Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: cherry-pick 3 changes from 0-M125 #42220

Merged
merged 2 commits into from
May 20, 2024

Conversation

ppontes
Copy link
Member

@ppontes ppontes commented May 17, 2024

electron/security#512 - 6503a987d966 from v8 [objects] Deal with large strings in NoSideEffectsErrorToString

If name is too big, StringBuilder will fail to even add
"" suffix.

In this case, we truncate name first.

Bug: 329699609
Change-Id: I6e4440c07eae84371f44b54f88127e2c70af0db5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5378286
Commit-Queue: Victor Gomes victorgomes@chromium.org
Reviewed-by: Patrick Thier pthier@chromium.org
Auto-Submit: Victor Gomes victorgomes@chromium.org
Cr-Commit-Position: refs/heads/main@{#92932}

electron/security#510 - 2a434fd0af6b from DirectXShaderCompiler Fix invalid IR from scalarrepl-param-hlsl in ReplaceConstantWithInst (#6556)

ReplaceConstantWithInst(C, V) replaces uses of C in the current function
with V. If such a use C is an instruction I, the it replaces uses of C
in I with V. However, this function did not make sure to only perform
this replacement if V dominates I. As a result, it may end up replacing
uses of C in instructions before the definition of V.

The fix is to lazily compute the dominator tree in
ReplaceConstantWithInst so that we can guard the replacement with that
dominance check.

Bug: chromium:333414294
Change-Id: I2a8bf64094298b49a1887cc7c1334e91a745c396
Reviewed-on: https://chromium-review.googlesource.com/c/external/github.com/microsoft/DirectXShaderCompiler/+/5525429
Reviewed-by: James Price jrprice@google.com
Reviewed-by: dan sinclair dsinclair@google.com

electron/security#508 - 03609e39be8c from chromium Fix size calculations in V8StringToUTF8

While I'm here, remove the unnecessary use of base::WriteInto, which is
a remnant of C++03 copy-on-write strings. Also ask V8 not to write a
NUL terminator because std::(u16)string already owns that byte.

(cherry picked from commit f414dc31032a453f4a6c88977d7894fcb3cba44e)

Bug: 338574384
Change-Id: I5c6eaa99093925db799736f321eab92d35f5acbb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5515743
Reviewed-by: mmenke mmenke@chromium.org
Commit-Queue: David Benjamin davidben@chromium.org
Reviewed-by: Michael Lippautz mlippautz@chromium.org
Cr-Original-Commit-Position: refs/heads/main@{#1297196}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5527764
Auto-Submit: David Benjamin davidben@chromium.org
Commit-Queue: mmenke mmenke@chromium.org
Cr-Commit-Position: refs/branch-heads/6367@{#1148}
Cr-Branched-From: d158c6dc6e3604e6f899041972edf26087a49740-refs/heads/main@{#1274542}

Notes:

  • Security: backported fix for 329699609.
  • Security: backported fix for CVE-2024-4948.
  • Security: backported fix for 338574384.

* 6503a987d966 from v8
* 2a434fd0af6b from DirectXShaderCompiler
* 03609e39be8c from chromium
@ppontes ppontes requested a review from a team as a code owner May 17, 2024 16:57
@ppontes ppontes added security 🔒 semver/patch backwards-compatible bug fixes backport-check-skip Skip trop's backport validity checking 29-x-y labels May 17, 2024
@VerteDinde VerteDinde merged commit d2ffa6f into 29-x-y May 20, 2024
12 of 13 checks passed
@VerteDinde VerteDinde deleted the cherry-pick/security/29-x-y/0-m125 branch May 20, 2024 19:00
Copy link

release-clerk bot commented May 20, 2024

Release Notes Persisted

  • Security: backported fix for 329699609.
  • Security: backported fix for CVE-2024-4948.
  • Security: backported fix for 338574384.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
29-x-y backport-check-skip Skip trop's backport validity checking security 🔒 semver/patch backwards-compatible bug fixes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants