VV8 LUCI CQ[wasm] Fix leak of wrappers via code logging
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
[inspector][fuzzer] Fix termination Joining the thread from the watchdog is problematic, since e.g. {pthread_join} (the implementation of {Thread::Join} on POSIX systems) has undefined behaviour if multiple threads try to join at the same time. In practice, this leads to deadlocks. Thus implement termination by just calling {TaskRunner::Terminate}, but not {TaskRunner::Join}. This fixes the deadlocks in the inspector fuzzer. The inspector test binary is fixed simarly, even though there it seems to not cause problems so far. In both files, the {Terminate} function is inlined into callers because it's only a single line now, with one to two users. Also, replace the single fuzzer test (which is invalid javascript) by two tests: One called "invalid" explicitly, still with invalid javascript, and one empty file, which is valid input. That one reproduced the deadlock. R=szuend@chromium.org Bug: chromium:1142437 Change-Id: I8fb98b0cdbf3ceff6af6849397e5da5a4e9acd3c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526384 Reviewed-by: Simon Zünd <szuend@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#71054} | 5 年前 | |
[inspector][fuzzer] Fix timeouts on endless loops The watchdog previously didn't terminate execution, it just prevented the execution of additional tasks. This CL fixes that by making {TaskRunner::Terminate} actually terminate execution in the isolate. It also adds a regression test for this. R=szuend@chromium.org Bug: chromium:1154412, chromium:1142437 Change-Id: Ic6638e8a5c37e8840a85651b4d4bea2ee0f71c43 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2622212 Reviewed-by: Simon Zünd <szuend@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#72031} | 5 年前 | |
[inspector][fuzzer] Fix termination Joining the thread from the watchdog is problematic, since e.g. {pthread_join} (the implementation of {Thread::Join} on POSIX systems) has undefined behaviour if multiple threads try to join at the same time. In practice, this leads to deadlocks. Thus implement termination by just calling {TaskRunner::Terminate}, but not {TaskRunner::Join}. This fixes the deadlocks in the inspector fuzzer. The inspector test binary is fixed simarly, even though there it seems to not cause problems so far. In both files, the {Terminate} function is inlined into callers because it's only a single line now, with one to two users. Also, replace the single fuzzer test (which is invalid javascript) by two tests: One called "invalid" explicitly, still with invalid javascript, and one empty file, which is valid input. That one reproduced the deadlock. R=szuend@chromium.org Bug: chromium:1142437 Change-Id: I8fb98b0cdbf3ceff6af6849397e5da5a4e9acd3c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526384 Reviewed-by: Simon Zünd <szuend@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#71054} | 5 年前 | |
[inspector] Handle isolate termination gracefully The inspector fuzzer is terminating the isolate after two seconds. At this point, we can be in pretty much any state, and any further JS execution would fail. This CL fixes an issue where we got the termination signal when creating a context for a regexp (while installing extensions). There might be more places that need fixing, but with this CL the linked issue does not reproduce locally any more, so it's a step forward. R=szuend@chromium.org, bmeurer@chromium.org Bug: chromium:1166549 Change-Id: I33b48205b71877aca6cfe5267f353fa899bfa05c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2636153 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#72156} | 5 年前 | |
[debug] Cleanup properly when microtask execution is terminated. When a terminate_exception is raised while executing one of the promise related jobs on the microtask queue, we don't clean up properly, leaving the async stack in the inspector in an inconsistent state, not cleaning up the promise stack on the Isolate, and also not resetting the global current_microtask slot. This CL adds appropriate logic to perform the correct cleanup. Fixed: chromium:1297964 Change-Id: I4ec64405d4c66bfe1f0115e7039866447fb10f02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3471815 Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/main@{#79162} | 4 年前 | |
[inspector-test] Gracefully handle termination. Reporting messages can trigger termination in case of inspector-test, which we need to be able to deal with gracefully for the fuzzer. Fixed: chromium:1307449 Change-Id: I88ba2b13d920134a1670b808adc4ace4ca6d1dff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3540260 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/main@{#79543} | 4 年前 | |
Ensure correct order of destruction for sessions and channels in tests This CL fixes another UaF found by the same Clusterfuzz regression test in the inspector test harness. When sessions are not manually disconnected, but cleaned up by the InspectorIsolateData destructor, then the channels for these sessions are deleted before the sessions themselves. Since session teardown triggers new notifications, we have a UaF on the channel. This CL fixes this by moving the channel cleanup logic into the InspectorIsolateData destructor, which guarantees the correct order of things: Delete session first, then delete the matching channels. Note that the regression test is the minified clusterfuzz repro. The UaF only repros on windows though. We suspect this is due to thread scheduling differences. R=jarin@chromium.org Bug: chromium:1433503 Change-Id: Ie74161d389b72fbba810828554c8f474f02c74c3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4507380 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/main@{#87513} | 3 年前 | |
[wasm] Fix leak of wrappers via code logging We forgot to decrement the ref count of wrappers which were outstanding for logging in an isolate that shuts down. R=jkummerow@chromium.org Bug: 391921979 Change-Id: Ib54881075fac5da1437d4cf3d4e0853302aac094 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6495035 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99993} | 1 年前 |