wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-20 22:27:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

Limit the number of SharedArrayBuffers in normal JS code (not just asm.js).

Browse source
This commit is contained in:
wolfbeast 2018-01-04 22:24:58 +01:00 • committed by Roy Tam
commit ad659f4f28
1 changed files with 19 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

18
js/src/vm/SharedArrayObject.cpp
View file

@ -116,10 +116,6 @@ SharedArrayRawBuffer::New(JSContext* cx, uint32_t length)
if (allocSize <= length) if (allocSize <= length)
return nullptr; return nullptr;
bool preparedForAsmJS = jit::JitOptions.asmJSAtomicsEnable && IsValidAsmJSHeapLength(length);
void* p = nullptr;
if (preparedForAsmJS) {
// Test >= to guard against the case where multiple extant runtimes // Test >= to guard against the case where multiple extant runtimes
// race to allocate. // race to allocate.
if (++numLive >= maxLive) { if (++numLive >= maxLive) {
@ -132,6 +128,10 @@ SharedArrayRawBuffer::New(JSContext* cx, uint32_t length)
} }
} }
bool preparedForAsmJS = jit::JitOptions.asmJSAtomicsEnable && IsValidAsmJSHeapLength(length);
void* p = nullptr;
if (preparedForAsmJS) {
uint32_t mappedSize = SharedArrayMappedSize(allocSize); uint32_t mappedSize = SharedArrayMappedSize(allocSize);
// Get the entire reserved region (with all pages inaccessible) // Get the entire reserved region (with all pages inaccessible)
@ -154,9 +154,11 @@ SharedArrayRawBuffer::New(JSContext* cx, uint32_t length)
# endif # endif
} else { } else {
p = MapMemory(allocSize, true); p = MapMemory(allocSize, true);
if (!p) if (!p) {
numLive--;
return nullptr; return nullptr;
} }
}
uint8_t* buffer = reinterpret_cast<uint8_t*>(p) + gc::SystemPageSize(); uint8_t* buffer = reinterpret_cast<uint8_t*>(p) + gc::SystemPageSize();
uint8_t* base = buffer - sizeof(SharedArrayRawBuffer); uint8_t* base = buffer - sizeof(SharedArrayRawBuffer);
@ -189,8 +191,6 @@ SharedArrayRawBuffer::dropReference()
uint32_t allocSize = SharedArrayAllocSize(this->length); uint32_t allocSize = SharedArrayAllocSize(this->length);
if (this->preparedForAsmJS) { if (this->preparedForAsmJS) {
numLive--;
uint32_t mappedSize = SharedArrayMappedSize(allocSize); uint32_t mappedSize = SharedArrayMappedSize(allocSize);
UnmapMemory(address, mappedSize); UnmapMemory(address, mappedSize);
@ -202,6 +202,10 @@ SharedArrayRawBuffer::dropReference()
} else { } else {
UnmapMemory(address, allocSize); UnmapMemory(address, allocSize);
} }
// Decrement the buffer counter at the end -- otherwise, a race condition
// could enable the creation of unlimited buffers.
numLive--;
} }