AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix construction of empty backing stores for SharedArrayBuffers

Browse Source 
Bug: chromium:1006629,v8:9380
Change-Id: I8e45759fe3ad1b0ef8f1ebdb33919c84e1e8a044
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815244
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63928}
This commit is contained in:
Ulan Degenbaev 2019-09-23 09:54:04 +02:00 committed by Commit Bot
parent 3803d4d32d
commit 39ecc997eb
4 changed files with 24 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/api/api.cc
View File

@ -3742,7 +3742,8 @@ std::shared_ptr<v8::BackingStore> v8::ArrayBuffer::GetBackingStore() {
i::Handle<i::JSArrayBuffer> self = Utils::OpenHandle(this);
std::shared_ptr<i::BackingStore> backing_store = self->GetBackingStore();
if (!backing_store) {
backing_store = i::BackingStore::NewEmptyBackingStore();
backing_store =
i::BackingStore::NewEmptyBackingStore(i::SharedFlag::kNotShared);
}
i::GlobalBackingStoreRegistry::Register(backing_store);
std::shared_ptr<i::BackingStoreBase> bs_base = backing_store;
@ -3753,7 +3754,8 @@ std::shared_ptr<v8::BackingStore> v8::SharedArrayBuffer::GetBackingStore() {
i::Handle<i::JSArrayBuffer> self = Utils::OpenHandle(this);
std::shared_ptr<i::BackingStore> backing_store = self->GetBackingStore();
if (!backing_store) {
backing_store = i::BackingStore::NewEmptyBackingStore();
backing_store =
i::BackingStore::NewEmptyBackingStore(i::SharedFlag::kShared);
}
i::GlobalBackingStoreRegistry::Register(backing_store);
std::shared_ptr<i::BackingStoreBase> bs_base = backing_store;

17
src/objects/backing-store.cc
View File

@ -454,14 +454,15 @@ std::unique_ptr<BackingStore> BackingStore::WrapAllocation(
return std::unique_ptr<BackingStore>(result);
}
std::unique_ptr<BackingStore> BackingStore::NewEmptyBackingStore() {
auto result = new BackingStore(nullptr, // start
0, // length
0, // capacity
SharedFlag::kNotShared, // shared
false, // is_wasm_memory
false, // free_on_destruct
false); // has_guard_regions
std::unique_ptr<BackingStore> BackingStore::NewEmptyBackingStore(
SharedFlag shared) {
auto result = new BackingStore(nullptr, // start
0, // length
0, // capacity
shared, // shared
false, // is_wasm_memory
false, // free_on_destruct
false); // has_guard_regions
return std::unique_ptr<BackingStore>(result);
}

2
src/objects/backing-store.h
View File

@ -64,7 +64,7 @@ class V8_EXPORT_PRIVATE BackingStore : public BackingStoreBase {
bool free_on_destruct);
// Create an empty backing store.
static std::unique_ptr<BackingStore> NewEmptyBackingStore();
static std::unique_ptr<BackingStore> NewEmptyBackingStore(SharedFlag shared);
// Accessors.
void* buffer_start() const { return buffer_start_; }

10
test/mjsunit/regress/regress-1006629.js Normal file
View File

@ -0,0 +1,10 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const workerScript = `
onmessage = function() {
};`;
const worker = new Worker(workerScript, {type: 'string'});
const i32a = new Int32Array( new SharedArrayBuffer() );
worker.postMessage([i32a.buffer]);