965e688d12
Memory64 currently does not use trap handling, so we should not allocate
a guard region (10GB total reservation).
This is implemented by adding a {WasmMemoryFlag} enum in the backing
store header, which replaces the previous {MemoryIndexType}. The flag is
not stored with the backing store, as the backing store does not care
about the index type, and we might want to share the same backing store
for memory32 and memory64 (if sizes permit this).
Instead, we (still) store the flag with the WasmMemoryObject and pass it
to the backing store methods.
R=jkummerow@chromium.org
Bug: v8:10949
Change-Id: I284b85b98d181ba5e8d454b24bfa48f6ac201be5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3789506
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82038}
87 lines
2.7 KiB
C++
87 lines
2.7 KiB
C++
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#include "src/api/api-inl.h"
|
|
#include "src/objects/backing-store.h"
|
|
#include "src/wasm/wasm-objects.h"
|
|
#include "test/cctest/cctest.h"
|
|
#include "test/cctest/manually-externalized-buffer.h"
|
|
|
|
namespace v8 {
|
|
namespace internal {
|
|
namespace wasm {
|
|
|
|
using testing::ManuallyExternalizedBuffer;
|
|
|
|
TEST(Run_WasmModule_Buffer_Externalized_Detach) {
|
|
{
|
|
// Regression test for
|
|
// https://bugs.chromium.org/p/chromium/issues/detail?id=731046
|
|
Isolate* isolate = CcTest::InitIsolateOnce();
|
|
HandleScope scope(isolate);
|
|
MaybeHandle<JSArrayBuffer> result =
|
|
isolate->factory()->NewJSArrayBufferAndBackingStore(
|
|
kWasmPageSize, InitializedFlag::kZeroInitialized);
|
|
Handle<JSArrayBuffer> buffer = result.ToHandleChecked();
|
|
|
|
// Embedder requests contents.
|
|
ManuallyExternalizedBuffer external(buffer);
|
|
|
|
buffer->Detach();
|
|
CHECK(buffer->was_detached());
|
|
|
|
// Make sure we can write to the buffer without crashing
|
|
uint32_t* int_buffer =
|
|
reinterpret_cast<uint32_t*>(external.backing_store());
|
|
int_buffer[0] = 0;
|
|
// Embedder frees contents.
|
|
}
|
|
CcTest::CollectAllAvailableGarbage();
|
|
}
|
|
|
|
TEST(Run_WasmModule_Buffer_Externalized_Regression_UseAfterFree) {
|
|
{
|
|
// Regression test for https://crbug.com/813876
|
|
Isolate* isolate = CcTest::InitIsolateOnce();
|
|
HandleScope scope(isolate);
|
|
MaybeHandle<WasmMemoryObject> result =
|
|
WasmMemoryObject::New(isolate, 1, 1, SharedFlag::kNotShared);
|
|
Handle<WasmMemoryObject> memory_object = result.ToHandleChecked();
|
|
Handle<JSArrayBuffer> buffer(memory_object->array_buffer(), isolate);
|
|
|
|
{
|
|
// Embedder requests contents.
|
|
ManuallyExternalizedBuffer external(buffer);
|
|
|
|
// Growing (even by 0) detaches the old buffer.
|
|
WasmMemoryObject::Grow(isolate, memory_object, 0);
|
|
CHECK(buffer->was_detached());
|
|
|
|
// Embedder frees contents.
|
|
}
|
|
|
|
// Make sure the memory object has a new buffer that can be written to.
|
|
uint32_t* int_buffer = reinterpret_cast<uint32_t*>(
|
|
memory_object->array_buffer().backing_store());
|
|
int_buffer[0] = 0;
|
|
}
|
|
CcTest::CollectAllAvailableGarbage();
|
|
}
|
|
|
|
#if V8_TARGET_ARCH_64_BIT
|
|
TEST(BackingStore_Reclaim) {
|
|
// Make sure we can allocate memories without running out of address space.
|
|
Isolate* isolate = CcTest::InitIsolateOnce();
|
|
for (int i = 0; i < 256; ++i) {
|
|
auto backing_store = BackingStore::AllocateWasmMemory(
|
|
isolate, 1, 1, WasmMemoryFlag::kWasmMemory32, SharedFlag::kNotShared);
|
|
CHECK(backing_store);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
} // namespace wasm
|
|
} // namespace internal
|
|
} // namespace v8
|