• Clemens Backes's avatar
    [asm] Fix use-after-free in ZoneVectors · 7887ae6f
    Clemens Backes authored
    The AsmParser kept pointers into ZoneVectors, which were accessed even
    after those vector might have grown. For regular vectors, this would be
    a use-after-free; with ZoneVectors it is technically allowed, since the
    old memory stays alive. This will change with
    https://crrev.com/c/2302895, which zaps zone memory which is
    deallocated. Eventually, we might want to reuse large deallocations in
    zone memory, hence this "use after free" needs to be fixed.
    
    This CL fixes the issue by explicitly re-allocating in the zone instead
    of using ZoneVectors. This makes sure that the old memory stays alive.
    This is kind of a quick-fix, but since asm.js is more or less deprecated
    anyway (in favor of Wasm), it's OK if this code does not profit from
    future ZoneVector memory re-use optimizations.
    
    Drive-by: Move field initializers to the field declaration.
    
    R=ishell@chromium.org
    
    Bug: v8:10717
    Change-Id: I56c1feb49d05080e78a6620273b55b4e18156254
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304581Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#68917}
    7887ae6f
Name
Last commit
Last update
..
OWNERS Loading commit data...
asm-js.cc Loading commit data...
asm-js.h Loading commit data...
asm-names.h Loading commit data...
asm-parser.cc Loading commit data...
asm-parser.h Loading commit data...
asm-scanner.cc Loading commit data...
asm-scanner.h Loading commit data...
asm-types.cc Loading commit data...
asm-types.h Loading commit data...