-
Samuel Groß authored
When the sandbox is enabled, an empty ArrayBuffer does not have a nullptr backing store but instead points to a special EmptyBackingStore pseudo-object inside the sandbox. This then requires special handling during deserialization. This CL fixes two cases where this was not done correctly, which caused some crashes when --stress-snapshot is active. Bug: v8:10391 Change-Id: I412adace229b979b317864a3e8c12ed4c601b850 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716480Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#81297}
9d3a645b
| Name |
Last commit
|
Last update |
|---|---|---|
| .. | ||
| api | Loading commit data... | |
| asmjs | ||
| ast | ||
| base | ||
| baseline | ||
| bigint | ||
| builtins | ||
| codegen | ||
| common | ||
| compiler | ||
| compiler-dispatcher | ||
| d8 | ||
| date | ||
| debug | ||
| deoptimizer | ||
| diagnostics | ||
| execution | ||
| extensions | ||
| flags | ||
| handles | ||
| heap | ||
| ic | ||
| init | ||
| inspector | ||
| interpreter | ||
| json | ||
| libplatform | ||
| libsampler | ||
| logging | ||
| maglev | ||
| numbers | ||
| objects | ||
| parsing | ||
| profiler | ||
| protobuf | ||
| regexp | ||
| roots | ||
| runtime | ||
| sandbox | ||
| sanitizer | ||
| snapshot | ||
| strings | ||
| tasks | ||
| temporal | ||
| third_party | ||
| torque | ||
| tracing | ||
| trap-handler | ||
| utils | ||
| wasm | ||
| web-snapshot | ||
| zone | ||
| DEPS | ||
| DIR_METADATA | ||
| OWNERS |