Jakob Kummerow
273e2fa0bc
`WasmExportWrapperCache` (`js_to_wasm_wrappers`) previously used an in-sandbox `WeakFixedArray` of `Weak<CodeWrapper>` entries, allowing in-sandbox corruption to substitute arbitrary `Code` objects (or cross-signature wrappers) into `JSDispatchTable` on instantiation and wrapper tier-up. Back `js_to_wasm_wrappers` with a `ProtectedWeakFixedArray` in trusted space storing `Weak<Code>` directly, avoiding `CodeWrapper` indirection and protecting cached wrappers from in-sandbox tampering. TAG=agy CONV=e1e8811e-0120-406f-bea6-4d5cd012cbb1 Fixed: 580519552 Change-Id: I7828d5fe8116f473a1a5de823136e8684db0d525 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8714722 Reviewed-by: Clemens Backes <clemensb@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#111595}