Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: cherry-pick a5f54612590d from chromium #31901

merged 1 commit into from Nov 30, 2021


Copy link

@ppontes ppontes commented Nov 18, 2021

M96: Storage Foundation: Avoid cross-thread access of DOMArrayBufferView.

blink::NativeIOFile::{read, write}() (in the Storage Foundation API
implementation) pass DOMArrayBufferView instances to
blink::NativeIOFile::Do{Read,Write}() via CrossThreadPersistent.
blink::NativeIOFile::Do{Read,Write}() accesses these instances.

CrossThreadPersistent can be used across threads to keep a garbage
collected object alive. However, accessing the object on a different
thread is not safe. cppgc::subtle::CrossThreadPersistent
(blink::CrossThreadPersistent is an alias to that) has comments
explaining that the garbage collected heap can go away while the
CrossThreadPersistent instance exists.

This CL bypasses the problem by having Do{Read,Write}() receive a
ArrayBufferContents that has the DOMArrayBufferView's backing buffer.
ArrayBufferContents is not garbage-collected, so it can be safely used
across threads.

This CL introduces a NativeIODataBuffer class that contains the logic
and state for tearing a DOMArrayBufferView apart into its components
(backing buffer, view type, view offset, view length) and putting it
back together into a new DOMArrayBufferView, after it doesn't need to be
accessed cross-thread anymore.

(cherry picked from commit 5200793c2aea5979cc79f3350a4e3d6c0795d6f2)

Bug: 1268274
Change-Id: I51588f5bfe963de96ce426e0f480e8c5b4902688
Commit-Queue: Victor Costan
Reviewed-by: enne
Reviewed-by: Joshua Bell
Cr-Original-Commit-Position: refs/heads/main@{#940070}
Bot-Commit: Rubber Stamper
Cr-Commit-Position: refs/branch-heads/4664@{#941}
Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512}

Notes: Backported fix for CVE-2021-38011.

@ppontes ppontes requested a review from a team as a code owner November 18, 2021 19:55
@ppontes ppontes added 13-x-y backport-check-skip Skip trop's backport validity checking semver/patch backwards-compatible bug fixes labels Nov 18, 2021
@electron-cation electron-cation bot added new-pr 🌱 PR opened in the last 24 hours and removed new-pr 🌱 PR opened in the last 24 hours labels Nov 18, 2021
@ppontes ppontes force-pushed the cherry-pick/13-x-y/chromium/a5f54612590d branch from 973cc23 to 873dad5 Compare November 20, 2021 00:40
@ppontes ppontes force-pushed the cherry-pick/13-x-y/chromium/a5f54612590d branch from 43655cf to e8f3f8b Compare November 26, 2021 13:21
Copy link

Merging as CI failures are unrelated to PR change.

@jkleinsc jkleinsc merged commit 39d55f0 into 13-x-y Nov 30, 2021
@jkleinsc jkleinsc deleted the cherry-pick/13-x-y/chromium/a5f54612590d branch November 30, 2021 21:51
Copy link

release-clerk bot commented Nov 30, 2021

Release Notes Persisted

Backported fix for CVE-2021-38011.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
13-x-y backport-check-skip Skip trop's backport validity checking security 🔒 semver/patch backwards-compatible bug fixes
None yet

Successfully merging this pull request may close these issues.

None yet

2 participants