[sandbox] Fix MicrotaskQueue liveness and serialization issues [v8/v8 : main]
0 views
Skip to first unread message
Igor Sheludko (Gerrit)
Jun 29, 2026, 11:01:49 AM (2 days ago) Jun 29
to Michael Lippautz, android-bu...@system.gserviceaccount.com, cbruni...@chromium.org, jgrube...@chromium.org, v8-re...@googlegroups.com, victorgo...@chromium.org
Attention needed from Michael Lippautz
Igor Sheludko voted and added 1 comment![]( "Open in Gerrit")
Votes added by Igor Sheludko
| Commit-Queue | +1 |
1 comment
Patchset-level comments
Related details
Attention is currently required from:
- Michael Lippautz
Submit Requirements:
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Michael Lippautz (Gerrit)
10:22 AM (11 hours ago) 10:22 AM
to Igor Sheludko, v8-s...@luci-project-accounts.iam.gserviceaccount.com, android-bu...@system.gserviceaccount.com, cbruni...@chromium.org, jgrube...@chromium.org, v8-re...@googlegroups.com, victorgo...@chromium.org
Attention needed from Igor Sheludko
Michael Lippautz voted and added 4 comments![]( "Open in Gerrit")
Votes added by Michael Lippautz
| Code-Review | +1 |
4 comments
Patchset-level comments
File include/v8-internal.h
Line 418, Patchset 10 (Latest):
constexpr uint64_t kCppHeapPointerTagMask = 0xfffe;Michael Lippautz . unresolved
Compute from shift?
File include/v8-sandbox.h
Line 64, Patchset 10 (Latest):
kMicrotaskQueueTag,Michael Lippautz . unresolved
Can we keep the stuff insite First/Last tag lexically sorted?
File src/objects/contexts.h
Line 862, Patchset 10 (Latest):
V(kMicrotaskQueueOffset, kMicrotaskQueueSlotSize) \Michael Lippautz . unresolved
Somewhere: Can you leave a TODO to implemented a `CppHeapMember`? We should provide the same primitive as TaggedMember to the C++ world here.
Related details
Attention is currently required from:
- Igor Sheludko
Submit Requirements:
Code-Owners
Code-Review
No-Unresolved-Comments
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Igor Sheludko (Gerrit)
12:03 PM (9 hours ago) 12:03 PM
to Michael Lippautz, v8-s...@luci-project-accounts.iam.gserviceaccount.com, android-bu...@system.gserviceaccount.com, cbruni...@chromium.org, jgrube...@chromium.org, v8-re...@googlegroups.com, victorgo...@chromium.org
Igor Sheludko voted and added 4 comments![]( "Open in Gerrit")
Votes added by Igor Sheludko
| Commit-Queue | +2 |
4 comments
Patchset-level comments
File include/v8-internal.h
Line 418, Patchset 10:
constexpr uint64_t kCppHeapPointerTagMask = 0xfffe;Michael Lippautz . resolved
Igor SheludkoCompute from shift?
Done
File include/v8-sandbox.h
Can we keep the stuff insite First/Last tag lexically sorted?
Igor Sheludko
Done
File src/objects/contexts.h
Line 862, Patchset 10:
V(kMicrotaskQueueOffset, kMicrotaskQueueSlotSize) \Michael Lippautz . resolved
Somewhere: Can you leave a TODO to implemented a `CppHeapMember`? We should provide the same primitive as TaggedMember to the C++ world here.
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Igor Sheludko (Gerrit)
1:16 PM (8 hours ago) 1:16 PM
to Michael Lippautz, v8-s...@luci-project-accounts.iam.gserviceaccount.com, android-bu...@system.gserviceaccount.com, cbruni...@chromium.org, jgrube...@chromium.org, v8-re...@googlegroups.com, victorgo...@chromium.org
Igor Sheludko voted Commit-Queue+2![]( "Open in Gerrit")
| Commit-Queue | +2 |
Related details
Attention set is empty
Submit Requirements:
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
v8-scoped@luci-project-accounts.iam.gserviceaccount.com (Gerrit)
1:18 PM (8 hours ago) 1:18 PM
to Igor Sheludko, Michael Lippautz, android-bu...@system.gserviceaccount.com, cbruni...@chromium.org, jgrube...@chromium.org, v8-re...@googlegroups.com, victorgo...@chromium.org
v8-s...@luci-project-accounts.iam.gserviceaccount.com submitted the change with unreviewed changes![]( "Open in Gerrit")
Unreviewed changes
10 is the latest approved patch-set.
