• Michael Lippautz's avatar
    Reland "cppgc: Properly clear (Weak)Peristent and WeakMember pointers" · 8bdce527
    Michael Lippautz authored
    This is a reland of e0c1a349
    
    The issue was passing SentinelPointer (== +1) through T*.
    
    The fix is disabling cfi unrelated cast diagnostic for the bottlenecks
    (Get()). This means that nullptr is treated the same as
    kSentinelPointer.
    
    The alternative would be a DCHECK that Get() does not return
    kSentinelPointer and adjusting all Member and Persistent logic that
    uses Get() to work on void*. This is quite intrusive as it involves
    Swap(), heterogeneous assignments, comparisons, etc.
    
    Original change's description:
    > cppgc: Properly clear (Weak)Peristent and WeakMember pointers
    >
    > The CL addresses two issues with (Weak)Persistent and WeakMember:
    > 1. (Weak)Persistent pointers are cleared on heap teardown. Before this
    >    CL the pointers would contain stale values which could lead to UAF.
    > 2. WeakPersistent and WeakMember are cleared using a combination of
    >    internal clearing methods and mutable fields which avoids the use
    >    of const_cast<>.
    >
    > Bug: chromium:1056170
    > Change-Id: Ibf2b0f0856771b4f6906608cde13a6d43ebf81f3
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2248190
    > Reviewed-by: Omer Katz <omerkatz@chromium.org>
    > Reviewed-by: Anton Bikineev <bikineev@chromium.org>
    > Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#68394}
    
    Bug: chromium:1056170
    Change-Id: I3d74b43464c2973df1956f51b1419d755dd9f519
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250240Reviewed-by: 's avatarOmer Katz <omerkatz@chromium.org>
    Reviewed-by: 's avatarAnton Bikineev <bikineev@chromium.org>
    Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#68426}
    8bdce527
Name
Last commit
Last update
..
asm Loading commit data...
allocation.cc Loading commit data...
caged-heap-local-data.cc Loading commit data...
caged-heap.cc Loading commit data...
caged-heap.h Loading commit data...
free-list.cc Loading commit data...
free-list.h Loading commit data...
garbage-collector.h Loading commit data...
gc-info-table.cc Loading commit data...
gc-info-table.h Loading commit data...
gc-info.cc Loading commit data...
gc-invoker.cc Loading commit data...
gc-invoker.h Loading commit data...
globals.h Loading commit data...
heap-base.cc Loading commit data...
heap-base.h Loading commit data...
heap-growing.cc Loading commit data...
heap-growing.h Loading commit data...
heap-object-header-inl.h Loading commit data...
heap-object-header.cc Loading commit data...
heap-object-header.h Loading commit data...
heap-page-inl.h Loading commit data...
heap-page.cc Loading commit data...
heap-page.h Loading commit data...
heap-space.cc Loading commit data...
heap-space.h Loading commit data...
heap-visitor.h Loading commit data...
heap.cc Loading commit data...
heap.h Loading commit data...
liveness-broker.cc Loading commit data...
logging.cc Loading commit data...
marker.cc Loading commit data...
marker.h Loading commit data...
marking-visitor.cc Loading commit data...
marking-visitor.h Loading commit data...
object-allocator-inl.h Loading commit data...
object-allocator.cc Loading commit data...
object-allocator.h Loading commit data...
object-start-bitmap-inl.h Loading commit data...
object-start-bitmap.h Loading commit data...
page-memory-inl.h Loading commit data...
page-memory.cc Loading commit data...
page-memory.h Loading commit data...
persistent-node.cc Loading commit data...
platform.cc Loading commit data...
pointer-policies.cc Loading commit data...
prefinalizer-handler.cc Loading commit data...
prefinalizer-handler.h Loading commit data...
process-heap.cc Loading commit data...
raw-heap.cc Loading commit data...
raw-heap.h Loading commit data...
sanitizers.h Loading commit data...
source-location.cc Loading commit data...
stack.cc Loading commit data...
stack.h Loading commit data...
stats-collector.cc Loading commit data...
stats-collector.h Loading commit data...
sweeper.cc Loading commit data...
sweeper.h Loading commit data...
task-handle.h Loading commit data...
virtual-memory.cc Loading commit data...
virtual-memory.h Loading commit data...
visitor.cc Loading commit data...
visitor.h Loading commit data...
worklist.h Loading commit data...
write-barrier.cc Loading commit data...