• Samuel Groß's avatar
    [sandbox] Forbid double-initialization of ExternalPointerSlots · a31e8f24
    Samuel Groß authored
    Double initialization may cause the ExternalPointerTable compaction
    algorithm to behave non-optimally: Consider the case of an Entry E1 that
    is owned by a HeapObject O and is marked for evacuation during GC
    marking. In that case, a new entry E2 is allocated for it, and during
    sweeping, E1 will be evacuated into E2 and the Handle in O updated to
    point to E2. However, if a new entry E3 for O is allocated before
    sweeping, then during sweeping E3 (instead of E1) will be moved into E2.
    This may then violate the invariant that the compaction algorithms
    always evacuates an entry out of the evacuation area.
    
    This CL therefore forbids double initializaiton of external pointer
    slots and adds DCHECKs to attempt to catch these in debug builds.
    
    Bug: v8:10391
    Change-Id: I128dc930e8b3f863dab18ba648f34d68d8cb276b
    Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3856563Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
    Commit-Queue: Samuel Groß <saelo@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#82729}
    a31e8f24
Name
Last commit
Last update
..
api Loading commit data...
asmjs Loading commit data...
ast Loading commit data...
base Loading commit data...
baseline Loading commit data...
bigint Loading commit data...
builtins Loading commit data...
codegen Loading commit data...
common Loading commit data...
compiler Loading commit data...
compiler-dispatcher Loading commit data...
d8 Loading commit data...
date Loading commit data...
debug Loading commit data...
deoptimizer Loading commit data...
diagnostics Loading commit data...
execution Loading commit data...
extensions Loading commit data...
flags Loading commit data...
handles Loading commit data...
heap Loading commit data...
ic Loading commit data...
init Loading commit data...
inspector Loading commit data...
interpreter Loading commit data...
json Loading commit data...
libplatform Loading commit data...
libsampler Loading commit data...
logging Loading commit data...
maglev Loading commit data...
numbers Loading commit data...
objects Loading commit data...
parsing Loading commit data...
profiler Loading commit data...
protobuf Loading commit data...
regexp Loading commit data...
roots Loading commit data...
runtime Loading commit data...
sandbox Loading commit data...
sanitizer Loading commit data...
snapshot Loading commit data...
strings Loading commit data...
tasks Loading commit data...
temporal Loading commit data...
third_party Loading commit data...
torque Loading commit data...
tracing Loading commit data...
trap-handler Loading commit data...
utils Loading commit data...
wasm Loading commit data...
web-snapshot Loading commit data...
zone Loading commit data...
DEPS Loading commit data...
DIR_METADATA Loading commit data...
OWNERS Loading commit data...