Issue 13058 in v8: Enable the V8 Sandbox on V8 bots

212 views
Skip to first unread message

sa… via monorail

unread,
Jul 11, 2022, 8:42:35 AM7/11/22
to v8-re...@googlegroups.com
Status: Available
Owner: ----
CC: mache...@chromium.org, sa...@chromium.org
Components: Infrastructure Sandbox
Type: FeatureRequest

New issue 13058 by sa...@chromium.org: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058

The V8 sandbox (go/ubercage) is enabled by default in Chromium. To test and benchmark the configuration of V8 that ships in Chromium, and to avoid breakages during V8 -> Chromium rolls, we should also enable the V8 sandbox (gn arg `v8_enable_sandbox = true`) on as many V8 bots as possible. However, we should also test the non-sandbox configuration. In particular:

- x64 (and I guess arm64?) V8 CI, Try and perf bots should all enable it
- No changes to Chromium bots are necessary as the sandbox is automatically enabled when building with Chromium
- Non-Chromium embedder bots (Node.js, Bazel, ...) should keep using the default configuration (i.e. sandbox off)
- There should be a new set of x64 release and debug bot with one trybot in CQ with the sandbox explicitly disabled (`v8_enable_sandbox = false`)
- The multiarch build of the correctness fuzzer (see https://source.chromium.org/chromium/chromium/src/+/main:v8/BUILD.gn;l=471) should include it as well

--
You received this message because:
1. The project was configured to send all issue notifications to this address

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings

mache… via monorail

unread,
Jul 14, 2022, 8:07:50 AM7/14/22
to v8-re...@googlegroups.com
Updates:
Owner: almut...@chromium.org
Status: Assigned

Comment #1 on issue 13058 by mache...@chromium.org: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c1

All sg. We'll have one problem with the "official" bots from V8. They have gn settings outside of the V8 repo. E.g. the basic contract was that those bots would not need any settings as they exactly build what we ship. Now we'd need to set a gn flag explicitly to enable the sandbox.

It's currently not clear on how to do that across releases. Note that one archive builder builds beta/stable/canary builds. On some older branches, the gn flag won't exist yet. Need to think about that. Until then we can also maybe just have it off on those bots.

Al, could you start looking into creating a set of bots for no-sandbox?

sa… via monorail

unread,
Jul 19, 2022, 7:21:25 AM7/19/22
to v8-re...@googlegroups.com

Comment #2 on issue 13058 by sa...@chromium.org: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c2

I'm going to disable the sandbox in BUILD.gn today (unless we're building with Chromium) because of the upcoming branch, which means we'll loose sandbox coverage on the V8 bots. So it'd be great to get the performance and test coverage for the sandbox back soon (i.e. the `v8_enable_sandbox = true` gn arg for the V8 builders). Thanks!

Git Watcher via monorail

unread,
Jul 19, 2022, 8:38:33 AM7/19/22
to v8-re...@googlegroups.com

Comment #3 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c3

The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8/+/a7329344e52a0af3461aacaa8c538ddf8992e0d6

commit a7329344e52a0af3461aacaa8c538ddf8992e0d6
Author: Samuel Groß <sa...@chromium.org>
Date: Tue Jul 19 11:22:14 2022

[sandbox] Disable the sandbox by default outside of Chromium builds

To work properly and securely, the sandbox requires cooperation from the
Embedder, for example in the form of a custom ArrayBufferAllocator and
later on custom type tags for external objects. As such, it likely does
not make sense to enable the sandbox by default everywhere.

Bug: v8:10391, v8:13058
Change-Id: Ief2720122f70b9a1bc3f2e6802e60b5b95b855d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3771841
Reviewed-by: Igor Sheludko <ish...@chromium.org>
Commit-Queue: Samuel Groß <sa...@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81805}

[modify] https://crrev.com/a7329344e52a0af3461aacaa8c538ddf8992e0d6/BUILD.gn

mache… via monorail

unread,
Jul 25, 2022, 8:28:41 AM7/25/22
to v8-re...@googlegroups.com
Updates:
Labels: Priority-1

Comment #4 on issue 13058 by mache...@chromium.org: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c4

Almothana, any updates?

Alternatively we could add a new variables v8_stand_alone=true to the build_overrides/build.gni file? And then embedders can keep this false. I.e. we'd set it to false on the node.js integration bot.

If we don't do this, we'd need to inject the sandbox-on flag in mb_config.py in various mixins, and then create copies of those mixins for the bots where we want to keep it off...

No matter what we choose, we also need a set of bots for no-sandbox as per issue description.

