-
Thibaud Michaud authored
We currently allow OSR (On-Stack Replacement) of arbitrarily deep return addresses. This is in direct violation of Intel CET's shadow stack, which we plan to enable eventually. This change works around this by postponing OSR until after we return to the old code. The main changes are: - Reserve a slot in Liftoff frames to store the OSR target, - Skip the return address modification, and instead store the new code pointer in the dedicated slot, - Upon returning to the old code, check the slot and do an indirect jump to the new code if needed. CET also prevents indirect jumps to arbitrary locations, so the last point is also a CET violation. Valid indirect jump targets must be marked with the ENDBRANCH instruction, which I will do in a follow-up CL. Bug: v8:11654 Change-Id: I6925005211aa95d60803b9409e3c07c7c226b25c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826127 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#73977}
06a2c2e0
Name |
Last commit
|
Last update |
---|---|---|
.. | ||
builtins-arm.cc |