Repository navigation
Conversation
mcollina
marked this pull request as ready for review
October 30, 2026 07:55
V8 only defines CppHeapPointerTag::kDefaultTag when the sandbox is disabled, so building with --experimental-pointer-compression-shared-cage (which enables the sandbox) failed to compile. Give each cppgc-managed wrapper type its own tag, declared with the new SET_CPPGC_TAG() macro, and unwrap through v8::Object::Unwrap() with that tag instead of reading the raw pointer from the internal field. With the sandbox enabled, unwrapping an object as the wrong type now yields nullptr. The deprecated SetCppgcReference() gets its own tag. Signed-off-by: Matteo Collina <hello@matteocollina.com>
With the V8 sandbox, ArrayBuffer backing stores must live inside the sandbox. Let V8 allocate the counters in the cppgc-object addon instead of wrapping a static array, skip the nullptr data check for empty buffers in null-buffer-neuter, and account for the eagerly freed main thread buffer in worker-buffer-callback. Signed-off-by: Matteo Collina <hello@matteocollina.com>
mcollina
force-pushed
the
src-cppgc-wrapper-tags
branch
from
October 30, 2026 09:04
e3c855d to
76f24fb
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #67131 +/- ##
==========================================
+ Coverage 90.65% 90.68% +0.03%
==========================================
Files 797 797
Lines 278268 278805 +537
Branches 53517 53618 +101
==========================================
+ Hits 252261 252838 +577
+ Misses 16386 16334 -52
- Partials 9621 9633 +12
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Building with
--experimental-enable-pointer-compression --experimental-pointer-compression-shared-cagecurrently fails to compile. The shared cage turns on the V8 sandbox, and V8 only definesCppHeapPointerTag::kDefaultTagwhen the sandbox is off:V8 asks embedders that use the sandbox to give each type its own tag. Swapping in a different single tag would compile, but the tag would protect nothing:
CppgcMixin::Unwrap()reads the raw pointer from the internal field and never checks it.This PR:
node::CppgcWrapperTaginsrc/node_v8_embedder.h, with one tag per cppgc wrapper type (ContextifyContext,ContextifyScript) and one for the deprecatedSetCppgcReference()SET_CPPGC_TAG()macro.CppgcMixin::Wrap<T>()usesT::kCppHeapPointerTag, so a wrapper without a tag fails to compilev8::Object::Unwrap<T::kCppHeapPointerTag, T>(). With the sandbox on, unwrapping an object as the wrong type now returnsnullptr. The isolate comes fromv8::Isolate::GetCurrent(), soASSIGN_OR_RETURN_UNWRAP_CPPGCand its callers stay the samekDefaultTagdirectlyIt also fixes three addon tests that crashed with the sandbox, because they created ArrayBuffers over memory outside it:
cppgc-objectnow lets V8 allocate its countersnull-buffer-neuteronly checks for anullptrdata pointer without the sandbox, because empty buffers point into the sandboxworker-buffer-callback/test-free-calledexpects the main thread buffer to be freed too, because the sandbox copies the data and frees the original right awayTested on main with a pointer-compression + shared-cage + sandbox build (
default,addons,embedding,cctest) and with a default build (default,addons,embedding,cctest). All pass.——-
AI generated, reviewed by me.