Git Watcher via monorail

unread,
Aug 4, 2022, 5:33:15 AM8/4/22
to v8-re...@googlegroups.com

Comment #5 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c5


The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8/+/161d7f929902e52a2219bed3ab4e944758bcdbe6

commit 161d7f929902e52a2219bed3ab4e944758bcdbe6
Author: Al Muthanna Athamina <almut...@chromium.org>
Date: Wed Aug 03 12:16:38 2022

[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off

Bug: v8:13058
Change-Id: Ie3d4f87080fd1076edff1ee75cb03ee8ea4db505
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3788096
Reviewed-by: Michael Achenbach <mache...@chromium.org>
Commit-Queue: Almothana Athamneh <almut...@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82191}

[modify] https://crrev.com/161d7f929902e52a2219bed3ab4e944758bcdbe6/infra/mb/mb_config.pyl
[modify] https://crrev.com/161d7f929902e52a2219bed3ab4e944758bcdbe6/infra/testing/builders.pyl

Git Watcher via monorail

unread,
Aug 4, 2022, 5:44:14 AM8/4/22
to v8-re...@googlegroups.com

Git Watcher via monorail

unread,
Aug 4, 2022, 5:46:14 AM8/4/22
to v8-re...@googlegroups.com

Comment #7 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c7


The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8/+/afd0933317c3197745cffa25b8059a959477ec5a

commit afd0933317c3197745cffa25b8059a959477ec5a
Author: Michael Achenbach <mache...@chromium.org>
Date: Thu Aug 04 09:44:35 2022

Revert "[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off"

This reverts commit 161d7f929902e52a2219bed3ab4e944758bcdbe6.

Reason for revert:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Clusterfuzz%20Linux64%20-%20release%20builder/29779/overview

Original change's description:
> [infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off
>
> Bug: v8:13058
> Change-Id: Ie3d4f87080fd1076edff1ee75cb03ee8ea4db505
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3788096

> Reviewed-by: Michael Achenbach <mache...@chromium.org>
> Commit-Queue: Almothana Athamneh <almut...@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82191}

Bug: v8:13058
Change-Id: I68a4097074150f2cf7cca9c776054dca19597fcc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810611
Auto-Submit: Michael Achenbach <mache...@chromium.org>
Commit-Queue: Rubber Stamper <rubber-...@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-...@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82192}

[modify] https://crrev.com/afd0933317c3197745cffa25b8059a959477ec5a/infra/mb/mb_config.pyl
[modify] https://crrev.com/afd0933317c3197745cffa25b8059a959477ec5a/infra/testing/builders.pyl

Git Watcher via monorail

unread,
Aug 5, 2022, 4:20:13 AM8/5/22
to v8-re...@googlegroups.com

Comment #8 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c8


The following revision refers to this bug:

Author: Al Muthanna Athamina <almut...@chromium.org>
Date: Thu Aug 04 13:15:40 2022


[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off

Bug: v8:13058
Change-Id: If9d500f46f02ed3588d2b0e3904567c61aaddd12
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810184

Reviewed-by: Michael Achenbach <mache...@chromium.org>
Commit-Queue: Almothana Athamneh <almut...@chromium.org>

Git Watcher via monorail

unread,
Aug 5, 2022, 4:46:18 AM8/5/22
to v8-re...@googlegroups.com

Comment #9 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c9


The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8/+/9179ea3ca1711ff729b828de26b256a0c79cda02

commit 9179ea3ca1711ff729b828de26b256a0c79cda02
Author: Nico Hartmann <nicoha...@chromium.org>
Date: Fri Aug 05 08:44:48 2022

Revert "[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off"

This reverts commit 2055c3b48233c2706ae5c22896508b5ad0621353.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Clusterfuzz%20Linux64%20-%20release%20builder/29801/overview

Original change's description:

> [infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off
>
> Bug: v8:13058
> Change-Id: If9d500f46f02ed3588d2b0e3904567c61aaddd12
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810184
> Reviewed-by: Michael Achenbach <mache...@chromium.org>
> Commit-Queue: Almothana Athamneh <almut...@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82213}

Bug: v8:13058
Change-Id: I63b86420d12fb4bf0333e9e52b17763c9d80afce

No-Presubmit: true
No-Tree-Checks: true
No-Try: true

Git Watcher via monorail

unread,
Aug 5, 2022, 7:48:14 AM8/5/22
to v8-re...@googlegroups.com

Comment #10 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c10


The following revision refers to this bug:

Author: Al Muthanna Athamina <almut...@chromium.org>
Date: Fri Aug 05 09:39:34 2022

Reland "[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off"

