Title: [282541] releases/WebKitGTK/webkit-2.32
- Revision
- 282541
- Author
- [email protected]
- Date
- 2021-09-16 03:43:17 -0700 (Thu, 16 Sep 2021)
Log Message
Merge r279076 - Release assert memory in JSC::Wasm::Memory::growShared(JSC::Wasm::PageCount)::<lambda()>
https://bugs.webkit.org/show_bug.cgi?id=227180
Reviewed by Keith Miller.
JSTests:
* stress/shared-wasm-memory-with-zero-byte.js: Added.
Source/_javascript_Core:
When Wasm.Memory is shared, we should allocate bound growable memory even if initial size is 0 bytes,
since this range can be later extended by mprotect. If maximum size is also 0 byte, we already have
a path that does not allocate anything.
* wasm/WasmMemory.cpp:
(JSC::Wasm::Memory::tryCreate):
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/JSTests/ChangeLog (282540 => 282541)
--- releases/WebKitGTK/webkit-2.32/JSTests/ChangeLog 2021-09-16 10:39:11 UTC (rev 282540)
+++ releases/WebKitGTK/webkit-2.32/JSTests/ChangeLog 2021-09-16 10:43:17 UTC (rev 282541)
@@ -1,3 +1,12 @@
+2021-06-21 Yusuke Suzuki <[email protected]>
+
+ Release assert memory in JSC::Wasm::Memory::growShared(JSC::Wasm::PageCount)::<lambda()>
+ https://bugs.webkit.org/show_bug.cgi?id=227180
+
+ Reviewed by Keith Miller.
+
+ * stress/shared-wasm-memory-with-zero-byte.js: Added.
+
2021-03-16 Saam Barati <[email protected]>
Object allocation sinking phase should prioritize materializations with no dependencies before materializations with no reverse dependencies
Added: releases/WebKitGTK/webkit-2.32/JSTests/stress/shared-wasm-memory-with-zero-byte.js (0 => 282541)
--- releases/WebKitGTK/webkit-2.32/JSTests/stress/shared-wasm-memory-with-zero-byte.js (rev 0)
+++ releases/WebKitGTK/webkit-2.32/JSTests/stress/shared-wasm-memory-with-zero-byte.js 2021-09-16 10:43:17 UTC (rev 282541)
@@ -0,0 +1,2 @@
+if (typeof WebAssembly !== 'undefined')
+ (new WebAssembly.Memory({initial: 0, maximum: 1, shared: true})).grow(1)
Modified: releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/ChangeLog (282540 => 282541)
--- releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/ChangeLog 2021-09-16 10:39:11 UTC (rev 282540)
+++ releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/ChangeLog 2021-09-16 10:43:17 UTC (rev 282541)
@@ -1,3 +1,17 @@
+2021-06-21 Yusuke Suzuki <[email protected]>
+
+ Release assert memory in JSC::Wasm::Memory::growShared(JSC::Wasm::PageCount)::<lambda()>
+ https://bugs.webkit.org/show_bug.cgi?id=227180
+
+ Reviewed by Keith Miller.
+
+ When Wasm.Memory is shared, we should allocate bound growable memory even if initial size is 0 bytes,
+ since this range can be later extended by mprotect. If maximum size is also 0 byte, we already have
+ a path that does not allocate anything.
+
+ * wasm/WasmMemory.cpp:
+ (JSC::Wasm::Memory::tryCreate):
+
2021-04-12 BJ Burg <[email protected]>
Modernize uses of ConsoleClient
Modified: releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/wasm/WasmMemory.cpp (282540 => 282541)
--- releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/wasm/WasmMemory.cpp 2021-09-16 10:39:11 UTC (rev 282540)
+++ releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/wasm/WasmMemory.cpp 2021-09-16 10:43:17 UTC (rev 282541)
@@ -416,11 +416,11 @@
if (UNLIKELY(Options::crashIfWebAssemblyCantFastMemory()))
webAssemblyCouldntGetFastMemory();
- if (!initialBytes)
- return adoptRef(new Memory(initial, maximum, sharingMode, WTFMove(notifyMemoryPressure), WTFMove(syncTryToReclaimMemory), WTFMove(growSuccessCallback)));
-
switch (sharingMode) {
case MemorySharingMode::Default: {
+ if (!initialBytes)
+ return adoptRef(new Memory(initial, maximum, sharingMode, WTFMove(notifyMemoryPressure), WTFMove(syncTryToReclaimMemory), WTFMove(growSuccessCallback)));
+
void* slowMemory = Gigacage::tryAllocateZeroedVirtualPages(Gigacage::Primitive, initialBytes);
if (!slowMemory) {
memoryManager().freePhysicalBytes(initialBytes);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
