Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2c2c1af3574308929fecb71bc1897b8f6b04dc2e
https://github.com/WebKit/WebKit/commit/2c2c1af3574308929fecb71bc1897b8f6b04dc2e
Author: Yusuke Suzuki <[email protected]>
Date: 2026-08-07 (Fri, 07 Aug 2026)
Changed paths:
A JSTests/stress/array-buffer-slice-larger-than-4gb.js
M JSTests/stress/shared-array-buffer-large-maxbytelength.js
A
JSTests/stress/typedarray-canonical-numeric-index-string-past-max-array-index.js
A JSTests/stress/typedarray-index-past-max-array-index.js
M JSTests/wasm/js-api/memory-toResizableBuffer.js
M JSTests/wasm/js-api/memory64-js-api-errors.js
M JSTests/wasm/js-api/memory64-js-api.js
A JSTests/wasm/stress/memory64-grow-past-4gb.js
A JSTests/wasm/stress/memory64-maximum-limits.js
M JSTests/wasm/stress/memory64-oversized-limits.js
M JSTests/wasm/v8/memory64.js
M LayoutTests/fast/canvas/webgl/array-unit-tests.html
M LayoutTests/fast/canvas/webgl/webgl-array-invalid-ranges.html
A
LayoutTests/fast/canvas/webgl/webgl2-array-buffer-view-offset-past-32-bits-expected.txt
A
LayoutTests/fast/canvas/webgl/webgl2-array-buffer-view-offset-past-32-bits.html
A
LayoutTests/http/tests/websocket/tests/hybi/bufferedAmount-past-32-bits-after-close-expected.txt
A
LayoutTests/http/tests/websocket/tests/hybi/bufferedAmount-past-32-bits-after-close.html
A LayoutTests/webrtc/generate-certificate-public-exponent-expected.txt
A LayoutTests/webrtc/generate-certificate-public-exponent.html
M Source/JavaScriptCore/runtime/ArrayBuffer.cpp
M Source/JavaScriptCore/runtime/ArrayBuffer.h
M Source/JavaScriptCore/runtime/BufferMemoryHandle.cpp
M Source/JavaScriptCore/runtime/BufferMemoryHandle.h
M Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp
M Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h
M Source/JavaScriptCore/runtime/PageCount.h
M Source/JavaScriptCore/runtime/PropertyName.h
M Source/JavaScriptCore/wasm/WasmAddressType.cpp
M Source/JavaScriptCore/wasm/WasmAddressType.h
M Source/JavaScriptCore/wasm/WasmLimits.h
M Source/JavaScriptCore/wasm/WasmMemory.cpp
M Source/JavaScriptCore/wasm/WasmMemory.h
M Source/JavaScriptCore/wasm/WasmSectionParser.cpp
M Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp
M Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.cpp
M Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
M Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h
M
Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
M
Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h
M Source/WebCore/Modules/websockets/WebSocket.cpp
M Source/WebCore/Modules/websockets/WebSocket.h
M Source/WebCore/Modules/websockets/WebSocket.idl
M Source/WebCore/Modules/websockets/WebSocketChannelClient.h
M Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
M Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h
M Source/WebCore/css/FontFace.cpp
M Source/WebCore/fileapi/NetworkSendQueue.cpp
M Source/WebCore/fileapi/NetworkSendQueue.h
M Source/WebCore/html/canvas/WebGL2RenderingContext.cpp
M Source/WebCore/html/canvas/WebGL2RenderingContext.h
M Source/WebCore/html/canvas/WebGL2RenderingContext.idl
M Source/WebCore/html/canvas/WebGLMultiDraw.cpp
M Source/WebCore/html/canvas/WebGLMultiDraw.h
M
Source/WebCore/html/canvas/WebGLMultiDrawInstancedBaseVertexBaseInstance.cpp
M Source/WebCore/html/canvas/WebGLMultiDrawInstancedBaseVertexBaseInstance.h
M Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
M Source/WebCore/html/canvas/WebGLRenderingContextBase.h
M Source/WebCore/platform/graphics/iso/ISOBox.cpp
M Source/WebKit/WebProcess/Network/WebSocketChannel.cpp
M Source/WebKit/WebProcess/Network/WebSocketChannel.h
M Source/WebKitLegacy/WebCoreSupport/WebSocketChannel.cpp
M Source/WebKitLegacy/WebCoreSupport/WebSocketChannel.h
M Source/bmalloc/bmalloc/Gigacage.h
Log Message:
-----------
[JSC] Overhaul ArrayBuffer & Wasm::Memory sizing with memory64
https://bugs.webkit.org/show_bug.cgi?id=321182
rdar://184241045
Reviewed by Yijia Huang.
