github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

chore: cherry-pick 3 changes from Release-5-M120 (#41013)

Browse Source 
* chore: [28-x-y] cherry-pick 3 changes from Release-5-M120

* 46cb67e3b296 from v8
* c1cda70a433a from chromium
* 78dd4b31847a from v8

* chore: update patches

---------

Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
This commit is contained in:
Keeley Hammond
2024-01-16 18:43:13 -08:00
committed by GitHub
parent dcc19bb8d6
commit 8f902599e4
5 changed files with 107 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
patches/chromium/.patches
View File

@@ -143,3 +143,4 @@ fix_font_flooding_in_dev_tools.patch
feat_allow_code_cache_in_custom_schemes.patch
enable_partition_alloc_ref_count_size.patch
reland_mojom_ts_generator_handle_empty_module_path_identically_to.patch
cherry-pick-c1cda70a433a.patch

31
patches/chromium/cherry-pick-c1cda70a433a.patch Normal file
View File

@@ -0,0 +1,31 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Mike Wasserman <msw@chromium.org>
Date: Thu, 21 Dec 2023 22:33:05 +0000
Subject: Speculative fix for UAF in
content::WebContentsImpl::ExitFullscreenMode
Bug: 1506535, 854815
Change-Id: Iace64d63f8cea2dbfbc761ad233db42451ec101c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5146875
Commit-Queue: John Abd-El-Malek <jam@chromium.org>
Auto-Submit: Mike Wasserman <msw@chromium.org>
Reviewed-by: John Abd-El-Malek <jam@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1240353}
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index a92c42ea05d680d435f6f69d9882e85537c995ec..e49ccf4ffc115a78abceeddd7f452aeeb5c6a917 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -3888,7 +3888,12 @@ void WebContentsImpl::ExitFullscreenMode(bool will_cause_resize) {
}
if (delegate_) {
+ // This may spin the message loop and destroy this object crbug.com/1506535
+ base::WeakPtr<WebContentsImpl> weak_ptr = weak_factory_.GetWeakPtr();
delegate_->ExitFullscreenModeForTab(this);
+ if (!weak_ptr) {
+ return;
+ }
if (keyboard_lock_widget_) {
delegate_->CancelKeyboardLockRequest(this);

2
patches/v8/.patches
View File

@@ -3,3 +3,5 @@ do_not_export_private_v8_symbols_on_windows.patch
fix_build_deprecated_attribute_for_older_msvc_versions.patch
chore_allow_customizing_microtask_policy_per_context.patch
cherry-pick-389ea9be7d68.patch
cherry-pick-46cb67e3b296.patch
cherry-pick-78dd4b31847a.patch

46
patches/v8/cherry-pick-46cb67e3b296.patch Normal file
View File

@@ -0,0 +1,46 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dominik=20Inf=C3=BChr?= <dinfuehr@chromium.org>
Date: Mon, 18 Dec 2023 09:15:00 +0100
Subject: Install BytecodeArray last in SharedFunctionInfo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Maglev assumes that when a SharedFunctionInfo has a BytecodeArray,
then it should also have FeedbackMetadata. However, this may not
hold with concurrent compilation when the SharedFunctionInfo is
re-compiled after being flushed. Here the BytecodeArray was installed
on the SFI before the FeedbackMetadata and a concurrent thread could
observe the BytecodeArray but not the FeedbackMetadata.
Drive-by: Reset the age field before setting the BytecodeArray as
well. This ensures that the concurrent marker will not observe the
old age for the new BytecodeArray.
Bug: chromium:1507412
Change-Id: I8855ed7ecc50c4a47d2c89043d62ac053858bc75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5125960
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91568}
diff --git a/src/codegen/compiler.cc b/src/codegen/compiler.cc
index 03860399e8b393cf315a507dbf5653381fc86d40..ff7360c10148657848440446e8d86bc4fcd51298 100644
--- a/src/codegen/compiler.cc
+++ b/src/codegen/compiler.cc
@@ -724,12 +724,12 @@ void InstallUnoptimizedCode(UnoptimizedCompilationInfo* compilation_info,
}
#endif // V8_ENABLE_WEBASSEMBLY
- shared_info->set_bytecode_array(*compilation_info->bytecode_array());
- shared_info->set_age(0);
-
Handle<FeedbackMetadata> feedback_metadata = FeedbackMetadata::New(
isolate, compilation_info->feedback_vector_spec());
shared_info->set_feedback_metadata(*feedback_metadata, kReleaseStore);
+
+ shared_info->set_age(0);
+ shared_info->set_bytecode_array(*compilation_info->bytecode_array());
} else {
#if V8_ENABLE_WEBASSEMBLY
DCHECK(compilation_info->has_asm_wasm_data());

27
patches/v8/cherry-pick-78dd4b31847a.patch Normal file
View File

@@ -0,0 +1,27 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Leszek Swirski <leszeks@chromium.org>
Date: Mon, 8 Jan 2024 11:13:58 +0100
Subject: Fix allocation folding in derived constructors
Bug: v8:7700
Change-Id: Ia33724d39d1397c7d47c36d14071abce6ed4b0fc
Fixed: chromium:1515930
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5173470
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91709}
diff --git a/src/maglev/maglev-graph-builder.cc b/src/maglev/maglev-graph-builder.cc
index 2b660f5a8681a854b799d54761c425b04d1d0444..31c114481dee5bd171700acf321c79d941c6df98 100644
--- a/src/maglev/maglev-graph-builder.cc
+++ b/src/maglev/maglev-graph-builder.cc
@@ -5210,6 +5210,7 @@ bool MaglevGraphBuilder::TryBuildFindNonDefaultConstructorOrConstruct(
object = BuildAllocateFastObject(
FastObject(new_target_function->AsJSFunction(), zone(), broker()),
AllocationType::kYoung);
+ ClearCurrentRawAllocation();
} else {
object = BuildCallBuiltin<Builtin::kFastNewObject>(
{GetConstant(current_function), new_target});