This is a reland of commit 2055c3b48233c2706ae5c22896508b5ad0621353


Original change's description:
> [infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off
>
> Bug: v8:13058
> Change-Id: If9d500f46f02ed3588d2b0e3904567c61aaddd12
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810184
> Reviewed-by: Michael Achenbach <mache...@chromium.org>
> Commit-Queue: Almothana Athamneh <almut...@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82213}

Bug: v8:13058
Change-Id: I315fd1cd5c36464b1a15c635c8f31825769c3eb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812042
Auto-Submit: Almothana Athamneh <almut...@chromium.org>

Reviewed-by: Michael Achenbach <mache...@chromium.org>
Commit-Queue: Almothana Athamneh <almut...@chromium.org>

Git Watcher via monorail

unread,
Aug 5, 2022, 8:18:13 AM8/5/22
to v8-re...@googlegroups.com

Comment #11 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c11


The following revision refers to this bug:

Author: Al Muthanna Athamina <almut...@chromium.org>
Date: Fri Aug 05 12:15:10 2022

[infra] Add "no" to pointer compression naming convention

Bug: v8:13058
Change-Id: I2a90e3ef4f4b455d6ece47a809defc975f09e1bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810351

Reviewed-by: Michael Achenbach <mache...@chromium.org>
Commit-Queue: Almothana Athamneh <almut...@chromium.org>

Git Watcher via monorail

unread,
Aug 5, 2022, 8:25:16 AM8/5/22
to v8-re...@googlegroups.com

Git Watcher via monorail

unread,
Aug 5, 2022, 9:29:13 AM8/5/22
to v8-re...@googlegroups.com

Comment #13 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c13


The following revision refers to this bug:

Author: Al Muthanna Athamina <almut...@chromium.org>
Date: Fri Aug 05 13:24:12 2022

Revert "Reland "[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off""

This reverts commit fe327545e382e7ca2469c64accedee50de5de7cd.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/8615/overview

Original change's description:

> Reland "[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off"
>
> This is a reland of commit 2055c3b48233c2706ae5c22896508b5ad0621353
>
> Original change's description:
> > [infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off
> >
> > Bug: v8:13058
> > Change-Id: If9d500f46f02ed3588d2b0e3904567c61aaddd12
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810184
> > Reviewed-by: Michael Achenbach <mache...@chromium.org>
> > Commit-Queue: Almothana Athamneh <almut...@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#82213}
>
> Bug: v8:13058
> Change-Id: I315fd1cd5c36464b1a15c635c8f31825769c3eb0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3812042
> Auto-Submit: Almothana Athamneh <almut...@chromium.org>
> Reviewed-by: Michael Achenbach <mache...@chromium.org>

> Commit-Queue: Almothana Athamneh <almut...@chromium.org>
> Commit-Queue: Michael Achenbach <mache...@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82221}

Bug: v8:13058
Change-Id: Icb621fac3758384e0b04520585f5c998563c1f6f

No-Presubmit: true
No-Tree-Checks: true
No-Try: true

Git Watcher via monorail

unread,
Aug 11, 2022, 6:36:14 AM8/11/22
to v8-re...@googlegroups.com

Comment #14 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c14


The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8/+/c5d322c81c63c9727ace4e26f9128bb1f2a9c5b0

commit c5d322c81c63c9727ace4e26f9128bb1f2a9c5b0
Author: Liviu Rau <livi...@chromium.org>
Date: Thu Aug 11 08:05:53 2022

Move no-sandbox builders to experiments until config gets fixed

In main console having a red builder console that does not close the tree is confusing for the sheriffs.

Drive by refactoring: remove bucket arg from all experimental builders and use a default in the builder factory.

Bug: v8:13058
Change-Id: I60dadbc5e96aaaed3e97cb7941b6a8aac776baf9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3825878
Reviewed-by: Alexander Schulze <alexs...@chromium.org>
Commit-Queue: Liviu Rau <livi...@google.com>

[modify] https://crrev.com/c5d322c81c63c9727ace4e26f9128bb1f2a9c5b0/generated/luci-scheduler.cfg
[modify] https://crrev.com/c5d322c81c63c9727ace4e26f9128bb1f2a9c5b0/builders/experiments.star
[modify] https://crrev.com/c5d322c81c63c9727ace4e26f9128bb1f2a9c5b0/builders/multibranch/main.star
[modify] https://crrev.com/c5d322c81c63c9727ace4e26f9128bb1f2a9c5b0/generated/project.cfg
[modify] https://crrev.com/c5d322c81c63c9727ace4e26f9128bb1f2a9c5b0/generated/cr-buildbucket.cfg
[modify] https://crrev.com/c5d322c81c63c9727ace4e26f9128bb1f2a9c5b0/generated/luci-milo.cfg

Git Watcher via monorail

unread,
Aug 16, 2022, 5:23:13 AM8/16/22
to v8-re...@googlegroups.com

Comment #15 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c15


The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8/+/2ecee896deb8094f1a6047f7123ddbb06183a9ad

commit 2ecee896deb8094f1a6047f7123ddbb06183a9ad
Author: Almothana Athamneh <almut...@chromium.org>
Date: Fri Aug 05 13:30:25 2022

Reland "Reland "[infra] Enable sandbox for x64 and arm64 builders and add a set of builders with Sandbox off""

This reverts commit e6bcabd10cc288f4439f4d23b4a1be19fce13c7e.

