• Michael Lippautz's avatar
    Reland "cppgc: Properly clear (Weak)Peristent and WeakMember pointers" · 8bdce527
    Michael Lippautz authored
    This is a reland of e0c1a349
    
    The issue was passing SentinelPointer (== +1) through T*.
    
    The fix is disabling cfi unrelated cast diagnostic for the bottlenecks
    (Get()). This means that nullptr is treated the same as
    kSentinelPointer.
    
    The alternative would be a DCHECK that Get() does not return
    kSentinelPointer and adjusting all Member and Persistent logic that
    uses Get() to work on void*. This is quite intrusive as it involves
    Swap(), heterogeneous assignments, comparisons, etc.
    
    Original change's description:
    > cppgc: Properly clear (Weak)Peristent and WeakMember pointers
    >
    > The CL addresses two issues with (Weak)Persistent and WeakMember:
    > 1. (Weak)Persistent pointers are cleared on heap teardown. Before this
    >    CL the pointers would contain stale values which could lead to UAF.
    > 2. WeakPersistent and WeakMember are cleared using a combination of
    >    internal clearing methods and mutable fields which avoids the use
    >    of const_cast<>.
    >
    > Bug: chromium:1056170
    > Change-Id: Ibf2b0f0856771b4f6906608cde13a6d43ebf81f3
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2248190
    > Reviewed-by: Omer Katz <omerkatz@chromium.org>
    > Reviewed-by: Anton Bikineev <bikineev@chromium.org>
    > Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#68394}
    
    Bug: chromium:1056170
    Change-Id: I3d74b43464c2973df1956f51b1419d755dd9f519
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250240Reviewed-by: 's avatarOmer Katz <omerkatz@chromium.org>
    Reviewed-by: 's avatarAnton Bikineev <bikineev@chromium.org>
    Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#68426}
    8bdce527
Name
Last commit
Last update
..
api Loading commit data...
asmjs Loading commit data...
assembler Loading commit data...
base Loading commit data...
codegen Loading commit data...
compiler Loading commit data...
compiler-dispatcher Loading commit data...
date Loading commit data...
diagnostics Loading commit data...
execution Loading commit data...
heap Loading commit data...
interpreter Loading commit data...
libplatform Loading commit data...
logging Loading commit data...
numbers Loading commit data...
objects Loading commit data...
parser Loading commit data...
profiler Loading commit data...
regress Loading commit data...
strings Loading commit data...
tasks Loading commit data...
torque Loading commit data...
utils Loading commit data...
wasm Loading commit data...
zone Loading commit data...
BUILD.gn Loading commit data...
DEPS Loading commit data...
run-all-unittests.cc Loading commit data...
test-helpers.cc Loading commit data...
test-helpers.h Loading commit data...
test-utils.cc Loading commit data...
test-utils.h Loading commit data...
testcfg.py Loading commit data...
unittests.status Loading commit data...