Changeset 265045 in webkit

Timestamp:

Jul 29, 2020 9:54:11 AM (4 years ago)

Author:

mark.lam@apple.com

Message:

Update some JSArrayBufferView comments and add some assertions.
​https://bugs.webkit.org/show_bug.cgi?id=214914

Reviewed by Darin Adler.

• runtime/ArrayBuffer.cpp:

(JSC::ArrayBuffer::createAdopted):

• runtime/JSArrayBufferView.cpp:

(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
(JSC::JSArrayBufferView::finalize):

• runtime/JSArrayBufferView.h:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/ArrayBuffer.cpp (modified) (2 diffs)
• runtime/JSArrayBufferView.cpp (modified) (3 diffs)
• runtime/JSArrayBufferView.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-07-29  Mark Lam  <mark.lam@apple.com>
+
+        Update some JSArrayBufferView comments and add some assertions.
+        https://bugs.webkit.org/show_bug.cgi?id=214914
+
+        Reviewed by Darin Adler.
+
+        * runtime/ArrayBuffer.cpp:
+        (JSC::ArrayBuffer::createAdopted):
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+        (JSC::JSArrayBufferView::finalize):
+        * runtime/JSArrayBufferView.h:
+
 2020-07-29  Paulo Matos  <pmatos@igalia.com>
 

trunk/Source/JavaScriptCore/runtime/ArrayBuffer.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2009-2018 Apple Inc. All rights reserved.
+ * Copyright (C) 2009-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -211 +211 @@
 Ref<ArrayBuffer> ArrayBuffer::createAdopted(const void* data, unsigned byteLength)
 {
+    ASSERT(!Gigacage::isEnabled() || (Gigacage::contains(data) && Gigacage::contains(static_cast<const uint8_t*>(data) + byteLength - 1)));
     return createFromBytes(data, byteLength, ArrayBuffer::primitiveGigacageDestructor());
 }

trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -49 +49 @@
     , m_butterfly(nullptr)
 {
+    ASSERT(!Gigacage::isEnabled() || (Gigacage::contains(vector) && Gigacage::contains(static_cast<const uint8_t*>(vector) + length - 1)));
     ASSERT(vector == removeArrayPtrTag(vector));
     RELEASE_ASSERT(length <= fastSizeLimit);
@@ -191 +192 @@
 {
     JSArrayBufferView* thisObject = static_cast<JSArrayBufferView*>(cell);
+
+    // This JSArrayBufferView could be an OversizeTypedArray that was converted
+    // to a WastefulTypedArray via slowDownAndWasteMemory(). Hence, it is possible
+    // to get to this finalizer and found the mode to be WastefulTypedArray.
     ASSERT(thisObject->m_mode == OversizeTypedArray || thisObject->m_mode == WastefulTypedArray);
     if (thisObject->m_mode == OversizeTypedArray)

trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -56 +56 @@
 // buffer or the DOM-specified neutering capabilities.
 enum TypedArrayMode : uint32_t {
+    // Legend:
+    // B: JSArrayBufferView::m_butterfly pointer
+    // V: JSArrayBufferView::m_vector pointer
+    // M: JSArrayBufferView::m_mode
+
     // Small and fast typed array. B is unused, V points to a vector
-    // allocated in copied space, and M = FastTypedArray. V's liveness is
-    // determined entirely by the view's liveness.
+    // allocated in the primitive Gigacage, and M = FastTypedArray. V's
+    // liveness is determined entirely by the view's liveness.
     FastTypedArray,
-    
+
     // A large typed array that still attempts not to waste too much
-    // memory. B is initialized to point to a slot that could hold a
-    // buffer pointer, V points to a vector allocated using fastCalloc(),
-    // and M = OversizeTypedArray. V's liveness is determined entirely by
-    // the view's liveness, and the view will add a finalizer to delete V.
+    // memory. B is unused, V points to a vector allocated using
+    // Gigacage::tryMalloc(), and M = OversizeTypedArray. V's liveness is
+    // determined entirely by the view's liveness, and the view will add a
+    // finalizer to delete V.
     OversizeTypedArray,
-    
+
     // A typed array that was used in some crazy way. B's IndexingHeader
     // is hijacked to contain a reference to the native array buffer. The
@@ -74 +79 @@
     // The view does not own the vector.
     WastefulTypedArray,
-    
+
     // A data view. B is unused, V points to a vector allocated using who-
     // knows-what, and M = DataViewMode. The view does not own the vector.