Changeset 217052 in webkit


Ignore:
Timestamp:
May 18, 2017 11:22:19 AM (7 years ago)
Author:
keith_miller@apple.com
Message:

WebAssembly API: test with neutered inputs
​https://bugs.webkit.org/show_bug.cgi?id=163899

Reviewed by JF Bastien.

JSTests:

  • wasm/js-api/neutered-inputs.js: Added.

(const.testFunction):
(const.testConstructor):

  • wasm/js-api/test_basic_api.js:

(const.c.in.constructorProperties.switch):

Source/JavaScriptCore:

Add tests to check that we properly throw a type error when
we get a transferred ArrayBuffer. Also, we should make sure
we cannot post message a wasm memory's ArrayBuffer.

  • API/JSTypedArray.cpp:

(JSObjectGetArrayBufferBytesPtr):

  • runtime/ArrayBuffer.cpp:

(JSC::ArrayBuffer::makeShared):
(JSC::ArrayBuffer::makeWasmMemory):
(JSC::ArrayBuffer::transferTo):
(JSC::ArrayBuffer::neuter):
(JSC::ArrayBuffer::notifyIncommingReferencesOfTransfer):
(JSC::errorMesasgeForTransfer):

  • runtime/ArrayBuffer.h:

(JSC::ArrayBuffer::isLocked):
(JSC::ArrayBuffer::isWasmMemory):

  • wasm/js/JSWebAssemblyMemory.cpp:

(JSC::JSWebAssemblyMemory::buffer):
(JSC::JSWebAssemblyMemory::grow):

Source/WebCore:

Make it not possible to transfer an ArrayBuffer that is backed by a
wasm memory.

Test: workers/wasm-mem-post-message.html

  • bindings/js/SerializedScriptValue.cpp:

(WebCore::SerializedScriptValue::create):

LayoutTests:

This patch dups Saam's de-modularized builder.

  • workers/sab/postMessage-transfer-type-error-expected.txt:
  • workers/wasm-mem-post-message-expected.txt: Added.
  • workers/wasm-mem-post-message.html: Added.
  • workers/wasm-mem-post-message/test.js: Added.

(worker.onmessage):

  • workers/wasm-mem-post-message/worker.js: Added.

(onmessage):

  • workers/wasm-resources/builder.js: Added.

(const._fail):
(const.isNotA.assert.isNotA):
(const):
(switch.typeof):
(Builder):
(Builder.prototype.setChecked):
(Builder.prototype.setPreamble):
(Builder.prototype._functionIndexSpaceKeyHash):
(Builder.prototype._registerFunctionToIndexSpace):
(Builder.prototype._getFunctionFromIndexSpace):
(Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
(Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.const.codeBuilder.End.switch.case.string_appeared_here.e):
(Builder.prototype._registerSectionBuilders.this.Unknown):

Location:
trunk
Files:
7 added
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r217050 r217052  
     12017-05-18  Keith Miller  <keith_miller@apple.com>
     2
     3        WebAssembly API: test with neutered inputs
     4        https://bugs.webkit.org/show_bug.cgi?id=163899
     5
     6        Reviewed by JF Bastien.
     7
     8        * wasm/js-api/neutered-inputs.js: Added.
     9        (const.testFunction):
     10        (const.testConstructor):
     11        * wasm/js-api/test_basic_api.js:
     12        (const.c.in.constructorProperties.switch):
     13
    1142017-05-18  Filip Pizlo  <fpizlo@apple.com>
    215

  • trunk/JSTests/wasm/js-api/test_basic_api.js

    r214260 r217052  
    6262            assert.throws(() => new WebAssembly[c](buffer), Error, `WebAssembly.Module doesn't parse at byte 0 / 0: expected a module of at least 8 bytes (evaluating 'new WebAssembly[c](buffer)')`);
    6363        assert.instanceof(new WebAssembly[c](emptyModuleArray), WebAssembly.Module);
    64         // FIXME test neutered TypedArray and TypedArrayView. https://bugs.webkit.org/show_bug.cgi?id=163899
    6564        break;
    6665    case "Instance":

  • trunk/LayoutTests/ChangeLog

    r217047 r217052  
     12017-05-18  Keith Miller  <keith_miller@apple.com>
     2
     3        WebAssembly API: test with neutered inputs
     4        https://bugs.webkit.org/show_bug.cgi?id=163899
     5
     6        Reviewed by JF Bastien.
     7
     8        This patch dups Saam's de-modularized builder.
     9
     10        * workers/sab/postMessage-transfer-type-error-expected.txt:
     11        * workers/wasm-mem-post-message-expected.txt: Added.
     12        * workers/wasm-mem-post-message.html: Added.
     13        * workers/wasm-mem-post-message/test.js: Added.
     14        (worker.onmessage):
     15        * workers/wasm-mem-post-message/worker.js: Added.
     16        (onmessage):
     17        * workers/wasm-resources/builder.js: Added.
     18        (const._fail):
     19        (const.isNotA.assert.isNotA):
     20        (const):
     21        (switch.typeof):
     22        (Builder):
     23        (Builder.prototype.setChecked):
     24        (Builder.prototype.setPreamble):
     25        (Builder.prototype._functionIndexSpaceKeyHash):
     26        (Builder.prototype._registerFunctionToIndexSpace):
     27        (Builder.prototype._getFunctionFromIndexSpace):
     28        (Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
     29        (Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.const.codeBuilder.End.switch.case.string_appeared_here.e):
     30        (Builder.prototype._registerSectionBuilders.this.Unknown):
     31
    1322017-05-18  Chris Dumez  <cdumez@apple.com>
    233

