Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v20.x] deps: cherry-pick V8 fixes for CVE-2023-3420 and others #50077

Closed
wants to merge 5 commits into from

Commits on Nov 12, 2023

  1. deps: V8: cherry-pick a1efa5343880

    Original commit message:
    
        Merged: [runtime] Set instance prototypes directly on maps
    
        Bug: chromium:1452137
        (cherry picked from commit c7c447735f762f6d6d0878e229371797845ef4ab)
    
        Change-Id: I611c41f942e2e51f3c4b4f1d119c18410617188e
        Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4637888
        Commit-Queue: Igor Sheludko <[email protected]>
        Auto-Submit: Igor Sheludko <[email protected]>
        Commit-Queue: Toon Verwaest <[email protected]>
        Reviewed-by: Toon Verwaest <[email protected]>
        Cr-Commit-Position: refs/branch-heads/11.4@{nodejs#47}
        Cr-Branched-From: 8a8a1e7086dacc426965d3875914efa66663c431-refs/heads/11.4.183@{#1}
        Cr-Branched-From: 5483d8e816e0bbce865cbbc3fa0ab357e6330bab-refs/heads/main@{#87241}
    
    Refs: v8/v8@a1efa53
    targos committed Nov 12, 2023
    Configuration menu
    Copy the full SHA
    f2d320b View commit details
    Browse the repository at this point in the history
  2. deps: V8: cherry-pick 840650f2ff4e

    Original commit message:
    
        Merged: [compiler] StackCheck can have side effects
    
        Bug: chromium:1452137
        (cherry picked from commit e548943e473b020fdc1de6e5543ca31b24d8b7f9)
    
        Change-Id: Ibd7c9b02efd12341b452e4c34a635a58a817649f
        Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4637129
        Reviewed-by: Toon Verwaest <[email protected]>
        Commit-Queue: Tobias Tebbi <[email protected]>
        Auto-Submit: Tobias Tebbi <[email protected]>
        Commit-Queue: Toon Verwaest <[email protected]>
        Cr-Commit-Position: refs/branch-heads/11.4@{nodejs#49}
        Cr-Branched-From: 8a8a1e7086dacc426965d3875914efa66663c431-refs/heads/11.4.183@{#1}
        Cr-Branched-From: 5483d8e816e0bbce865cbbc3fa0ab357e6330bab-refs/heads/main@{#87241}
    
    Refs: v8/v8@840650f
    targos committed Nov 12, 2023
    Configuration menu
    Copy the full SHA
    827dd00 View commit details
    Browse the repository at this point in the history
  3. deps: V8: cherry-pick 9721082687c9

    Original commit message:
    
        heap: Add missing <algorithm> include for std::remove
    
        GCC 14 changes some internal includes within libstdc++ so this transient
        include gets lost. Include <algorithm> explicitly for std::remove.
    
        Change-Id: Iab8a2c751a0f9c9dc6a770d6296ad6de724ef3bb
        Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4583222
        Reviewed-by: Michael Lippautz <[email protected]>
        Commit-Queue: Michael Lippautz <[email protected]>
        Cr-Commit-Position: refs/heads/main@{#88037}
    shipujin authored and targos committed Nov 12, 2023
    Configuration menu
    Copy the full SHA
    03d1cb7 View commit details
    Browse the repository at this point in the history
  4. deps: V8: cherry-pick f7d000a7ae7b

    Original commit message:
    
        [logging] Bugfix: LinuxPerfBasicLogger should log JS functions
    
        This patch fixes a typo that was introduced in commit
        c51041f45400928cd64fbc8f389c0dd0dd15f82f /
        https://chromium-review.googlesource.com/c/v8/v8/+/2336793, which reversed the behavior of the perf_basic_prof_only_functions flag.
    
        This also refactors the equivalent guard in LinuxPerfJitLogger to use the same inline CodeKind API for identifying JS Functions. This is unrelated to the bug, but it seems a fair rider to add on here.
    
        Bug: v8:14387
        Change-Id: I25766b0d45f4c65dfec5ae01e094a1ed94111054
        Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4954225
        Reviewed-by: Camillo Bruni <[email protected]>
        Commit-Queue: Camillo Bruni <[email protected]>
        Cr-Commit-Position: refs/heads/main@{#90501}
    
    Refs: v8/v8@f7d000a
    lukealbao authored and targos committed Nov 12, 2023
    Configuration menu
    Copy the full SHA
    29146d0 View commit details
    Browse the repository at this point in the history

Commits on Nov 13, 2023

  1. deps: V8: cherry-pick d90d4533b053

    Original commit message:
    
        Fix reading integer-indexed import assertions in dynamic import
    
        Use GetPropertyOrElement instead of GetProperty to read import assertion
        values from the import assertions object, to support cases in which the
        key is an integer index such as `"0"`.
    
        The added test case, when using GetProperty, triggers the following DCHECK in
        debug builds:
        https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/lookup-inl.h;l=108;drc=515f187ba067ee4a99fdf5198cca2c97abd342fd
        In release builds it silently fails to read the property, and thus throws about
        it not being a valid string.
    
        Bug: v8:14069
        Change-Id: Ifd4645b7bd9bfd07f06fa33727441d27eabc4d32
        Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4614489
        Reviewed-by: Victor Gomes <[email protected]>
        Commit-Queue: Marja Hölttä <[email protected]>
        Reviewed-by: Marja Hölttä <[email protected]>
        Cr-Commit-Position: refs/heads/main@{#88267}
    
    Refs: v8/v8@d90d453
    targos committed Nov 13, 2023
    Configuration menu
    Copy the full SHA
    ac65ccc View commit details
    Browse the repository at this point in the history