7887ae6fc3
The AsmParser kept pointers into ZoneVectors, which were accessed even after those vector might have grown. For regular vectors, this would be a use-after-free; with ZoneVectors it is technically allowed, since the old memory stays alive. This will change with https://crrev.com/c/2302895, which zaps zone memory which is deallocated. Eventually, we might want to reuse large deallocations in zone memory, hence this "use after free" needs to be fixed. This CL fixes the issue by explicitly re-allocating in the zone instead of using ZoneVectors. This makes sure that the old memory stays alive. This is kind of a quick-fix, but since asm.js is more or less deprecated anyway (in favor of Wasm), it's OK if this code does not profit from future ZoneVector memory re-use optimizations. Drive-by: Move field initializers to the field declaration. R=ishell@chromium.org Bug: v8:10717 Change-Id: I56c1feb49d05080e78a6620273b55b4e18156254 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304581 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#68917} |
||
|---|---|---|
| build_overrides | ||
| custom_deps | ||
| docs | ||
| gni | ||
| include | ||
| infra | ||
| samples | ||
| src | ||
| test | ||
| testing | ||
| third_party | ||
| tools | ||
| .clang-format | ||
| .clang-tidy | ||
| .editorconfig | ||
| .flake8 | ||
| .git-blame-ignore-revs | ||
| .gitattributes | ||
| .gitignore | ||
| .gn | ||
| .vpython | ||
| .ycm_extra_conf.py | ||
| AUTHORS | ||
| BUILD.gn | ||
| CODE_OF_CONDUCT.md | ||
| codereview.settings | ||
| COMMON_OWNERS | ||
| DEPS | ||
| ENG_REVIEW_OWNERS | ||
| INFRA_OWNERS | ||
| INTL_OWNERS | ||
| LICENSE | ||
| LICENSE.fdlibm | ||
| LICENSE.strongtalk | ||
| LICENSE.v8 | ||
| LICENSE.valgrind | ||
| MIPS_OWNERS | ||
| OWNERS | ||
| PPC_OWNERS | ||
| PRESUBMIT.py | ||
| README.md | ||
| S390_OWNERS | ||
| WATCHLISTS | ||
V8 JavaScript Engine
V8 is Google's open source JavaScript engine.
V8 implements ECMAScript as specified in ECMA-262.
V8 is written in C++ and is used in Google Chrome, the open source browser from Google.
V8 can run standalone, or can be embedded into any C++ application.
V8 Project page: https://v8.dev/docs
Getting the Code
Checkout depot tools, and run
fetch v8
This will checkout V8 into the directory v8 and fetch all of its dependencies.
To stay up to date, run
git pull origin
gclient sync
For fetching all branches, add the following into your remote
configuration in .git/config:
fetch = +refs/branch-heads/*:refs/remotes/branch-heads/*
fetch = +refs/tags/*:refs/tags/*
Contributing
Please follow the instructions mentioned at v8.dev/docs/contribute.