Currently memory64 crashes when growing a shared buffer more than 4GB.
We have an inconsistency in our current implementation in terms of
size. ArrayBuffer's maximum size is right now 4GB, but Wasm::Memory's
maximum reserved size is 2^37-1 pages, which is way more than the
actually usable memory (8PB).
This patch overhauls the design and the limit of ArrayBuffer / Wasm::Memory
sizing.
1. Now ArrayBuffer max size is bumped from 4GB to 16GB, aligning to V8's
number. Also this 16GB is aligned to the spec's limit size[1].
"The maximum size of a 64-bit memory is 262,144 pages (16 GiB)."
Because of our LARGE_TYPED_ARRAYS work, size of ArrayBuffer can be
larger than 4GB already, so changing this is not hard. On 32bit
environment, no threshold change is done.
2. We introduce a limit for memory32 and memory64 based on the spec[1].
4GB for memory32 and 16GB for memory64.
3. We also found that some of WebCore side is truncating size of
ArrayBuffer to `unsinged` (32bit) while it can be 64bit size before
this change. They are semantically incorrect but it is fine (just
only handling small sized part), but anyway, fixing them.
4. Also avoid calling GC while taking a lock of BufferMemoryHandle.
5. This also revealed many of WebGL issues too, where it is not using
`unsinged long long` while spec requires so. This patch fixes them
too as they started becoming failures after ArrayBuffer can get
larger size than 32bit.
Three web-visible behavior changes fall out of this:
1. A memory64 may now declare a maximum of at most 262144 pages, down from
PageCount's own 2^37-1. A module declaring more used to compile and
instantiate at its initial size and now fails WebAssembly.Module(), which
matches V8's kV8MaxWasmMemory64Pages. JSTests/wasm/v8/memory64.js's two
tests for this are re-enabled.
2. A memory's buffer reports the maximum this platform could actually grow it
to, rather than the one the address type permits declaring, so that a resize
within maxByteLength never fails deterministically. The two differ wherever
the Primitive address space budget is the tighter bound.
3. RTCPeerConnection.generateCertificate() reads publicExponent as the big
endian WebCrypto BigInteger it is, rather than little endian, and accepts
arbitrary leading zero padding. WebSocket.send() now fails the connection
for a binary payload too large to frame instead of dropping it or crashing.
[1]: https://www.w3.org/TR/wasm-js-api-2/#limits
Tests: JSTests/stress/array-buffer-slice-larger-than-4gb.js
JSTests/wasm/stress/memory64-grow-past-4gb.js
JSTests/wasm/stress/memory64-maximum-limits.js
webrtc/generate-certificate-public-exponent.html
* JSTests/stress/array-buffer-slice-larger-than-4gb.js: Added.
(shouldBe):
* JSTests/stress/shared-array-buffer-large-maxbytelength.js:
(catch):
*
JSTests/stress/typedarray-canonical-numeric-index-string-past-max-array-index.js:
Added.
(shouldBe):
(const.key.of.keys.array.key.valueOf):
* JSTests/stress/typedarray-index-past-max-array-index.js: Added.
(shouldBe):
(catch):
(array.undefined.String):
* JSTests/wasm/js-api/memory-toResizableBuffer.js:
(assertTrue):
* JSTests/wasm/js-api/memory64-js-api-errors.js:
(assert.throws):
* JSTests/wasm/js-api/memory64-js-api.js:
(assert.throws):
* JSTests/wasm/stress/memory64-grow-past-4gb.js: Added.
(catch):
(true.try.mem.await.instantiate.module.memory):
(true.catch):
(true.canHostPastFourGiB.catch):
(assert.throws.grow):
* JSTests/wasm/stress/memory64-maximum-limits.js: Added.
(true.try.mem.await.instantiate.module.memory):
(true.catch):
* JSTests/wasm/stress/memory64-oversized-limits.js:
(moduleBytesWithMemoryLimits):
* JSTests/wasm/v8/memory64.js:
(BasicMemory64Tests):
(TestBulkMemoryOperations): Deleted.
