Commit e9d93bab authored by Clemens Hammacher's avatar Clemens Hammacher Committed by Commit Bot

[wasm] Register trap handler data early enough

Registration of trap handler data has to happen *before* updating the
jump table, otherwise other threads might start using the code right
away, and if they hit a memory OOB, they just segfault if the trap
handlers have not been registered yet.

R=ahaas@chromium.org

Bug: v8:9375, chromium:980843
Change-Id: Ifac5c0681ce133b7af730a87beaede9d3c223f50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687414Reviewed-by: 's avatarAndreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62535}
parent a80a6e31
......@@ -949,6 +949,8 @@ WasmCode* NativeModule::PublishCodeLocked(std::unique_ptr<WasmCode> code) {
code->index() >= module_->num_imported_functions) {
DCHECK_LT(code->index(), num_functions());
code->RegisterTrapHandlerData();
// Assume an order of execution tiers that represents the quality of their
// generated code.
static_assert(ExecutionTier::kNone < ExecutionTier::kInterpreter &&
......@@ -987,8 +989,6 @@ WasmCode* NativeModule::PublishCodeLocked(std::unique_ptr<WasmCode> code) {
jump_table_->instruction_start(), slot_idx, code->instruction_start(),
WasmCode::kFlushICache);
}
code->RegisterTrapHandlerData();
}
WasmCodeRefScope::AddRef(code.get());
WasmCode* result = code.get();
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment