-
Notifications
You must be signed in to change notification settings - Fork 15k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore: cherry-pick 3 changes from Release-5-M120 (#41013)
* chore: [28-x-y] cherry-pick 3 changes from Release-5-M120 * 46cb67e3b296 from v8 * c1cda70a433a from chromium * 78dd4b31847a from v8 * chore: update patches --------- Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
- Loading branch information
1 parent
dcc19bb
commit 8f90259
Showing
5 changed files
with
107 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,31 @@ | ||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 | ||
From: Mike Wasserman <msw@chromium.org> | ||
Date: Thu, 21 Dec 2023 22:33:05 +0000 | ||
Subject: Speculative fix for UAF in | ||
content::WebContentsImpl::ExitFullscreenMode | ||
|
||
Bug: 1506535, 854815 | ||
Change-Id: Iace64d63f8cea2dbfbc761ad233db42451ec101c | ||
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5146875 | ||
Commit-Queue: John Abd-El-Malek <jam@chromium.org> | ||
Auto-Submit: Mike Wasserman <msw@chromium.org> | ||
Reviewed-by: John Abd-El-Malek <jam@chromium.org> | ||
Cr-Commit-Position: refs/heads/main@{#1240353} | ||
|
||
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc | ||
index a92c42ea05d680d435f6f69d9882e85537c995ec..e49ccf4ffc115a78abceeddd7f452aeeb5c6a917 100644 | ||
--- a/content/browser/web_contents/web_contents_impl.cc | ||
+++ b/content/browser/web_contents/web_contents_impl.cc | ||
@@ -3888,7 +3888,12 @@ void WebContentsImpl::ExitFullscreenMode(bool will_cause_resize) { | ||
} | ||
|
||
if (delegate_) { | ||
+ // This may spin the message loop and destroy this object crbug.com/1506535 | ||
+ base::WeakPtr<WebContentsImpl> weak_ptr = weak_factory_.GetWeakPtr(); | ||
delegate_->ExitFullscreenModeForTab(this); | ||
+ if (!weak_ptr) { | ||
+ return; | ||
+ } | ||
|
||
if (keyboard_lock_widget_) { | ||
delegate_->CancelKeyboardLockRequest(this); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,46 @@ | ||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 | ||
From: =?UTF-8?q?Dominik=20Inf=C3=BChr?= <dinfuehr@chromium.org> | ||
Date: Mon, 18 Dec 2023 09:15:00 +0100 | ||
Subject: Install BytecodeArray last in SharedFunctionInfo | ||
MIME-Version: 1.0 | ||
Content-Type: text/plain; charset=UTF-8 | ||
Content-Transfer-Encoding: 8bit | ||
|
||
Maglev assumes that when a SharedFunctionInfo has a BytecodeArray, | ||
then it should also have FeedbackMetadata. However, this may not | ||
hold with concurrent compilation when the SharedFunctionInfo is | ||
re-compiled after being flushed. Here the BytecodeArray was installed | ||
on the SFI before the FeedbackMetadata and a concurrent thread could | ||
observe the BytecodeArray but not the FeedbackMetadata. | ||
|
||
Drive-by: Reset the age field before setting the BytecodeArray as | ||
well. This ensures that the concurrent marker will not observe the | ||
old age for the new BytecodeArray. | ||
|
||
Bug: chromium:1507412 | ||
Change-Id: I8855ed7ecc50c4a47d2c89043d62ac053858bc75 | ||
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5125960 | ||
Reviewed-by: Leszek Swirski <leszeks@chromium.org> | ||
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> | ||
Cr-Commit-Position: refs/heads/main@{#91568} | ||
|
||
diff --git a/src/codegen/compiler.cc b/src/codegen/compiler.cc | ||
index 03860399e8b393cf315a507dbf5653381fc86d40..ff7360c10148657848440446e8d86bc4fcd51298 100644 | ||
--- a/src/codegen/compiler.cc | ||
+++ b/src/codegen/compiler.cc | ||
@@ -724,12 +724,12 @@ void InstallUnoptimizedCode(UnoptimizedCompilationInfo* compilation_info, | ||
} | ||
#endif // V8_ENABLE_WEBASSEMBLY | ||
|
||
- shared_info->set_bytecode_array(*compilation_info->bytecode_array()); | ||
- shared_info->set_age(0); | ||
- | ||
Handle<FeedbackMetadata> feedback_metadata = FeedbackMetadata::New( | ||
isolate, compilation_info->feedback_vector_spec()); | ||
shared_info->set_feedback_metadata(*feedback_metadata, kReleaseStore); | ||
+ | ||
+ shared_info->set_age(0); | ||
+ shared_info->set_bytecode_array(*compilation_info->bytecode_array()); | ||
} else { | ||
#if V8_ENABLE_WEBASSEMBLY | ||
DCHECK(compilation_info->has_asm_wasm_data()); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,27 @@ | ||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 | ||
From: Leszek Swirski <leszeks@chromium.org> | ||
Date: Mon, 8 Jan 2024 11:13:58 +0100 | ||
Subject: Fix allocation folding in derived constructors | ||
|
||
Bug: v8:7700 | ||
Change-Id: Ia33724d39d1397c7d47c36d14071abce6ed4b0fc | ||
Fixed: chromium:1515930 | ||
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5173470 | ||
Commit-Queue: Patrick Thier <pthier@chromium.org> | ||
Reviewed-by: Patrick Thier <pthier@chromium.org> | ||
Commit-Queue: Leszek Swirski <leszeks@chromium.org> | ||
Auto-Submit: Leszek Swirski <leszeks@chromium.org> | ||
Cr-Commit-Position: refs/heads/main@{#91709} | ||
|
||
diff --git a/src/maglev/maglev-graph-builder.cc b/src/maglev/maglev-graph-builder.cc | ||
index 2b660f5a8681a854b799d54761c425b04d1d0444..31c114481dee5bd171700acf321c79d941c6df98 100644 | ||
--- a/src/maglev/maglev-graph-builder.cc | ||
+++ b/src/maglev/maglev-graph-builder.cc | ||
@@ -5210,6 +5210,7 @@ bool MaglevGraphBuilder::TryBuildFindNonDefaultConstructorOrConstruct( | ||
object = BuildAllocateFastObject( | ||
FastObject(new_target_function->AsJSFunction(), zone(), broker()), | ||
AllocationType::kYoung); | ||
+ ClearCurrentRawAllocation(); | ||
} else { | ||
object = BuildCallBuiltin<Builtin::kFastNewObject>( | ||
{GetConstant(current_function), new_target}); |