Heap zone enforce passable state and state shape #10170
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mhofman
force-pushed
the
mhofman/endo-1648-heap-zone-state-checks
branch
from
d94eb32
to
18454b6
Compare
Deploying agoric-sdk with
|
| Latest commit: |
ec8191b
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://6012ebe0.agoric-sdk.pages.dev |
| Branch Preview URL: | https://mhofman-endo-1648-heap-zone.agoric-sdk.pages.dev |
Merged
mhofman
force-pushed
the
mhofman/endo-1648-heap-zone-state-checks
branch
from
6f5c965
to
48bfbfb
Compare
mhofman
force-pushed
the
mhofman/passable-exo-state
branch
from
518a68b
to
4f07d1c
Compare
mergify bot
added a commit
that referenced
this pull request
Oct 5, 2024
refs: #10170 refs: endojs/endo#1648 best reviewed by ignoring white space ## Description After implementing a change to enforce that heap exo are passable, I found that some things currently stored in heap exos, mostly in tests, are not actually passable. Almost all of them are remotable like objects not marked as `Far`, usually related to storage nodes. While I plan on moving the implementation of the checks into endo instead of landing it in agoric-sdk first, I figured we should already fix the issues found. ### Security Considerations None ### Scaling Considerations None ### Documentation Considerations None ### Testing Considerations See #10170 for passing tests with checks enabled ### Upgrade Considerations As it's a heap zone change, cross upgrade behavior is not involved. In the future any code using a stricter heap zone would need to comply. However heaps zones are used as packages bundled by the contract, and are not provided by liveslots or zcf, so there is no compatibility risk.
|
Base branch is changed to master. Please re-run the integration tests by adding 'force:integration' label. |
mhofman
force-pushed
the
mhofman/endo-1648-heap-zone-state-checks
branch
from
48bfbfb
to
ec8191b
Compare
erights
requested changes
Oct 17, 2024
There was a problem hiding this comment.
This likely should move into Endo itself
Yes. I would prefer that you do it this way from the outset. If you then want to make it available to agoric-sdk before the next round of endo sync, do that with an agoric-sdk patch of endo, as we’ve done on other such occasions.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
refs: endojs/endo#1648
Description
Check heap exo state to be passable and match any stateShape provided. Implements the checks by wrapping the endo defineExo functions to replace their
initfunction with one that creates state accessors similar to the ones created by liveslots.This likely should move into Endo itself
Security Considerations
Enforces previously ignored invariants of exos
Scaling Considerations
Similar to liveslots, exo classes (and kits) share a prototype object. If a state shape is provided, the accessors are created on that prototype.
To avoid WeakMap costs, the state when using a shape uses a private field to hold the data.
Documentation Considerations
This is a breaking change in the sense that some stated invariants of exo / zone were not actually enforced. Some tests seemed to be relying on this lack of enforcement.
Testing Considerations
Trivial updates of breaking tests
TODO: add thorough checking of exo state accessors
Verify that the checks done here are consistent with the checks done by liveslots. In particular an exo without state shape may not accept state values that are not first explicitly hardened?
Upgrade Considerations
This updates the code of
@agoric/base-zonepackage. While this package is depended on by a broad number of other packages, either directly or transitively through@agoric/zone, heap zones are only part of contract bundles, and not part of liveslots or zcf (TODO: check this).A contract has to opt-in to this breaking change by using a new version of
@agoric/base-zonewhen updating. Since only heap state is affected, there is no particular risk regarding upgrading beyond what the package would do to update its dependencies.