AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm] Properly handlify WasmCompiledModule::Clone.

Browse Source 
This is to avoid a dereference of the unhandlified {this} reference
after handlified allocation functions have been called. Combining
handlified and unhandlified style is inherently unsafe.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2380463006
Cr-Commit-Position: refs/heads/master@{#39921}
This commit is contained in:
mstarzinger 2016-09-30 09:31:08 -07:00 committed by Commit bot
parent 050bf39d85
commit 2ab7a917c9
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/wasm/wasm-module.cc
View File

@ -1220,7 +1220,7 @@ MaybeHandle<JSObject> WasmModule::Instantiate(Isolate* isolate,
// There is already an owner, clone everything.
owner = Handle<JSObject>(JSObject::cast(tmp->value()), isolate);
// Insert the latest clone in front.
compiled_module = original->Clone(isolate);
compiled_module = WasmCompiledModule::Clone(isolate, original);
// Replace the strong reference to point to the new instance here.
// This allows any of the other instances, including the original,
// to be collected.

9
src/wasm/wasm-module.h
View File

@ -442,13 +442,14 @@ class WasmCompiledModule : public FixedArray {
return handle(WasmCompiledModule::cast(*ret));
}
Handle<WasmCompiledModule> Clone(Isolate* isolate) {
Handle<WasmCompiledModule> ret = handle(WasmCompiledModule::cast(
*isolate->factory()->CopyFixedArray(handle(this))));
static Handle<WasmCompiledModule> Clone(Isolate* isolate,
Handle<WasmCompiledModule> module) {
Handle<WasmCompiledModule> ret = Handle<WasmCompiledModule>::cast(
isolate->factory()->CopyFixedArray(module));
Handle<HeapNumber> number =
isolate->factory()->NewHeapNumber(0.0, MUTABLE, TENURED);
ret->set(kID_mem_size, *number);
ret->set_mem_size(mem_size());
ret->set_mem_size(module->mem_size());
return ret;
}