• Michael Lippautz's avatar
    Reland "cppgc: Properly clear (Weak)Peristent and WeakMember pointers" · 8bdce527
    Michael Lippautz authored
    This is a reland of e0c1a349
    
    The issue was passing SentinelPointer (== +1) through T*.
    
    The fix is disabling cfi unrelated cast diagnostic for the bottlenecks
    (Get()). This means that nullptr is treated the same as
    kSentinelPointer.
    
    The alternative would be a DCHECK that Get() does not return
    kSentinelPointer and adjusting all Member and Persistent logic that
    uses Get() to work on void*. This is quite intrusive as it involves
    Swap(), heterogeneous assignments, comparisons, etc.
    
    Original change's description:
    > cppgc: Properly clear (Weak)Peristent and WeakMember pointers
    >
    > The CL addresses two issues with (Weak)Persistent and WeakMember:
    > 1. (Weak)Persistent pointers are cleared on heap teardown. Before this
    >    CL the pointers would contain stale values which could lead to UAF.
    > 2. WeakPersistent and WeakMember are cleared using a combination of
    >    internal clearing methods and mutable fields which avoids the use
    >    of const_cast<>.
    >
    > Bug: chromium:1056170
    > Change-Id: Ibf2b0f0856771b4f6906608cde13a6d43ebf81f3
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2248190
    > Reviewed-by: Omer Katz <omerkatz@chromium.org>
    > Reviewed-by: Anton Bikineev <bikineev@chromium.org>
    > Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#68394}
    
    Bug: chromium:1056170
    Change-Id: I3d74b43464c2973df1956f51b1419d755dd9f519
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250240Reviewed-by: 's avatarOmer Katz <omerkatz@chromium.org>
    Reviewed-by: 's avatarAnton Bikineev <bikineev@chromium.org>
    Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#68426}
    8bdce527
Name
Last commit
Last update
..
benchmarks Loading commit data...
cctest Loading commit data...
common Loading commit data...
debugger Loading commit data...
debugging Loading commit data...
fuzzer Loading commit data...
fuzzilli Loading commit data...
inspector Loading commit data...
intl Loading commit data...
js-perf-test Loading commit data...
memory Loading commit data...
message Loading commit data...
mjsunit Loading commit data...
mkgrokdump Loading commit data...
mozilla Loading commit data...
test262 Loading commit data...
torque Loading commit data...
unittests Loading commit data...
wasm-api-tests Loading commit data...
wasm-js Loading commit data...
wasm-spec-tests Loading commit data...
webkit Loading commit data...
BUILD.gn Loading commit data...
OWNERS Loading commit data...