Commit c4c79f9
committed
Roll V8 to 14.9.207.26 (dispatch-handle UAF fix 8e1b07549b03)
Bumps the v8 submodule from 14.9.207.2 (73d19698) to 14.9.207.26
(9facb64e77c7) to pick up the M149 cherry-pick 8e1b07549b03,
'Fix raw pointer usage across GC point in dispatch handle allocation'
(Bug 511279942), which first ships in 14.9.207.22. Fixes the funrun-pro
leaptiering JSDispatchTable use-after-free.1 parent 5d0e31e commit c4c79f9
1 file changed
Lines changed: 1 addition & 1 deletion
- include/cppgc/visitor.h+7-4
- include/v8-version.h+1-1
- src/api/api.cc+23-7
- src/api/api.h+1-1
- src/baseline/baseline-batch-compiler.cc+8-4
- src/baseline/baseline-compiler.cc+11-4
- src/baseline/baseline-compiler.h+3-1
- src/builtins/builtins-array.cc-21
- src/builtins/builtins-microtask-queue-gen.cc+6
- src/builtins/promise-misc.tq+2
- src/compiler/backend/loong64/code-generator-loong64.cc+40-18
- src/compiler/backend/mips64/code-generator-mips64.cc+12-10
- src/compiler/turboshaft/late-load-elimination-reducer.cc+8
- src/compiler/turboshaft/sidetable.h+2
- src/compiler/turboshaft/wasm-load-elimination-reducer.h+38-8
- src/compiler/turboshaft/wasm-shuffle-reducer.cc+4-4
- src/compiler/turboshaft/wasm-shuffle-reducer.h+36-3
- src/execution/futex-emulation.cc+5-1
- src/execution/isolate.cc+6
- src/heap/cppgc/heap-page.cc+16-8
- src/heap/cppgc/heap-page.h+8-16
- src/heap/cppgc/object-start-bitmap.h+7-1
- src/inspector/v8-debugger-agent-impl.cc+7-1
- src/inspector/v8-deep-serializer.cc+1
- src/inspector/v8-runtime-agent-impl.cc+8-1
- src/interpreter/bytecode-array-builder.cc+17-2
- src/interpreter/bytecode-array-builder.h+20
- src/interpreter/bytecode-generator.cc+8-4
- src/interpreter/bytecodes.h+4-3
- src/interpreter/control-flow-builders.cc+14-8
- src/interpreter/control-flow-builders.h+1-1
- src/interpreter/handler-table-builder.cc+23-9
- src/interpreter/handler-table-builder.h+2
- src/maglev/maglev-code-generator.cc+45-22
- src/maglev/maglev-code-generator.h+5
- src/maglev/maglev-graph-builder.cc+5-5
- src/maglev/maglev-graph-optimizer.cc+3
- src/maglev/maglev-kna-processor.h+3-5
- src/maglev/maglev-known-node-aspects.cc+2-4
- src/maglev/maglev-reducer-inl.h+7-2
- src/objects/feedback-vector.cc+3-1
- src/objects/heap-object.h-6
- src/objects/js-function-inl.h+3-2
- src/objects/js-promise-inl.h+2
- src/objects/js-promise.h+10-4
- src/objects/js-promise.tq+2-1
- src/objects/objects-inl.h-32
- src/objects/tagged-field.h+2-8
- src/parsing/literal-buffer.cc+9-8
- src/parsing/literal-buffer.h+10-8
- src/parsing/scanner-character-streams.cc+8
- src/profiler/profile-generator.h+2-4
- src/runtime/runtime.h+1-1
- src/wasm/baseline/loong64/liftoff-assembler-loong64-inl.h+10-3
- src/wasm/baseline/mips64/liftoff-assembler-mips64-inl.h+6-1
- test/cctest/test-api-interceptors.cc-14
- test/cctest/test-api.cc+111
- test/cctest/test-api.h+18
- test/inspector/regress/regress-crbug-516311623-expected.txt+24
- test/inspector/regress/regress-crbug-516311623.js+72
- test/mjsunit/maglev/maglev-508811474.js+47
- test/mjsunit/maglev/regress-513350759.js+37
- test/mjsunit/mjsunit.status+1
- test/mjsunit/regress/regress-509268941-2.js+50
- test/mjsunit/regress/regress-513936340.js+29
- test/mjsunit/regress/wasm/regress-509268941-1.js+117
- test/mjsunit/regress/wasm/regress-509268941.js+75
- test/mjsunit/regress/wasm/regress-simd-508025392.js+58
- test/mjsunit/turbolev/regress-505610970.js+34
- test/unittests/heap/cppgc/ephemeron-pair-unittest.cc+2-1
- test/unittests/interpreter/bytecode_expectations/TryCatch.golden+4-39
- test/unittests/interpreter/bytecode_expectations/TryFinally.golden+8-47
- test/unittests/parser/scanner-streams-unittest.cc+31
0 commit comments