Commits on Dec 15, 2022

1. deps: V8: backport 8ca9f77d0f7c …

   This fixes a crash when loading snapshots that contain empty
   ArrayBuffer instances:
   
   ```js
   const X = [];
   X.push(new ArrayBuffer());
   v8.startupSnapshot.setDeserializeMainFunction(() => {
     for (let i = 0; i < 1000000; i++) { // trigger GC
       X.push(new ArrayBuffer());
     }
   })
   ```
   
   Original commit message:
   
       [sandbox] Sandboxify JSArrayBuffer::extension external pointer
   
       Bug: chromium:1335043
       Change-Id: Id8e6883fc652b144f6380ff09b1c18e777e041c2
       Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3706626
       Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
       Reviewed-by: Igor Sheludko <ishell@chromium.org>
       Commit-Queue: Samuel Groß <saelo@chromium.org>
       Cr-Commit-Position: refs/heads/main@{#84544}
   
   Refs: v8/v8@8ca9f77

   

   addaleax committed Dec 15, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for 27be3cd
   • Browse repository at this point

   Copy the full SHA

   27be3cd View commit details

   Browse the repository at this point in the history