• Michael Lippautz's avatar
    [heap] Remove DCHECKs when clearning on-stack handles · e3b27b4a
    Michael Lippautz authored
    The DCHECKs ensured that all on-stack handles removed when the embedder
    notifies V8 of an empty stack are indeed below the current stack limit.
    
    This is brittle, as the calls that are guaranteed to have no stack
    above, e.g., non-nestable tasks executing GC, sometimes have larger
    stack depth then previously registered on-stack handles. Resetting the
    slot to avoid UAF is not possible/needed as it is guaranteed in such
    cases that the stack is indeed different from the stack that was used
    when registering an on-stack handle.
    
    This CL removes the DCHECKs and trust the embedder on such calls,
    similar to when the embedder tells V8 that there's no interesting C++
    stack on top of a call to avoid conservative stack scanning.
    
    Bug: chromium:1040038
    Change-Id: I2e8c77d8080f2d888f773984646998bede59e19c
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000753Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
    Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#65786}
    e3b27b4a
Name
Last commit
Last update
..
api Loading commit data...
asmjs Loading commit data...
ast Loading commit data...
base Loading commit data...
builtins Loading commit data...
codegen Loading commit data...
common Loading commit data...
compiler Loading commit data...
compiler-dispatcher Loading commit data...
d8 Loading commit data...
date Loading commit data...
debug Loading commit data...
deoptimizer Loading commit data...
diagnostics Loading commit data...
execution Loading commit data...
extensions Loading commit data...
flags Loading commit data...
handles Loading commit data...
heap Loading commit data...
ic Loading commit data...
init Loading commit data...
inspector Loading commit data...
interpreter Loading commit data...
json Loading commit data...
libplatform Loading commit data...
libsampler Loading commit data...
logging Loading commit data...
numbers Loading commit data...
objects Loading commit data...
parsing Loading commit data...
profiler Loading commit data...
protobuf Loading commit data...
regexp Loading commit data...
roots Loading commit data...
runtime Loading commit data...
sanitizer Loading commit data...
snapshot Loading commit data...
strings Loading commit data...
tasks Loading commit data...
third_party Loading commit data...
torque Loading commit data...
tracing Loading commit data...
trap-handler Loading commit data...
utils Loading commit data...
wasm Loading commit data...
zone Loading commit data...
DEPS Loading commit data...
OWNERS Loading commit data...