wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-03 22:38:41 +09:00
Code Issues Projects Releases Packages Wiki Activity

Limit the number of SharedArrayBuffers in normal JS code (not just asm.js).

Browse source
This commit is contained in:
wolfbeast 2018-01-04 22:24:58 +01:00 • committed by Roy Tam
commit ad659f4f28
1 changed files with 19 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

34
js/src/vm/SharedArrayObject.cpp
View file

@ -116,22 +116,22 @@ SharedArrayRawBuffer::New(JSContext* cx, uint32_t length)
if (allocSize <= length)
return nullptr;
// Test >= to guard against the case where multiple extant runtimes
// race to allocate.
if (++numLive >= maxLive) {
JSRuntime* rt = cx->runtime();
if (rt->largeAllocationFailureCallback)
rt->largeAllocationFailureCallback(rt->largeAllocationFailureCallbackData);
if (numLive >= maxLive) {
numLive--;
return nullptr;
}
}
bool preparedForAsmJS = jit::JitOptions.asmJSAtomicsEnable && IsValidAsmJSHeapLength(length);
void* p = nullptr;
if (preparedForAsmJS) {
// Test >= to guard against the case where multiple extant runtimes
// race to allocate.
if (++numLive >= maxLive) {
JSRuntime* rt = cx->runtime();
if (rt->largeAllocationFailureCallback)
rt->largeAllocationFailureCallback(rt->largeAllocationFailureCallbackData);
if (numLive >= maxLive) {
numLive--;
return nullptr;
}
}
uint32_t mappedSize = SharedArrayMappedSize(allocSize);
// Get the entire reserved region (with all pages inaccessible)
@ -154,8 +154,10 @@ SharedArrayRawBuffer::New(JSContext* cx, uint32_t length)
# endif
} else {
p = MapMemory(allocSize, true);
if (!p)
if (!p) {
numLive--;
return nullptr;
}
}
uint8_t* buffer = reinterpret_cast<uint8_t*>(p) + gc::SystemPageSize();
@ -189,8 +191,6 @@ SharedArrayRawBuffer::dropReference()
uint32_t allocSize = SharedArrayAllocSize(this->length);
if (this->preparedForAsmJS) {
numLive--;
uint32_t mappedSize = SharedArrayMappedSize(allocSize);
UnmapMemory(address, mappedSize);
@ -202,6 +202,10 @@ SharedArrayRawBuffer::dropReference()
} else {
UnmapMemory(address, allocSize);
}
// Decrement the buffer counter at the end -- otherwise, a race condition
// could enable the creation of unlimited buffers.
numLive--;
}