GitLab

With this patch, PartitionAlloc holds the reference count (i.e. the
number of associated CheckedPtrs) for every non-direct-mapped
allocation. On free(), if the count doesn't equal zero, the allocation
is poisoned and quarantined until there are no references left;
therefore, use-after-free issues affecting CheckedPtr-protected
pointers become unexploitable.

This is a highly experimental feature, which is disabled by default.

Bug: 1073933
Change-Id: Icda4b6e0c303e472df4222e1418bf0fdfe9aeef1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385456
Commit-Queue: Sergei Glazunov <glazunov@google.com>
Reviewed-by: Bartek Nowierski <bartekn@chromium.org>
Reviewed-by: Benoit L <lizeb@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#805392}