The change was submitted with unreviewed changes in the following files:
```
The name of the file: test/mjsunit/d8/d8-realm-microtask-queue.js
Insertions: 4, Deletions: 3.
The diff is too large to show. Please review the diff.
```
```
The name of the file: include/v8-sandbox.h
Insertions: 1, Deletions: 1.
The diff is too large to show. Please review the diff.
```
```
The name of the file: src/objects/contexts.h
Insertions: 5, Deletions: 0.
The diff is too large to show. Please review the diff.
```
```
The name of the file: test/mjsunit/regress/regress-515252150.js
Insertions: 1, Deletions: 1.
The diff is too large to show. Please review the diff.
```
```
The name of the file: include/v8-internal.h
Insertions: 3, Deletions: 1.
The diff is too large to show. Please review the diff.
```
```
The name of the file: test/mjsunit/sandbox/regress/regress-508092629.js
Insertions: 2, Deletions: 4.
The diff is too large to show. Please review the diff.
```
Change information
Commit message:
[runtime] Fix MicrotaskQueue liveness and serialization issues
This fixes a Use-After-Free (UAF) vulnerability where the CppGC-managed
MicrotaskQueue in NativeContext was not traced by the V8 GC, allowing
it to be prematurely reclaimed.
In addition, this CL adds infrastructure in d8 and sandbox testing
tools to verify custom MicrotaskQueue lifecycle and isolation across
native contexts.
1. Extend Realm.create() with an option bag argument for requesting a
new realm to be created with its own MicrotaskQueue.
2. Extend SandboxTesting::GetFieldOffsetMap() and GetInstanceTypeMap()
with offsets for NativeContext's microtask_queue and JSFunction's
context fields, and export cppgc_microtask_queue in build config.
3. Add regression mjsunit tests verifying microtask queue separation
and triggering UAF via sandbox memory corruption Api.
TAG=agy
CONV=4bb71540-afc9-4de3-8c14-b9a4b213d916
Bug: 515252150
Bug: 508092629
Change-Id: I8a694a92bd0d3de618ff02deb0fb7c7bff27cc61
Reviewed-by: Michael Lippautz <mlip...@chromium.org>
Commit-Queue: Igor Sheludko <ish...@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108380}
Files:
- M BUILD.gn
- M bazel/defs.bzl
- M include/v8-internal.h
- M include/v8-sandbox.h
- M src/api/api.cc
- M src/builtins/builtins-microtask-queue-gen.cc
- M src/codegen/code-stub-assembler.cc
- M src/codegen/code-stub-assembler.h
- M src/d8/d8.cc
- M src/d8/d8.h
- M src/objects/contexts-inl.h
- M src/objects/contexts.cc
- M src/objects/contexts.h
- M src/objects/cpp-heap-object-wrapper.h
- M src/objects/object-macros.h
- M src/objects/objects-body-descriptors-inl.h
- M src/objects/slots-inl.h
- M src/objects/slots.h
- M src/sandbox/cppheap-pointer-table.h
- M src/sandbox/testing.cc
- M src/snapshot/context-serializer.cc
- M src/snapshot/serializer.cc
- A test/mjsunit/d8/d8-realm-microtask-queue.js
- M test/mjsunit/mjsunit.status
- A test/mjsunit/regress/regress-515252150.js
- A test/mjsunit/sandbox/regress/regress-508092629.js
Change size: L
Delta: 26 files changed, 441 insertions(+), 53 deletions(-)
Branch: refs/heads/main
Submit Requirements:
Code-Review: +1 by Michael Lippautz
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages