commit | 9aa76aede80b2e9317f02dccd00010ea2967d2c8 | [log] [tgz] |
---|---|---|
author | Benoit Lize <lizeb@chromium.org> | Mon Oct 22 10:55:24 2018 |
committer | Commit Bot <commit-bot@chromium.org> | Mon Oct 22 10:55:24 2018 |
tree | aa9f010959db05ea901db6fb8d3ec63f0c846ebb | |
parent | c56690c375a47ba4822e689acb3f6998c96791f9 [diff] |
blink/bindings: Fix false-positive ASAN check. A ParkableString underlying String may be atomic. In this case, as long as it it alive, there is a raw pointer reference to it in a per-thread table. This can lead to a use-after-poison as the string gets poisoned whereas it is still in the table. This is due to not freeing string_ in ParkableStringImpl. To fix that, don't poison AtomicStrings (which are not the majority of ParkableString). This is a false positive as when real parking happens the underlying string would be freed, hence removed from the AtomicStringTable. Bug: 883344,877044 Change-Id: I685260eafe31da4cafed150b74870a08aa61ed40 Reviewed-on: https://chromium-review.googlesource.com/c/1228057 Reviewed-by: Kentaro Hara <haraken@chromium.org> Commit-Queue: Benoit L <lizeb@chromium.org> Cr-Commit-Position: refs/heads/master@{#601522}
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
The project's web site is https://www.chromium.org.
Documentation in the source is rooted in docs/README.md.
Learn how to Get Around the Chromium Source Code Directory Structure .