[sandbox] Guard against freelist corruption in JSDispatchTable [v8/v8 : main]
chromeperf@appspot.gserviceaccount.com (Gerrit)
Message from chrom...@appspot.gserviceaccount.com![]( "Open in Gerrit")
📍 Job mac-m4-mini-perf/jetstream-main.crossbench complete.
See results at: https://pinpoint-dot-chromeperf.appspot.com/job/11a98407490000
Related details
- Arash Kazemi
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
chromeperf@appspot.gserviceaccount.com (Gerrit)
Message from chrom...@appspot.gserviceaccount.com![]( "Open in Gerrit")
📍 Job mac-m4-mini-perf/jetstream-main.crossbench complete.
See results at: https://pinpoint-dot-chromeperf.appspot.com/job/14834fcf490000
Related details
- Arash Kazemi
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Arash Kazemi (Gerrit)
Arash Kazemi added 2 comments![]( "Open in Gerrit")
SBXCHECK(IsFreelistEntry());Was your idea to instead create a dedicated bottleneck for all `entrypoint_` loads that returns nullpointer if it's a free list entry?
Related details
- Samuel Groß
Code-Owners
Code-Review
No-Unresolved-Comments
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Samuel Groß (Gerrit)
Samuel Groß added 1 comment![]( "Open in Gerrit")
SBXCHECK(IsFreelistEntry());Was your idea to instead create a dedicated bottleneck for all `entrypoint_` loads that returns nullpointer if it's a free list entry?
Yeah so my concern here is that this approach seems fundamentally racy: `IsFreelistEntry()` will load the entrypoint and check for a specific tag. Then we load the entrypoint again and just drop the upper 32 bits. If the entry is overwritten in the meantime, we still have the same problem. I think we need to do what the other tables do: atomically load the entrypoint value, check that it has the expected tag, then return the lower 32 bits (or do proper untagging). And then I think we don't actually need to worry about freelist entries getting overwritten? WDYT?
Related details
- Arash Kazemi
Code-Owners
Code-Review
No-Unresolved-Comments
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |