mirrors/nodejs
mirrors/nodejs
0
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2024-11-24 03:07:54 +01:00
Code Issues Releases Activity

deps: V8: cherry-pick e061cf9970d9

Browse Source 
Original commit message:

    [arraybuffers] initialize max byte length of empty array buffers

    Without initializing the max byte length field, any empty array
    buffer captured in the snapshot can make the snapshot unreproducible.

    Refs: https://github.com/nodejs/node/issues/53579

    Change-Id: I2489ab2e57ecbb405ec431a87d0acc92822b777c
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5662576
    Reviewed-by: Marja Hölttä <marja@chromium.org>
    Commit-Queue: Marja Hölttä <marja@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#94754}

Refs: e061cf9970
PR-URL: https://github.com/nodejs/node/pull/53755
Fixes: https://github.com/nodejs/node/issues/53579
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
This commit is contained in:
Joyee Cheung 2024-07-07 20:22:17 +02:00 committed by Node.js GitHub Bot
parent 307430e490
commit d15f514077
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
common.gypi
View File

@ -36,7 +36,7 @@
# Reset this number to 0 on major V8 upgrades.
# Increment by one for each non-official patch applied to deps/v8.
'v8_embedder_string': '-node.15',
'v8_embedder_string': '-node.16',
##### V8 defaults for Node.js #####

2
deps/v8/src/builtins/builtins-typed-array-gen.cc vendored
View File

@ -68,6 +68,8 @@ TNode<JSArrayBuffer> TypedArrayBuiltinsAssembler::AllocateEmptyOnHeapBuffer(
UndefinedConstant());
StoreBoundedSizeToObject(buffer, JSArrayBuffer::kRawByteLengthOffset,
UintPtrConstant(0));
StoreBoundedSizeToObject(buffer, JSArrayBuffer::kRawMaxByteLengthOffset,
UintPtrConstant(0));
StoreSandboxedPointerToObject(buffer, JSArrayBuffer::kBackingStoreOffset,
EmptyBackingStoreBufferConstant());
#ifdef V8_COMPRESS_POINTERS