[builtins] Fix external-string UAF in StringSubstring on GC transition [v8/v8 : main]
0 views
Skip to first unread message
Jakob Linke (Gerrit)
Jul 24, 2026, 4:43:53 AM (yesterday) Jul 24
to Victor Gomes, v8-s...@luci-project-accounts.iam.gserviceaccount.com, v8-re...@googlegroups.com
Attention needed from Victor Gomes
Jakob Linke voted Auto-Submit+1![]( "Open in Gerrit")
| Auto-Submit | +1 |
Related details
Attention is currently required from:
- Victor Gomes
Submit Requirements:
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Olivier Flückiger (Gerrit)
Jul 24, 2026, 6:14:08 AM (23 hours ago) Jul 24
to Jakob Linke, Victor Gomes, v8-s...@luci-project-accounts.iam.gserviceaccount.com, v8-re...@googlegroups.com
Attention needed from Jakob Linke and Victor Gomes
Olivier Flückiger voted and added 1 comment![]( "Open in Gerrit")
Votes added by Olivier Flückiger
| Code-Review | +1 |
| Commit-Queue | +2 |
1 comment
Patchset-level comments
Related details
Attention is currently required from:
- Jakob Linke
- Victor Gomes
Submit Requirements:
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
v8-scoped@luci-project-accounts.iam.gserviceaccount.com (Gerrit)
Jul 24, 2026, 6:18:43 AM (23 hours ago) Jul 24
to Jakob Linke, Olivier Flückiger, Victor Gomes, v8-re...@googlegroups.com
v8-s...@luci-project-accounts.iam.gserviceaccount.com submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[builtins] Fix external-string UAF in StringSubstring on GC transition
SubString's external path hands AllocAndCopyStringCharacters a raw
pointer into the external resource, then allocates the result; a GC
during that allocation can internalize the source in place. 692245fd4b3
added a post-allocation re-check for sequential sources but skipped
external ones as unable to transition, an assumption dc19ad0e517 then
broke by internalizing one-byte-content external two-byte strings to a
non-external copy, which frees the resource and dangles the pointer.
Reading the freed memory trips the two-byte-to-one-byte CSA_DCHECK on
x64 (a heap-use-after-free on arm, garbage in release). Thread the
tagged source through and bail to the runtime if it is no longer
external after the allocation.
Fixed: 537813778
Change-Id: Id9be7b36627ad10935b13d110e2db68976e5437c
Reviewed-by: Olivier Flückiger <ol...@chromium.org>
Commit-Queue: Olivier Flückiger <ol...@chromium.org>
Auto-Submit: Jakob Linke <jgr...@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108862}
Files:
- M src/builtins/builtins-string-gen.cc
- M src/builtins/builtins-string-gen.h
- M test/mjsunit/mjsunit.status
- A test/mjsunit/regress/regress-537813778.js
Change size: M
Delta: 4 files changed, 48 insertions(+), 17 deletions(-)
Branch: refs/heads/main
Submit Requirements:
Code-Review: +1 by Olivier Flückiger
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages