• Michael Lippautz's avatar
    Reland "cppgc: Properly clear (Weak)Peristent and WeakMember pointers" · 8bdce527
    Michael Lippautz authored
    This is a reland of e0c1a349
    
    The issue was passing SentinelPointer (== +1) through T*.
    
    The fix is disabling cfi unrelated cast diagnostic for the bottlenecks
    (Get()). This means that nullptr is treated the same as
    kSentinelPointer.
    
    The alternative would be a DCHECK that Get() does not return
    kSentinelPointer and adjusting all Member and Persistent logic that
    uses Get() to work on void*. This is quite intrusive as it involves
    Swap(), heterogeneous assignments, comparisons, etc.
    
    Original change's description:
    > cppgc: Properly clear (Weak)Peristent and WeakMember pointers
    >
    > The CL addresses two issues with (Weak)Persistent and WeakMember:
    > 1. (Weak)Persistent pointers are cleared on heap teardown. Before this
    >    CL the pointers would contain stale values which could lead to UAF.
    > 2. WeakPersistent and WeakMember are cleared using a combination of
    >    internal clearing methods and mutable fields which avoids the use
    >    of const_cast<>.
    >
    > Bug: chromium:1056170
    > Change-Id: Ibf2b0f0856771b4f6906608cde13a6d43ebf81f3
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2248190
    > Reviewed-by: Omer Katz <omerkatz@chromium.org>
    > Reviewed-by: Anton Bikineev <bikineev@chromium.org>
    > Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#68394}
    
    Bug: chromium:1056170
    Change-Id: I3d74b43464c2973df1956f51b1419d755dd9f519
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250240Reviewed-by: 's avatarOmer Katz <omerkatz@chromium.org>
    Reviewed-by: 's avatarAnton Bikineev <bikineev@chromium.org>
    Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#68426}
    8bdce527
Name
Last commit
Last update
..
api Loading commit data...
asmjs Loading commit data...
ast Loading commit data...
base Loading commit data...
builtins Loading commit data...
codegen Loading commit data...
common Loading commit data...
compiler Loading commit data...
compiler-dispatcher Loading commit data...
d8 Loading commit data...
date Loading commit data...
debug Loading commit data...
deoptimizer Loading commit data...
diagnostics Loading commit data...
execution Loading commit data...
extensions Loading commit data...
flags Loading commit data...
handles Loading commit data...
heap Loading commit data...
ic Loading commit data...
init Loading commit data...
inspector Loading commit data...
interpreter Loading commit data...
json Loading commit data...
libplatform Loading commit data...
libsampler Loading commit data...
logging Loading commit data...
numbers Loading commit data...
objects Loading commit data...
parsing Loading commit data...
profiler Loading commit data...
protobuf Loading commit data...
regexp Loading commit data...
roots Loading commit data...
runtime Loading commit data...
sanitizer Loading commit data...
snapshot Loading commit data...
strings Loading commit data...
tasks Loading commit data...
third_party Loading commit data...
torque Loading commit data...
tracing Loading commit data...
trap-handler Loading commit data...
utils Loading commit data...
wasm Loading commit data...
zone Loading commit data...
DEPS Loading commit data...
OWNERS Loading commit data...