deps: cherry-pick b87d408 from upstream V8 #24272
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original commit message:
[heap-profiler] Fix a use-after-free when snapshots are deleted
If a caller starts the sampling heap profiler and takes a snapshot, and
then deletes the snapshot before the sampling has completed, a
use-after-free will occur on the StringsStorage pointer.
The same issue applies for StartTrackingHeapObjects which shares the
same StringsStorage object.
Bug: v8:8373
Change-Id: I5d69d60d3f9465f9dd3b3bef107c204e0fda0643
Reviewed-on: https://chromium-review.googlesource.com/c/1301477
Commit-Queue: Peter Marshall <[email protected]>
Reviewed-by: Alexei Filippov <[email protected]>
Cr-Commit-Position: refs/heads/master@{#57114}
Refs: v8/v8@b87d408
nodejs-github-bot
added
build
psmarshall
added
the
author ready
|
The version number is bumped twice because I expect to land #23827 first |
cjihrig
approved these changes
Nov 9, 2018
|
Is this commit already on master ? |
|
It's in V8 7.2 so I guess not - should I just retarget it to master? We aren't merging it back in v8 |
Yes, please. We will also have to take it in v11.x and it's easier to manage if the fix lands first on master. |
danbev
approved these changes
Nov 12, 2018
|
I updated |
danbev
pushed a commit
that referenced
this pull request
Nov 12, 2018
Original commit message:
[heap-profiler] Fix a use-after-free when snapshots are deleted
If a caller starts the sampling heap profiler and takes a snapshot,
and then deletes the snapshot before the sampling has completed, a
use-after-free will occur on the StringsStorage pointer.
The same issue applies for StartTrackingHeapObjects which shares the
same StringsStorage object.
Bug: v8:8373
Change-Id: I5d69d60d3f9465f9dd3b3bef107c204e0fda0643
Reviewed-on: https://chromium-review.googlesource.com/c/1301477
Commit-Queue: Peter Marshall <[email protected]>
Reviewed-by: Alexei Filippov <[email protected]>
Cr-Commit-Position: refs/heads/master@{#57114}
PR-URL: #24272
Refs:
v8/v8@b87d408
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
|
Thanks, the patch should apply cleanly to 10. This should also be backported to 8 if possible. |
|
A bit late to this, but since the PR was not retargetted doesn't this mean it effectively landed without relevant CI runs? |
Sorry about this, that was my fault. I read the comments a little too quickly and did not notice it was still targeted at |
BridgeAR
pushed a commit
that referenced
this pull request
Nov 14, 2018
Original commit message:
[heap-profiler] Fix a use-after-free when snapshots are deleted
If a caller starts the sampling heap profiler and takes a snapshot,
and then deletes the snapshot before the sampling has completed, a
use-after-free will occur on the StringsStorage pointer.
The same issue applies for StartTrackingHeapObjects which shares the
same StringsStorage object.
Bug: v8:8373
Change-Id: I5d69d60d3f9465f9dd3b3bef107c204e0fda0643
Reviewed-on: https://chromium-review.googlesource.com/c/1301477
Commit-Queue: Peter Marshall <[email protected]>
Reviewed-by: Alexei Filippov <[email protected]>
Cr-Commit-Position: refs/heads/master@{#57114}
PR-URL: #24272
Refs:
v8/v8@b87d408
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
kiyomizumia
pushed a commit
to kiyomizumia/node
that referenced
this pull request
Nov 15, 2018
Original commit message:
[heap-profiler] Fix a use-after-free when snapshots are deleted
If a caller starts the sampling heap profiler and takes a snapshot,
and then deletes the snapshot before the sampling has completed, a
use-after-free will occur on the StringsStorage pointer.
The same issue applies for StartTrackingHeapObjects which shares the
same StringsStorage object.
