9281d9b67f
Reason for revert: [Sheriff] Test hangs sometimes and times out flakily. E.g.: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosse3/builds/4551/steps/Check%20%28flakes%29/logs/d8-worker-sharedarray.. Original issue's description: > Fix bug when transferring SharedArrayBuffer to multiple Workers. > > Previously, the serialization code would call Externalize for every transferred > ArrayBuffer or SharedArrayBuffer, but that function can only be called once. If > the buffer is already externalized, we should call GetContents instead. > > Also fix use-after-free bug when transferring ArrayBuffers. The transferred > ArrayBuffer must be internalized in the new isolate, or be managed by the > Shell. The current code gives it to the isolate externalized and frees it > immediately afterward when the SerializationData object is destroyed. > > BUG=chromium:497295 > R=jarin@chromium.org > LOG=n > > Committed: https://crrev.com/dd7962bf7838f8379ba776ee6b7b0e4d3bec2140 > Cr-Commit-Position: refs/heads/master@{#29499} TBR=jarin@chromium.org,jochen@chromium.org,binji@chromium.org NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=chromium:497295 Review URL: https://codereview.chromium.org/1224843008 Cr-Commit-Position: refs/heads/master@{#29506}
69 lines
2.5 KiB
JavaScript
69 lines
2.5 KiB
JavaScript
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Redistribution and use in source and binary forms, with or without
|
|
// modification, are permitted provided that the following conditions are
|
|
// met:
|
|
//
|
|
// * Redistributions of source code must retain the above copyright
|
|
// notice, this list of conditions and the following disclaimer.
|
|
// * Redistributions in binary form must reproduce the above
|
|
// copyright notice, this list of conditions and the following
|
|
// disclaimer in the documentation and/or other materials provided
|
|
// with the distribution.
|
|
// * Neither the name of Google Inc. nor the names of its
|
|
// contributors may be used to endorse or promote products derived
|
|
// from this software without specific prior written permission.
|
|
//
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
|
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
// Flags: --harmony-sharedarraybuffer --harmony-atomics
|
|
|
|
var workerScript =
|
|
`onmessage = function(m) {
|
|
var sab = m;
|
|
var ta = new Uint32Array(sab);
|
|
if (sab.byteLength !== 16) {
|
|
throw new Error('SharedArrayBuffer transfer byteLength');
|
|
}
|
|
for (var i = 0; i < 4; ++i) {
|
|
if (ta[i] !== i) {
|
|
throw new Error('SharedArrayBuffer transfer value ' + i);
|
|
}
|
|
}
|
|
// Atomically update ta[0]
|
|
Atomics.store(ta, 0, 100);
|
|
};`;
|
|
|
|
if (this.Worker) {
|
|
var w = new Worker(workerScript);
|
|
|
|
var sab = new SharedArrayBuffer(16);
|
|
var ta = new Uint32Array(sab);
|
|
for (var i = 0; i < 4; ++i) {
|
|
ta[i] = i;
|
|
}
|
|
|
|
// Transfer SharedArrayBuffer
|
|
w.postMessage(sab, [sab]);
|
|
assertEquals(16, sab.byteLength); // ArrayBuffer should not be neutered.
|
|
|
|
// Spinwait for the worker to update ta[0]
|
|
var ta0;
|
|
while ((ta0 = Atomics.load(ta, 0)) == 0) {}
|
|
|
|
assertEquals(100, ta0);
|
|
|
|
w.terminate();
|
|
|
|
assertEquals(16, sab.byteLength); // Still not neutered.
|
|
}
|