lukechilds/node - node - Gitea: Git with a cup of tea

16198 Commits

131 Branches

446 Tags

325 MiB

Tree: 3585ffa247

Commit Graph

Author	SHA1	Message	Date
Cristian Cavalli	ee09828622	deps: backport 2bd7464 from upstream V8 Original commit message: For global object property cells, we did not check that the map on the previous object is still the same for which we actually optimized. So the optimized code was not in sync with the actual state of the property cell. When loading from such a global object property cell, Crankshaft optimizes away any map checks (based on the stable map assumption), leading to arbitrary memory access in the worst case. TurboFan has the same bug for stores, but is safe on loads because we do appropriate map checks there. However mixing TurboFan and Crankshaft still exposes the bug. R=yangguo@chromium.org BUG=chromium:659475 Review-Url: https://codereview.chromium.org/2444233004 Cr-Commit-Position: refs/heads/master@{#40592} PR-URL: https://github.com/nodejs/node/pull/10169 Reviewed-By: bnoordhuis - Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: ofrobots - Ali Ijaz Sheikh <ofrobots@google.com>	8 years ago

Author

SHA1

Message

Date

Cristian Cavalli

ee09828622

deps: backport 2bd7464 from upstream V8

Original commit message:
  For global object property cells, we did not check that the map on the
  previous object is still the same for which we actually optimized. So
  the optimized code was not in sync with the actual state of the property
  cell. When loading from such a global object property cell, Crankshaft
  optimizes away any map checks (based on the stable map assumption),
  leading to arbitrary memory access in the worst case.

  TurboFan has the same bug for stores, but is safe on loads because we
  do appropriate map checks there. However mixing TurboFan and Crankshaft
  still exposes the bug.

  R=yangguo@chromium.org
  BUG=chromium:659475

  Review-Url: https://codereview.chromium.org/2444233004
  Cr-Commit-Position: refs/heads/master@{#40592}

PR-URL: https://github.com/nodejs/node/pull/10169
Reviewed-By: bnoordhuis - Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: ofrobots - Ali Ijaz Sheikh <ofrobots@google.com>

8 years ago

1 Commits (3585ffa247e9ae87310aa101fa418595aad11dc9)