Bug: v8:8373
Change-Id: I5d69d60d3f9465f9dd3b3bef107c204e0fda0643
Reviewed-on: https://chromium-review.googlesource.com/c/1301477
Commit-Queue: Peter Marshall <[email protected]>
Reviewed-by: Alexei Filippov <[email protected]>
Cr-Commit-Position: refs/heads/master@{#57114}
PR-URL: nodejs#24272
Refs:
v8/v8@b87d408
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
This was referenced Nov 15, 2018
targos
pushed a commit
to targos/node
that referenced
this pull request
Dec 4, 2018
Original commit message:
[heap-profiler] Fix a use-after-free when snapshots are deleted
If a caller starts the sampling heap profiler and takes a snapshot,
and then deletes the snapshot before the sampling has completed, a
use-after-free will occur on the StringsStorage pointer.
The same issue applies for StartTrackingHeapObjects which shares the
same StringsStorage object.
Bug: v8:8373
Change-Id: I5d69d60d3f9465f9dd3b3bef107c204e0fda0643
Reviewed-on: https://chromium-review.googlesource.com/c/1301477
Commit-Queue: Peter Marshall <[email protected]>
Reviewed-by: Alexei Filippov <[email protected]>
Cr-Commit-Position: refs/heads/master@{#57114}
PR-URL: nodejs#24272
Refs:
v8/v8@b87d408
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
pull bot
pushed a commit
to shakir-abdo/node
that referenced
this pull request
Dec 6, 2018
Original commit message:
[heap-profiler] Fix a use-after-free when snapshots are deleted
If a caller starts the sampling heap profiler and takes a snapshot,
and then deletes the snapshot before the sampling has completed, a
use-after-free will occur on the StringsStorage pointer.
The same issue applies for StartTrackingHeapObjects which shares the
same StringsStorage object.
Bug: v8:8373
Change-Id: I5d69d60d3f9465f9dd3b3bef107c204e0fda0643
Reviewed-on: https://chromium-review.googlesource.com/c/1301477
Commit-Queue: Peter Marshall <[email protected]>
Reviewed-by: Alexei Filippov <[email protected]>
Cr-Commit-Position: refs/heads/master@{#57114}
PR-URL: nodejs#24272
Refs:
v8/v8@b87d408
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
codebytere
pushed a commit
that referenced
this pull request
Jan 12, 2019
Original commit message:
[heap-profiler] Fix a use-after-free when snapshots are deleted
If a caller starts the sampling heap profiler and takes a snapshot,
and then deletes the snapshot before the sampling has completed, a
use-after-free will occur on the StringsStorage pointer.
The same issue applies for StartTrackingHeapObjects which shares the
same StringsStorage object.
Bug: v8:8373
Change-Id: I5d69d60d3f9465f9dd3b3bef107c204e0fda0643
Reviewed-on: https://chromium-review.googlesource.com/c/1301477
Commit-Queue: Peter Marshall <[email protected]>
Reviewed-by: Alexei Filippov <[email protected]>
Cr-Commit-Position: refs/heads/master@{#57114}
PR-URL: #24272
Refs:
v8/v8@b87d408
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
refack
pushed a commit
to refack/node
that referenced
this pull request
Jan 14, 2019
Original commit message:
[heap-profiler] Fix a use-after-free when snapshots are deleted
If a caller starts the sampling heap profiler and takes a snapshot,
and then deletes the snapshot before the sampling has completed, a
use-after-free will occur on the StringsStorage pointer.
The same issue applies for StartTrackingHeapObjects which shares the
same StringsStorage object.
Bug: v8:8373
Change-Id: I5d69d60d3f9465f9dd3b3bef107c204e0fda0643
Reviewed-on: https://chromium-review.googlesource.com/c/1301477
Commit-Queue: Peter Marshall <[email protected]>
Reviewed-by: Alexei Filippov <[email protected]>
Cr-Commit-Position: refs/heads/master@{#57114}
PR-URL: nodejs#24272
Refs:
v8/v8@b87d408
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Merged
This was referenced Jan 29, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Original commit message:
Refs: v8/v8@b87d408
Checklist
make -j4 test(UNIX), orvcbuild test(Windows) passes