AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[runtime] Fix relaxed memmove in TypedArray.prototype.set

Browse Source 
If either target or source are shared buffers, use relaxed memmove.

Bug: chromium:1353555
Change-Id: Ieaad826c610b0f2f808b4061947372d851f95978
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3862209
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82812}
This commit is contained in:
Camillo 2022-08-29 16:59:09 +02:00 committed by V8 LUCI CQ
parent af62c4f0e5
commit d15537cf1f
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/builtins/typed-array-set.tq
View File

@ -274,7 +274,8 @@ TypedArrayPrototypeSetTypedArray(implicit context: Context, receiver: JSAny)(
// value, true, Unordered).
// iii. Set srcByteIndex to srcByteIndex + 1.
// iv. Set targetByteIndex to targetByteIndex + 1.
if (IsSharedArrayBuffer(target.buffer)) {
if (IsSharedArrayBuffer(target.buffer) ||
IsSharedArrayBuffer(source.buffer)) {
// SABs need a relaxed memmove to preserve atomicity.
CallCRelaxedMemmove(dstPtr, source.data_ptr, countBytes);
} else {

16
test/mjsunit/regress/regress-1353555.js Normal file
View File

@ -0,0 +1,16 @@
// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const worker = new Worker(`function onmessage(buffer) {
const shared2 = new Int32Array(buffer);
shared2.fill(1);
}`, {
type: 'string'
});
const shared = new Int32Array(new SharedArrayBuffer(4));
worker.postMessage(shared.buffer);
while (Atomics.load(shared) == 0) {}
(new Int32Array(1)).set(shared);