99af8d4918
This is a wasm-only test, hence move it to the wasm directory and skip it in no-wasm builds. R=ahaas@chromium.org Bug: v8:11238 Change-Id: I57c9abbb98c3415f4d759372d479e1f61464217f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2731536 Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#73152}
87 lines
2.7 KiB
C++
87 lines
2.7 KiB
C++
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#include "src/api/api-inl.h"
|
|
#include "src/objects/backing-store.h"
|
|
#include "src/wasm/wasm-objects.h"
|
|
#include "test/cctest/cctest.h"
|
|
#include "test/cctest/manually-externalized-buffer.h"
|
|
|
|
namespace v8 {
|
|
namespace internal {
|
|
namespace wasm {
|
|
|
|
using testing::ManuallyExternalizedBuffer;
|
|
|
|
TEST(Run_WasmModule_Buffer_Externalized_Detach) {
|
|
{
|
|
// Regression test for
|
|
// https://bugs.chromium.org/p/chromium/issues/detail?id=731046
|
|
Isolate* isolate = CcTest::InitIsolateOnce();
|
|
HandleScope scope(isolate);
|
|
MaybeHandle<JSArrayBuffer> result =
|
|
isolate->factory()->NewJSArrayBufferAndBackingStore(
|
|
kWasmPageSize, InitializedFlag::kZeroInitialized);
|
|
Handle<JSArrayBuffer> buffer = result.ToHandleChecked();
|
|
|
|
// Embedder requests contents.
|
|
ManuallyExternalizedBuffer external(buffer);
|
|
|
|
buffer->Detach();
|
|
CHECK(buffer->was_detached());
|
|
|
|
// Make sure we can write to the buffer without crashing
|
|
uint32_t* int_buffer =
|
|
reinterpret_cast<uint32_t*>(external.backing_store());
|
|
int_buffer[0] = 0;
|
|
// Embedder frees contents.
|
|
}
|
|
CcTest::CollectAllAvailableGarbage();
|
|
}
|
|
|
|
TEST(Run_WasmModule_Buffer_Externalized_Regression_UseAfterFree) {
|
|
{
|
|
// Regression test for https://crbug.com/813876
|
|
Isolate* isolate = CcTest::InitIsolateOnce();
|
|
HandleScope scope(isolate);
|
|
MaybeHandle<WasmMemoryObject> result =
|
|
WasmMemoryObject::New(isolate, 1, 1, SharedFlag::kNotShared);
|
|
Handle<WasmMemoryObject> memory_object = result.ToHandleChecked();
|
|
Handle<JSArrayBuffer> buffer(memory_object->array_buffer(), isolate);
|
|
|
|
{
|
|
// Embedder requests contents.
|
|
ManuallyExternalizedBuffer external(buffer);
|
|
|
|
// Growing (even by 0) detaches the old buffer.
|
|
WasmMemoryObject::Grow(isolate, memory_object, 0);
|
|
CHECK(buffer->was_detached());
|
|
|
|
// Embedder frees contents.
|
|
}
|
|
|
|
// Make sure the memory object has a new buffer that can be written to.
|
|
uint32_t* int_buffer = reinterpret_cast<uint32_t*>(
|
|
memory_object->array_buffer().backing_store());
|
|
int_buffer[0] = 0;
|
|
}
|
|
CcTest::CollectAllAvailableGarbage();
|
|
}
|
|
|
|
#if V8_TARGET_ARCH_64_BIT
|
|
TEST(BackingStore_Reclaim) {
|
|
// Make sure we can allocate memories without running out of address space.
|
|
Isolate* isolate = CcTest::InitIsolateOnce();
|
|
for (int i = 0; i < 256; ++i) {
|
|
auto backing_store =
|
|
BackingStore::AllocateWasmMemory(isolate, 1, 1, SharedFlag::kNotShared);
|
|
CHECK(backing_store);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
} // namespace wasm
|
|
} // namespace internal
|
|
} // namespace v8
|