  • trunk/LayoutTests/workers/sab/postMessage-transfer-type-error-expected.txt

    r212301 r217052  
    44
    55
    6 PASS postMessageTransferSharedArrayBuffer() threw exception TypeError: Type error.
     6PASS postMessageTransferSharedArrayBuffer() threw exception TypeError: Cannot transfer a SharedArrayBuffer.
    77PASS successfullyParsed is true
    88

  • trunk/Source/JavaScriptCore/API/JSTypedArray.cpp

    r211247 r217052  
    318318}
    319319
    320 void* JSObjectGetArrayBufferBytesPtr(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)
     320void* JSObjectGetArrayBufferBytesPtr(JSContextRef ctx, JSObjectRef objectRef, JSValueRef* exception)
    321321{
    322322    ExecState* exec = toJS(ctx);
    … …  
    327327    if (JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(vm, object)) {
    328328        ArrayBuffer* buffer = jsBuffer->impl();
     329        if (buffer->isWasmMemory()) {
     330            setException(exec, exception, createTypeError(exec, ASCIILiteral("Cannot get the backing buffer for a WebAssembly.Memory")));
     331            return nullptr;
     332        }
     333
    329334        buffer->pinAndLock();
    330335        return buffer->data();

  • trunk/Source/JavaScriptCore/ChangeLog

    r217051 r217052  
     12017-05-18  Keith Miller  <keith_miller@apple.com>
     2
     3        WebAssembly API: test with neutered inputs
     4        https://bugs.webkit.org/show_bug.cgi?id=163899
     5
     6        Reviewed by JF Bastien.
     7
     8        Add tests to check that we properly throw a type error when
     9        we get a transferred ArrayBuffer. Also, we should make sure
     10        we cannot post message a wasm memory's ArrayBuffer.
     11
     12        * API/JSTypedArray.cpp:
     13        (JSObjectGetArrayBufferBytesPtr):
     14        * runtime/ArrayBuffer.cpp:
     15        (JSC::ArrayBuffer::makeShared):
     16        (JSC::ArrayBuffer::makeWasmMemory):
     17        (JSC::ArrayBuffer::transferTo):
     18        (JSC::ArrayBuffer::neuter):
     19        (JSC::ArrayBuffer::notifyIncommingReferencesOfTransfer):
     20        (JSC::errorMesasgeForTransfer):
     21        * runtime/ArrayBuffer.h:
     22        (JSC::ArrayBuffer::isLocked):
     23        (JSC::ArrayBuffer::isWasmMemory):
     24        * wasm/js/JSWebAssemblyMemory.cpp:
     25        (JSC::JSWebAssemblyMemory::buffer):
     26        (JSC::JSWebAssemblyMemory::grow):
     27
    1282017-05-18  Joseph Pecoraro  <pecoraro@apple.com>
    229

  • trunk/Source/JavaScriptCore/runtime/ArrayBuffer.cpp

    r212035 r217052  
    249249    : m_contents(WTFMove(contents))
    250250    , m_pinCount(0)
     251    , m_isWasmMemory(false)
    251252    , m_locked(false)
    252253{
    … …  
    274275{
    275276    m_contents.makeShared();
     277    m_locked = true;
     278}
     279
     280void ArrayBuffer::makeWasmMemory()
     281{
     282    m_locked = true;
     283    m_isWasmMemory = true;
    276284}
    277285
    … …  
    320328
    321329    m_contents.transferTo(result);
     330    notifyIncommingReferencesOfTransfer(vm);
     331    return true;
     332}
     333
     334// We allow neutering wasm memory ArrayBuffers even though they are locked.
     335void ArrayBuffer::neuter(VM& vm)
     336{
     337    ASSERT(isWasmMemory());
     338    ArrayBufferContents unused;
     339    m_contents.transferTo(unused);
     340    notifyIncommingReferencesOfTransfer(vm);
     341}
     342
     343void ArrayBuffer::notifyIncommingReferencesOfTransfer(VM& vm)
     344{
    322345    for (size_t i = numberOfIncomingReferences(); i--;) {
    323346        JSCell* cell = incomingReferenceAt(i);
    … …  
    327350            watchpoint->fireAll();
    328351    }
    329     return true;
     352}
     353
     354ASCIILiteral errorMesasgeForTransfer(ArrayBuffer* buffer)
     355{
     356    ASSERT(buffer->isLocked());
     357    if (buffer->isShared())
     358        return ASCIILiteral("Cannot transfer a SharedArrayBuffer");
     359    if (buffer->isWasmMemory())
     360        return ASCIILiteral("Cannot transfer a WebAssembly.Memory");
     361    return ASCIILiteral("Cannot transfer an ArrayBuffer whose backing store has been accessed by the JavaScriptCore C API");
    330362}
    331363

