Changeset 295181 in webkit

Timestamp:

Jun 2, 2022, 11:45:22 PM (4 years ago)

Author:

Alan Coon

Message:

Cherry-pick 1d5e3b70369b. rdar://problem/93369102

[JSC] Always have non nullptr for WebAssembly.Memory buffer
​https://bugs.webkit.org/show_bug.cgi?id=240510

Reviewed by Mark Lam.

This patch adds CagedUniquePtr to allocate a pointer for that.

• Source/JavaScriptCore/runtime/ArrayBuffer.cpp: (JSC::ArrayBuffer::makeShared):
• Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp: (JSC::JSWebAssemblyMemory::buffer):

Canonical link: ​https://commits.webkit.org/250639@main
git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@294319 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-613-branch/Source/JavaScriptCore

Files:

• runtime/ArrayBuffer.cpp (modified) (1 diff)
• wasm/js/JSWebAssemblyMemory.cpp (modified) (1 diff)

branches/safari-613-branch/Source/JavaScriptCore/runtime/ArrayBuffer.cpp

@@ -333 +333 @@
     m_contents.makeShared();
     m_locked = true;
+    ASSERT(!isDetached());
 }
 

branches/safari-613-branch/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp

@@ -91 +91 @@
 
     Ref<Wasm::MemoryHandle> protectedHandle = m_memory->handle();
-    auto destructor = createSharedTask<void(void*)>([protectedHandle = WTFMove(protectedHandle)] (void*) { });
-    m_buffer = ArrayBuffer::createFromBytes(m_memory->memory(), m_memory->size(), WTFMove(destructor));
+    CagedUniquePtr<Gigacage::Primitive, uint8_t> pointerForEmpty;
+
+    void* memory = m_memory->memory();
+    size_t size = m_memory->size();
+    if (!memory) {
+        ASSERT(!size);
+        constexpr unsigned allocationSize = 1;
+        pointerForEmpty = CagedUniquePtr<Gigacage::Primitive, uint8_t>::tryCreate(allocationSize);
+        if (!pointerForEmpty) {
+            throwOutOfMemoryError(globalObject, throwScope);
+            return nullptr;
+        }
+        memory = pointerForEmpty.get(allocationSize);
+    }
+    ASSERT(memory);
+    auto destructor = createSharedTask<void(void*)>([protectedHandle = WTFMove(protectedHandle), pointerForEmpty = WTFMove(pointerForEmpty)] (void*) { });
+    m_buffer = ArrayBuffer::createFromBytes(memory, size, WTFMove(destructor));
     m_buffer->makeWasmMemory();
     if (m_memory->sharingMode() == Wasm::MemorySharingMode::Shared)