Reason for revert: preparation to reland for when the errors are solved

Original change's description:
Bug: v8:13058
Cq-Include-Trybots: luci.v8.try.triggered:v8_linux64_tsan_rel_ng_triggered
Change-Id: Ifc8ecd1e7fc2ccc58718f662fbade1a66c46aa13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811585
Bot-Commit: Rubber Stamper <rubber-...@appspot.gserviceaccount.com>

Reviewed-by: Michael Achenbach <mache...@chromium.org>
Commit-Queue: Almothana Athamneh <almut...@chromium.org>

Git Watcher via monorail

unread,
Aug 16, 2022, 7:43:06 AM8/16/22
to v8-re...@googlegroups.com

Comment #16 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c16


The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8/+/99378a477753ff724c6449e2716d1fb325791be7

commit 99378a477753ff724c6449e2716d1fb325791be7
Author: Liviu Rau <livi...@chromium.org>
Date: Tue Aug 16 10:13:27 2022

Add 'no sandbox' builders to scheduler

Bug: v8:13058
Change-Id: Id7d063500f6f1703fc67508ffdef10df5e1e8ea6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3833815
Reviewed-by: Almothana Athamneh <almut...@chromium.org>
Commit-Queue: Liviu Rau <livi...@google.com>

[modify] https://crrev.com/99378a477753ff724c6449e2716d1fb325791be7/generated/luci-scheduler.cfg
[modify] https://crrev.com/99378a477753ff724c6449e2716d1fb325791be7/builders/experiments.star
[modify] https://crrev.com/99378a477753ff724c6449e2716d1fb325791be7/generated/project.cfg

Git Watcher via monorail

unread,
Aug 16, 2022, 9:45:07 AM8/16/22
to v8-re...@googlegroups.com

Comment #17 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c17


The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8/+/06e7b4599bab9ccad256bdc8a4042150cd2b9bc0

commit 06e7b4599bab9ccad256bdc8a4042150cd2b9bc0
Author: Liviu Rau <livi...@chromium.org>
Date: Tue Aug 16 13:33:48 2022

Make builder_group property default in experiments

Fixing infra failure in 'no sandbox' builders.

Bug: v8:13058
Change-Id: I2a7a256fb28221cdaa90dfc16da2423548ff9965
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3834030
Commit-Queue: Liviu Rau <livi...@google.com>
Reviewed-by: Alexander Schulze <alexs...@chromium.org>

[modify] https://crrev.com/06e7b4599bab9ccad256bdc8a4042150cd2b9bc0/builders/experiments.star
[modify] https://crrev.com/06e7b4599bab9ccad256bdc8a4042150cd2b9bc0/generated/cr-buildbucket.cfg

mache… via monorail

unread,
Nov 18, 2022, 10:55:53 AM11/18/22
to v8-re...@googlegroups.com

Comment #18 on issue 13058 by mache...@chromium.org: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c18

Update: By now the sandbox is on by default.

Al, could you change mb_config.py again accordingly and remove the redundant settings that enable the sandbox. We keep the builders that turn sandbox off explicitly. That setting could now be decoupled from x64.

Git Watcher via monorail

unread,
Nov 22, 2022, 5:36:12 AM11/22/22
to v8-re...@googlegroups.com

Comment #19 on issue 13058 by Git Watcher: Enable the V8 Sandbox on V8 bots
https://bugs.chromium.org/p/v8/issues/detail?id=13058#c19


The following revision refers to this bug:

Author: Al Muthanna Athamina <almut...@chromium.org>
Date: Tue Nov 22 09:47:00 2022

[infra] Removing redundant sandbox setting since it is on by default

Bug: v8:13058
Change-Id: Ifb7e9621b59dfae0f34857f944abd3881fe9fad2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4042541
Commit-Queue: Almothana Athamneh <almut...@chromium.org>
Reviewed-by: Michael Achenbach <mache...@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84418}

[modify] https://crrev.com/858e87894af5bbbc47b1a113cb4f2b490e4502e5/infra/mb/mb_config.pyl
Reply all
Reply to author
Forward
0 new messages