• Simon Zünd's avatar
    [typedarray] Fix crash when sorting SharedArrayBuffers · 3d846115
    Simon Zünd authored
    TypedArray#sort has a fast-path when the user does not provide a
    comparison function. This fast-path utilizes std::sort which operates
    directly on the raw data. Per spec, std::sort requires the "less than"
    operation to be anti-symmetric and transitive.
    
    When sorting SharedArrayBuffers (SAB) that are concurrently modified during
    sorting, the "less than" operator stops being consistent as the
    underlying data is constantly modified. This breaks some invariants
    in std::sort resulting in infinite loops or straight out segfaults.
    
    This CL fixes this by copying the data before sorting SABs and
    writing the sorted result back.
    
    Note: The added regression test is tailored for ASAN bots as a
    normal build would need too many iterations to consistently crash.
    
    R=neis@chromium.org, petermarshall@chromium.org
    
    Bug: v8:9161
    Change-Id: Ic089928652f75865bfdb11e7453806faa6ecb988
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1581641Reviewed-by: 's avatarPeter Marshall <petermarshall@chromium.org>
    Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
    Commit-Queue: Simon Zünd <szuend@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#61004}
    3d846115
Name
Last commit
Last update
..
benchmarks Loading commit data...
cctest Loading commit data...
common Loading commit data...
debugger Loading commit data...
fuzzer Loading commit data...
inspector Loading commit data...
intl Loading commit data...
js-perf-test Loading commit data...
memory Loading commit data...
message Loading commit data...
mjsunit Loading commit data...
mkgrokdump Loading commit data...
mozilla Loading commit data...
preparser Loading commit data...
test262 Loading commit data...
torque Loading commit data...
unittests Loading commit data...
wasm-js Loading commit data...
wasm-spec-tests Loading commit data...
webkit Loading commit data...
BUILD.gn Loading commit data...
OWNERS Loading commit data...