  • trunk/Source/JavaScriptCore/runtime/ArrayBuffer.h

    r215686 r217052  
    3232#include <wtf/StdLibExtras.h>
    3333#include <wtf/ThreadSafeRefCounted.h>
     34#include <wtf/text/WTFString.h>
    3435
    3536namespace JSC {
    … …  
    123124    inline bool isShared() const;
    124125    inline ArrayBufferSharingMode sharingMode() const { return isShared() ? ArrayBufferSharingMode::Shared : ArrayBufferSharingMode::Default; }
    125    
     126
    126127    inline size_t gcSizeEstimateInBytes() const;
    127128
    … …  
    132133    inline void unpin();
    133134    inline void pinAndLock();
     135    inline bool isLocked();
     136
     137    void makeWasmMemory();
     138    inline bool isWasmMemory();
    134139
    135140    JS_EXPORT_PRIVATE bool transferTo(VM&, ArrayBufferContents&);
    136141    JS_EXPORT_PRIVATE bool shareWith(ArrayBufferContents&);
     142
     143    void neuter(VM&);
    137144    bool isNeutered() { return !m_contents.m_data; }
    138    
     145
    139146    static ptrdiff_t offsetOfData() { return OBJECT_OFFSETOF(ArrayBuffer, m_contents) + OBJECT_OFFSETOF(ArrayBufferContents, m_data); }
    140147
    … …  
    150157    static inline int clampValue(int x, int left, int right);
    151158
     159    void notifyIncommingReferencesOfTransfer(VM&);
     160
    152161    ArrayBufferContents m_contents;
    153     unsigned m_pinCount : 31;
    154     bool m_locked : 1; // m_locked == true means that some API user fetched m_contents directly from a TypedArray object.
     162    unsigned m_pinCount : 30;
     163    bool m_isWasmMemory : 1;
     164    // m_locked == true means that some API user fetched m_contents directly from a TypedArray object,
     165    // the buffer is backed by a WebAssembly.Memory, or is a SharedArrayBuffer.
     166    bool m_locked : 1;
    155167
    156168public:
    … …  
    217229}
    218230
     231bool ArrayBuffer::isLocked()
     232{
     233    return m_locked;
     234}
     235
     236bool ArrayBuffer::isWasmMemory()
     237{
     238    return m_isWasmMemory;
     239}
     240
     241JS_EXPORT_PRIVATE ASCIILiteral errorMesasgeForTransfer(ArrayBuffer*);
     242
    219243} // namespace JSC
    220244

  • trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp

    r217049 r217052  
    6969    auto destructor = [protectedMemory = WTFMove(protectedMemory)] (void*) { };
    7070    m_buffer = ArrayBuffer::createFromBytes(memory().memory(), memory().size(), WTFMove(destructor));
     71    m_buffer->makeWasmMemory();
    7172    m_bufferWrapper.set(vm, this, JSArrayBuffer::create(vm, globalObject->m_arrayBufferStructure.get(), m_buffer.get()));
    7273    RELEASE_ASSERT(m_bufferWrapper);
    … …  
    111112    // Neuter the old array.
    112113    if (m_buffer) {
    113         ArrayBufferContents dummyContents;
    114         m_buffer->transferTo(vm, dummyContents);
     114        m_buffer->neuter(vm);
    115115        m_buffer = nullptr;
    116116        m_bufferWrapper.clear();

  • trunk/Source/WebCore/ChangeLog

    r217049 r217052  
     12017-05-18  Keith Miller  <keith_miller@apple.com>
     2
     3        WebAssembly API: test with neutered inputs
     4        https://bugs.webkit.org/show_bug.cgi?id=163899
     5
     6        Reviewed by JF Bastien.
     7
     8        Make it not possible to transfer an ArrayBuffer that is backed by a
     9        wasm memory.
     10
     11        Test: workers/wasm-mem-post-message.html
     12
     13        * bindings/js/SerializedScriptValue.cpp:
     14        (WebCore::SerializedScriptValue::create):
     15
    1162017-05-18  Commit Queue  <commit-queue@webkit.org>
    217

  • trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp

    r216428 r217052  
    29972997            if (arrayBuffer->isNeutered())
    29982998                return Exception { DATA_CLONE_ERR };
    2999             if (arrayBuffer->isShared())
    3000                 return Exception { TypeError };
     2999            if (arrayBuffer->isLocked()) {
     3000                auto scope = DECLARE_THROW_SCOPE(vm);
     3001                throwVMTypeError(&state, scope, errorMesasgeForTransfer(arrayBuffer));
     3002                return Exception { ExistingExceptionError };
     3003            }
    30013004            arrayBuffers.append(WTFMove(arrayBuffer));
    30023005            continue;
Note: See TracChangeset for help on using the changeset viewer.