* LayoutTests/fast/canvas/webgl/array-unit-tests.html:
* LayoutTests/fast/canvas/webgl/webgl-array-invalid-ranges.html:
*
LayoutTests/fast/canvas/webgl/webgl2-array-buffer-view-offset-past-32-bits-expected.txt:
Added.
*
LayoutTests/fast/canvas/webgl/webgl2-array-buffer-view-offset-past-32-bits.html:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/bufferedAmount-past-32-bits-after-close-expected.txt:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/bufferedAmount-past-32-bits-after-close.html:
Added.
* LayoutTests/webrtc/generate-certificate-public-exponent-expected.txt: Added.
* LayoutTests/webrtc/generate-certificate-public-exponent.html: Added.
* Source/JavaScriptCore/runtime/ArrayBuffer.cpp:
(JSC::tryAllocateResizableMemory):
(JSC::ArrayBuffer::resize):
(JSC::SharedArrayBufferContents::grow):
(JSC::SharedArrayBufferContents::tryGrow):
* Source/JavaScriptCore/runtime/ArrayBuffer.h:
* Source/JavaScriptCore/runtime/BufferMemoryHandle.cpp:
(JSC::BufferMemoryHandle::fastMappedBytes):
* Source/JavaScriptCore/runtime/BufferMemoryHandle.h:
* Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp:
(JSC::arrayBufferSlice):
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
(JSC::JSGenericTypedArrayView<Adaptor>::put):
(JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
(JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
* Source/JavaScriptCore/runtime/PageCount.h:
* Source/JavaScriptCore/runtime/PropertyName.h:
(JSC::isCanonicalNumericIndexString):
* Source/JavaScriptCore/wasm/WasmAddressType.cpp:
* Source/JavaScriptCore/wasm/WasmAddressType.h:
(JSC::Wasm::AddressType::AddressType):
(JSC::Wasm::AddressType::is64Bit const):
* Source/JavaScriptCore/wasm/WasmLimits.h:
(JSC::Wasm::maxDeclarablePages):
(JSC::Wasm::maxBufferByteLength):
(JSC::Wasm::static_assert):
* Source/JavaScriptCore/wasm/WasmMemory.cpp:
(JSC::Wasm::maxAllocatableBytes):
(JSC::Wasm::Memory::tryCreate):
(JSC::Wasm::Memory::growShared):
(JSC::Wasm::Memory::grow):
* Source/JavaScriptCore/wasm/WasmMemory.h:
* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:
(JSC::Wasm::SectionParser::parseMemoryHelper):
* Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp:
(JSC::JSWebAssemblyMemory::associateArrayBuffer):
* Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.cpp:
(JSC::WebAssemblyMemoryConstructor::createMemoryFromDescriptor):
* Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp:
(WebCore::certificateTypeFromAlgorithmIdentifier):
* Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h:
* Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
(WebCore::ThreadableWebSocketChannelClientWrapper::didUpdateBufferedAmount):
(WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
* Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
* Source/WebCore/Modules/websockets/WebSocket.cpp:
(WebCore::saturateAdd):
(WebCore::isFramablePayloadSize):
(WebCore::WebSocket::send):
(WebCore::WebSocket::bufferedAmount const):
(WebCore::WebSocket::didUpdateBufferedAmount):
(WebCore::WebSocket::didClose):
* Source/WebCore/Modules/websockets/WebSocket.h:
* Source/WebCore/Modules/websockets/WebSocket.idl:
* Source/WebCore/Modules/websockets/WebSocketChannelClient.h:
* Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
(WebCore::WorkerThreadableWebSocketChannel::send):
(WebCore::WorkerThreadableWebSocketChannel::Peer::didUpdateBufferedAmount):
(WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
(WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
* Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h:
* Source/WebCore/css/FontFace.cpp:
(WebCore::FontFace::create):
* Source/WebCore/fileapi/NetworkSendQueue.cpp:
(WebCore::NetworkSendQueue::enqueue):
* Source/WebCore/fileapi/NetworkSendQueue.h:
