public TqObjectVisitor {
handle, kExternalStringResourceDataTag)); handle, kExternalStringResourceDataTag));
#else #else
uintptr_t data_address = static_cast<uintptr_t>(resource_data); uintptr_t data_address = static_cast<uintptr_t>(resource_data);
#endif // V8_COMPRESS_POINTERS #endif // V8_ENABLE_SANDBOX
if (done_) return; if (done_) return;
ReadStringCharacters<TChar>(object, data_address); ReadStringCharacters<TChar>(object, data_address);
} else { } else {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment