• Anna Henningsen's avatar
    [heap-profiler] Fix crash when a snapshot deleted while taking one · 3176bfd4
    Anna Henningsen authored
    Fix a crash/hang that occurred when deleting a snapshot during the
    GC that is part of taking another one.
    
    Specifically, when deleting the only other snapshot in such
    a situation, the `v8::HeapSnapshot::Delete()` method sees that there
    is only one (complete) snapshot at that point, and decides that it is
    okay to perform “delete all snapshots” instead of just deleting
    the requested one. That resets the internal string lookup table
    of the heap profiler, but the new snapshot that is currently in
    progress still holds references to the old string lookup table,
    leading to a use-after-free segfault or infinite loop.
    
    Fix this by guarding against resetting the string table while
    another heap snapshot is being taken, and add a test that would
    crash before this fix.
    
    This can be triggered in Node.js by repeatedly calling
    `v8.getHeapSnapshot()`, which provides heap snapshots as weakly
    held host objects.
    
    Change-Id: If9ac3728bf79114000982f1e7bb05e8034299e3c
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2464823Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
    Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#70445}
    3176bfd4
Name
Last commit
Last update
..
OWNERS Loading commit data...
api-arguments-inl.h Loading commit data...
api-arguments.cc Loading commit data...
api-arguments.h Loading commit data...
api-inl.h Loading commit data...
api-natives.cc Loading commit data...
api-natives.h Loading commit data...
api.cc Loading commit data...
api.h Loading commit data...