Changeset 215525 in webkit

Timestamp:

Apr 19, 2017 12:38:52 PM (7 years ago)

Author:

jfbastien@apple.com

Message:

WebAssembly: limit slow memories
​https://bugs.webkit.org/show_bug.cgi?id=170825

Reviewed by Saam Barati.

JSTests:

• wasm.yaml:
• wasm/stress/oom.js: Added.

(try.true.WebAssemblyMemoryMode):
(catch):

Source/JavaScriptCore:

We limits the number of fast memories, partly because ASLR. The
code then falls back to slow memories. It first tries to virtually
allocated any declared maximum (and in there, physically the
initial), and if that fails it tries to physically allocate the
initial without any extra.

This can still be used to cause a bunch of virtual
allocation. This patch imposes soft limit on slow memories as
well. The total virtual maximum for slow memories is set at the
same (theoretical) value as that for fast memories.

Anything exceeding that limit causes allocation/grow to fail.

• wasm/WasmMemory.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/wasm.yaml (modified) (1 diff)
• JSTests/wasm/stress (added)
• JSTests/wasm/stress/oom.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/wasm/WasmMemory.cpp (modified) (3 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2017-04-19  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: limit slow memories
+        https://bugs.webkit.org/show_bug.cgi?id=170825
+
+        Reviewed by Saam Barati.
+
+        * wasm.yaml:
+        * wasm/stress/oom.js: Added.
+        (try.true.WebAssemblyMemoryMode):
+        (catch):
+
 2017-04-19  JF Bastien  <jfbastien@apple.com>
 

trunk/JSTests/wasm.yaml

@@ -32 +32 @@
 - path: wasm/fuzz
   cmd: runWebAssembly unless parseRunCommands
+- path: wasm/stress
+  cmd: runWebAssembly unless parseRunCommands
 
 - path: wasm/spec-tests/address.wast.js

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-04-19  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: limit slow memories
+        https://bugs.webkit.org/show_bug.cgi?id=170825
+
+        Reviewed by Saam Barati.
+
+        We limits the number of fast memories, partly because ASLR. The
+        code then falls back to slow memories. It first tries to virtually
+        allocated any declared maximum (and in there, physically the
+        initial), and if that fails it tries to physically allocate the
+        initial without any extra.
+
+        This can still be used to cause a bunch of virtual
+        allocation. This patch imposes soft limit on slow memories as
+        well. The total virtual maximum for slow memories is set at the
+        same (theoretical) value as that for fast memories.
+
+        Anything exceeding that limit causes allocation/grow to fail.
+
+        * wasm/WasmMemory.cpp:
+
 2017-04-19  JF Bastien  <jfbastien@apple.com>
 

trunk/Source/JavaScriptCore/wasm/WasmMemory.cpp

@@ -94 +94 @@
 std::atomic<size_t> currentlyAllocatedFastMemories = ATOMIC_VAR_INIT(0);
 std::atomic<size_t> observedMaximumFastMemory = ATOMIC_VAR_INIT(0);
+std::atomic<size_t> currentSlowMemoryCapacity = ATOMIC_VAR_INIT(0);
+
+size_t fastMemoryAllocatedBytesSoftLimit()
+{
+    return fastMemoryAllocationSoftLimit * Memory::fastMappedBytes();
+}
 
 void* tryGetCachedFastMemory()
@@ -195 +201 @@
 }
 
+bool slowMemoryCapacitySoftMaximumExceeded()
+{
+    // The limit on slow memory capacity is arbitrary. Its purpose is to limit
+    // virtual memory allocation. We choose to set the limit at the same virtual
+    // memory limit imposed on fast memories.
+    size_t maximum = fastMemoryAllocatedBytesSoftLimit();
+    size_t currentCapacity = currentSlowMemoryCapacity.load(std::memory_order_acquire);
+    if (UNLIKELY(currentCapacity > maximum)) {
+        dataLogLnIf(verbose, "Slow memory capacity limit reached");
+        return true;
+    }
+    return false;
+}
+
 void* tryGetSlowMemory(size_t bytes)
 {
+    if (slowMemoryCapacitySoftMaximumExceeded())
+        return nullptr;
     void* memory = mmapBytes(bytes);
+    if (memory)
+        currentSlowMemoryCapacity.fetch_add(bytes, std::memory_order_acq_rel);
     dataLogLnIf(memory && verbose, "Obtained slow memory ", RawPointer(memory), " with capacity ", bytes);
     dataLogLnIf(!memory && verbose, "Failed obtaining slow memory with capacity ", bytes);
@@ -229 +253 @@
         dataLogLnIf(verbose, "relinquishFastMemory freeing slow memory ", RawPointer(memory));
         munmapBytes(memory, mappedCapacity);
+        currentSlowMemoryCapacity.fetch_sub(mappedCapacity, std::memory_order_acq_rel);
         return;