diff options
| author | Ionen Wolkens <ionen@gentoo.org> | 2025-09-28 00:12:06 -0400 |
|---|---|---|
| committer | Ionen Wolkens <ionen@gentoo.org> | 2025-09-28 02:50:39 -0400 |
| commit | 6c3a3b34732e5b21d05a65f6e1f8668ccfd9c854 (patch) | |
| tree | 2649ccc9dca5c6f78c894aadfdc54a1e269f8967 /dev-qt/qtwebengine/files/qtwebengine-6.9.1-CVE-2025-5419.patch | |
| parent | e2736f5caea2a682128bf04fd734138feef8f6e3 (diff) | |
| download | gentoo-6c3a3b34732e5b21d05a65f6e1f8668ccfd9c854.tar.gz gentoo-6c3a3b34732e5b21d05a65f6e1f8668ccfd9c854.tar.bz2 gentoo-6c3a3b34732e5b21d05a65f6e1f8668ccfd9c854.zip | |
dev-qt/qtwebengine: drop 6.9.1-r1
Signed-off-by: Ionen Wolkens <ionen@gentoo.org>
Diffstat (limited to 'dev-qt/qtwebengine/files/qtwebengine-6.9.1-CVE-2025-5419.patch')
| -rw-r--r-- | dev-qt/qtwebengine/files/qtwebengine-6.9.1-CVE-2025-5419.patch | 36 |
1 files changed, 0 insertions, 36 deletions
diff --git a/dev-qt/qtwebengine/files/qtwebengine-6.9.1-CVE-2025-5419.patch b/dev-qt/qtwebengine/files/qtwebengine-6.9.1-CVE-2025-5419.patch deleted file mode 100644 index f42c854f46ca..000000000000 --- a/dev-qt/qtwebengine/files/qtwebengine-6.9.1-CVE-2025-5419.patch +++ /dev/null @@ -1,36 +0,0 @@ -https://bugs.gentoo.org/957076 -https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/650558 ---- a/src/3rdparty/chromium/v8/src/compiler/turboshaft/store-store-elimination-reducer-inl.h -+++ b/src/3rdparty/chromium/v8/src/compiler/turboshaft/store-store-elimination-reducer-inl.h -@@ -325,8 +325,9 @@ - // access once available. - const bool is_on_heap_store = store.kind.tagged_base; -- const bool is_field_store = !store.index().valid(); -+ const bool is_fixed_offset_store = !store.index().valid(); - const uint8_t size = store.stored_rep.SizeInBytes(); -- // For now we consider only stores of fields of objects on the heap. -- if (is_on_heap_store && is_field_store) { -+ // For now we consider only stores of fixed offsets of objects on the -+ // heap. -+ if (is_on_heap_store && is_fixed_offset_store) { - bool is_eliminable_store = false; - switch (table_.GetObservability(store.base(), store.offset, size)) { -@@ -415,9 +416,14 @@ - // access once available. - const bool is_on_heap_load = load.kind.tagged_base; -- const bool is_field_load = !load.index().valid(); -+ const bool is_fixed_offset_load = !load.index().valid(); - // For now we consider only loads of fields of objects on the heap. -- if (is_on_heap_load && is_field_load) { -- table_.MarkPotentiallyAliasingStoresAsObservable(load.base(), -- load.offset); -+ if (is_on_heap_load) { -+ if (is_fixed_offset_load) { -+ table_.MarkPotentiallyAliasingStoresAsObservable(load.base(), -+ load.offset); -+ } else { -+ // A dynamically indexed load might alias any fixed offset. -+ table_.MarkAllStoresAsObservable(); -+ } - } - break; |
