-
Clemens Backes authored
The AsmParser kept pointers into ZoneVectors, which were accessed even after those vector might have grown. For regular vectors, this would be a use-after-free; with ZoneVectors it is technically allowed, since the old memory stays alive. This will change with https://crrev.com/c/2302895, which zaps zone memory which is deallocated. Eventually, we might want to reuse large deallocations in zone memory, hence this "use after free" needs to be fixed. This CL fixes the issue by explicitly re-allocating in the zone instead of using ZoneVectors. This makes sure that the old memory stays alive. This is kind of a quick-fix, but since asm.js is more or less deprecated anyway (in favor of Wasm), it's OK if this code does not profit from future ZoneVector memory re-use optimizations. Drive-by: Move field initializers to the field declaration. R=ishell@chromium.org Bug: v8:10717 Change-Id: I56c1feb49d05080e78a6620273b55b4e18156254 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304581Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#68917}
7887ae6f
Name |
Last commit
|
Last update |
---|---|---|
.. | ||
OWNERS | ||
asm-js.cc | ||
asm-js.h | ||
asm-names.h | ||
asm-parser.cc | ||
asm-parser.h | ||
asm-scanner.cc | ||
asm-scanner.h | ||
asm-types.cc | ||
asm-types.h |