8a59678b83
This CL does the following: - It enables (i.e. allocates and initializes) the per-Isolate ExternalPointerTable when the sandbox is enabled. - It refactors the list of external pointer tags to mark them as "sandboxed" or "unsandboxed". An unsandboxed external pointer has a null tag. - It changes V8_SANDBOXED_EXTERNAL_POINTERS to now essentially just enable sandboxing for all available tags. - It modifies all low-level external pointer accessors to perform the ExternalPointerLookup only if the tag is non-zero and otherwise treat the slot as containing a raw pointer. This now allows rolling out external pointer sandboxing incrementally (separately for each external pointer type), which will in turn allow for more precise performance measurements of the impact of the sandbox. Note: when an external pointer tag is now marked as sandboxed (and V8_SANDBOXED_EXTERNAL_POINTERS is not enabled), the underlying slots are still 64-bits in size. This simplifies the implementation as we would otherwise need to deal with variably-sized external pointer slots. Local benchmarking suggests that the benefits from 32-bit external pointer slots are insignificant on typical benchmarks, so this should be ok. Drive-by: rename kExternalPointerSize to kExternalPointerSlotSize to make it more clear what it refers to (the on-heap storage size). Also delete CodeStubAssembler::InitializeExternalPointerField as it is not currently used and the implementation is fairly inefficient. Bug: v8:10391 Change-Id: I7c38729c7e9048d737a1a8ced84749f5b1f7feab Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3736447 Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#81636} |
||
---|---|---|
.. | ||
cppgc | ||
libplatform | ||
APIDesign.md | ||
DEPS | ||
DIR_METADATA | ||
js_protocol-1.2.json | ||
js_protocol-1.3.json | ||
js_protocol.pdl | ||
OWNERS | ||
v8-array-buffer.h | ||
v8-callbacks.h | ||
v8-container.h | ||
v8-context.h | ||
v8-cppgc.h | ||
v8-data.h | ||
v8-date.h | ||
v8-debug.h | ||
v8-embedder-heap.h | ||
v8-embedder-state-scope.h | ||
v8-exception.h | ||
v8-extension.h | ||
v8-external.h | ||
v8-fast-api-calls.h | ||
v8-forward.h | ||
v8-function-callback.h | ||
v8-function.h | ||
v8-initialization.h | ||
v8-inspector-protocol.h | ||
v8-inspector.h | ||
v8-internal.h | ||
v8-isolate.h | ||
v8-json.h | ||
v8-local-handle.h | ||
v8-locker.h | ||
v8-maybe.h | ||
v8-memory-span.h | ||
v8-message.h | ||
v8-metrics.h | ||
v8-microtask-queue.h | ||
v8-microtask.h | ||
v8-object.h | ||
v8-persistent-handle.h | ||
v8-platform.h | ||
v8-primitive-object.h | ||
v8-primitive.h | ||
v8-profiler.h | ||
v8-promise.h | ||
v8-proxy.h | ||
v8-regexp.h | ||
v8-script.h | ||
v8-snapshot.h | ||
v8-statistics.h | ||
v8-template.h | ||
v8-traced-handle.h | ||
v8-typed-array.h | ||
v8-unwinder-state.h | ||
v8-unwinder.h | ||
v8-util.h | ||
v8-value-serializer-version.h | ||
v8-value-serializer.h | ||
v8-value.h | ||
v8-version-string.h | ||
v8-version.h | ||
v8-wasm-trap-handler-posix.h | ||
v8-wasm-trap-handler-win.h | ||
v8-wasm.h | ||
v8-weak-callback-info.h | ||
v8.h | ||
v8config.h |