* Source/WebCore/html/canvas/WebGL2RenderingContext.cpp:
(WebCore::WebGL2RenderingContext::arrayBufferViewSliceFactory):
(WebCore::WebGL2RenderingContext::sliceArrayBufferView):
(WebCore::WebGL2RenderingContext::bufferData):
(WebCore::WebGL2RenderingContext::bufferSubData):
(WebCore::WebGL2RenderingContext::getBufferSubData):
(WebCore::WebGL2RenderingContext::texImage2D):
(WebCore::WebGL2RenderingContext::texImage3D):
(WebCore::WebGL2RenderingContext::texSubImage2D):
(WebCore::WebGL2RenderingContext::texSubImage3D):
(WebCore::WebGL2RenderingContext::compressedTexImage2D):
(WebCore::WebGL2RenderingContext::compressedTexImage3D):
(WebCore::WebGL2RenderingContext::compressedTexSubImage2D):
(WebCore::WebGL2RenderingContext::compressedTexSubImage3D):
(WebCore::WebGL2RenderingContext::uniform1uiv):
(WebCore::WebGL2RenderingContext::uniform2uiv):
(WebCore::WebGL2RenderingContext::uniform3uiv):
(WebCore::WebGL2RenderingContext::uniform4uiv):
(WebCore::WebGL2RenderingContext::uniformMatrix2x3fv):
(WebCore::WebGL2RenderingContext::uniformMatrix3x2fv):
(WebCore::WebGL2RenderingContext::uniformMatrix2x4fv):
(WebCore::WebGL2RenderingContext::uniformMatrix4x2fv):
(WebCore::WebGL2RenderingContext::uniformMatrix3x4fv):
(WebCore::WebGL2RenderingContext::uniformMatrix4x3fv):
(WebCore::WebGL2RenderingContext::vertexAttribI4iv):
(WebCore::WebGL2RenderingContext::vertexAttribI4uiv):
(WebCore::WebGL2RenderingContext::clearBufferiv):
(WebCore::WebGL2RenderingContext::clearBufferuiv):
(WebCore::WebGL2RenderingContext::clearBufferfv):
(WebCore::WebGL2RenderingContext::validateClearBuffer):
(WebCore::WebGL2RenderingContext::uniform1fv):
(WebCore::WebGL2RenderingContext::uniform2fv):
(WebCore::WebGL2RenderingContext::uniform3fv):
(WebCore::WebGL2RenderingContext::uniform4fv):
(WebCore::WebGL2RenderingContext::uniform1iv):
(WebCore::WebGL2RenderingContext::uniform2iv):
(WebCore::WebGL2RenderingContext::uniform3iv):
(WebCore::WebGL2RenderingContext::uniform4iv):
(WebCore::WebGL2RenderingContext::uniformMatrix2fv):
(WebCore::WebGL2RenderingContext::uniformMatrix3fv):
(WebCore::WebGL2RenderingContext::uniformMatrix4fv):
(WebCore::WebGL2RenderingContext::readPixels):
* Source/WebCore/html/canvas/WebGL2RenderingContext.h:
* Source/WebCore/html/canvas/WebGL2RenderingContext.idl:
* Source/WebCore/html/canvas/WebGLMultiDraw.cpp:
(WebCore::WebGLMultiDraw::validateOffset):
* Source/WebCore/html/canvas/WebGLMultiDraw.h:
* Source/WebCore/html/canvas/WebGLMultiDrawInstancedBaseVertexBaseInstance.cpp:
(WebCore::WebGLMultiDrawInstancedBaseVertexBaseInstance::validateOffset):
* Source/WebCore/html/canvas/WebGLMultiDrawInstancedBaseVertexBaseInstance.h:
* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::texImageArrayBufferViewHelper):
(WebCore::WebGLRenderingContextBase::validateTexFuncData):
(WebCore::WebGLRenderingContextBase::validateUniformMatrixParameters):
(WebCore::WebGLRenderingContextBase::vertexAttribfvImpl):
* Source/WebCore/html/canvas/WebGLRenderingContextBase.h:
(WebCore::WebGLRenderingContextBase::TypedList::length const):
(WebCore::WebGLRenderingContextBase::validateUniformParameters):
* Source/WebCore/platform/graphics/iso/ISOBox.cpp:
(WebCore::isWalkableView):
(WebCore::ISOBox::peekBox):
(WebCore::ISOBox::parse):
* Source/WebKit/WebProcess/Network/WebSocketChannel.cpp:
(WebKit::WebSocketChannel::send):
* Source/WebKit/WebProcess/Network/WebSocketChannel.h:
* Source/WebKitLegacy/WebCoreSupport/WebSocketChannel.cpp:
(WebCore::WebSocketChannel::send):
* Source/WebKitLegacy/WebCoreSupport/WebSocketChannel.h:
* Source/bmalloc/bmalloc/Gigacage.h:
Canonical link: https://commits.webkit.org/318784@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
