• Michael Lippautz's avatar
    Reland "cppgc: Properly clear (Weak)Peristent and WeakMember pointers" · 8bdce527
    Michael Lippautz authored
    This is a reland of e0c1a349
    
    The issue was passing SentinelPointer (== +1) through T*.
    
    The fix is disabling cfi unrelated cast diagnostic for the bottlenecks
    (Get()). This means that nullptr is treated the same as
    kSentinelPointer.
    
    The alternative would be a DCHECK that Get() does not return
    kSentinelPointer and adjusting all Member and Persistent logic that
    uses Get() to work on void*. This is quite intrusive as it involves
    Swap(), heterogeneous assignments, comparisons, etc.
    
    Original change's description:
    > cppgc: Properly clear (Weak)Peristent and WeakMember pointers
    >
    > The CL addresses two issues with (Weak)Persistent and WeakMember:
    > 1. (Weak)Persistent pointers are cleared on heap teardown. Before this
    >    CL the pointers would contain stale values which could lead to UAF.
    > 2. WeakPersistent and WeakMember are cleared using a combination of
    >    internal clearing methods and mutable fields which avoids the use
    >    of const_cast<>.
    >
    > Bug: chromium:1056170
    > Change-Id: Ibf2b0f0856771b4f6906608cde13a6d43ebf81f3
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2248190
    > Reviewed-by: Omer Katz <omerkatz@chromium.org>
    > Reviewed-by: Anton Bikineev <bikineev@chromium.org>
    > Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#68394}
    
    Bug: chromium:1056170
    Change-Id: I3d74b43464c2973df1956f51b1419d755dd9f519
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250240Reviewed-by: 's avatarOmer Katz <omerkatz@chromium.org>
    Reviewed-by: 's avatarAnton Bikineev <bikineev@chromium.org>
    Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#68426}
    8bdce527
Name
Last commit
Last update
..
debug Loading commit data...
platform Loading commit data...
utils Loading commit data...
DEPS Loading commit data...
OWNERS Loading commit data...
address-region.h Loading commit data...
atomic-utils.h Loading commit data...
atomicops.h Loading commit data...
atomicops_internals_atomicword_compat.h Loading commit data...
atomicops_internals_portable.h Loading commit data...
atomicops_internals_std.h Loading commit data...
base-export.h Loading commit data...
bit-field.h Loading commit data...
bits-iterator.h Loading commit data...
bits.cc Loading commit data...
bits.h Loading commit data...
bounded-page-allocator.cc Loading commit data...
bounded-page-allocator.h Loading commit data...
bounds.h Loading commit data...
build_config.h Loading commit data...
compiler-specific.h Loading commit data...
cpu.cc Loading commit data...
cpu.h Loading commit data...
division-by-constant.cc Loading commit data...
division-by-constant.h Loading commit data...
enum-set.h Loading commit data...
export-template.h Loading commit data...
file-utils.cc Loading commit data...
file-utils.h Loading commit data...
flags.h Loading commit data...
free_deleter.h Loading commit data...
functional.cc Loading commit data...
functional.h Loading commit data...
hashmap-entry.h Loading commit data...
hashmap.h Loading commit data...
ieee754.cc Loading commit data...
ieee754.h Loading commit data...
iterator.h Loading commit data...
lazy-instance.h Loading commit data...
logging.cc Loading commit data...
logging.h Loading commit data...
lsan.h Loading commit data...
macros.h Loading commit data...
memory.h Loading commit data...
once.cc Loading commit data...
once.h Loading commit data...
optional.h Loading commit data...
overflowing-math.h Loading commit data...
page-allocator.cc Loading commit data...
page-allocator.h Loading commit data...
qnx-math.h Loading commit data...
region-allocator.cc Loading commit data...
region-allocator.h Loading commit data...
ring-buffer.h Loading commit data...
safe_conversions.h Loading commit data...
safe_conversions_impl.h Loading commit data...
small-vector.h Loading commit data...
sys-info.cc Loading commit data...
sys-info.h Loading commit data...
template-utils.h Loading commit data...
threaded-list.h Loading commit data...
timezone-cache.h Loading commit data...
type-traits.h Loading commit data...
ubsan.cc Loading commit data...
v8-fallthrough.h Loading commit data...
vlq-base64.cc Loading commit data...
vlq-base64.h Loading commit data...
win32-headers.h Loading commit data...