Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4002a938c8699bcd479e7b3cb998a9675738c8a1
https://github.com/WebKit/WebKit/commit/4002a938c8699bcd479e7b3cb998a9675738c8a1
Author: Tadeu Zagallo <[email protected]>
Date: 2026-08-26 (Wed, 26 Aug 2026)
Changed paths:
A
JSTests/wasm/stress/multimemory-shared-grow-refreshes-only-its-own-slots.js
M Source/JavaScriptCore/runtime/ArrayBuffer.cpp
M Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h
Log Message:
-----------
[JSC][Wasm] Growing a shared memory reads its instances' sibling memory
handles across threads
https://bugs.webkit.org/show_bug.cgi?id=322405
rdar://183462752
Reviewed by Yusuke Suzuki.
setMemory() anchors an instance on every imported memory's BufferMemoryHandle,
so
growing a shared memory reaches every instance that imported it, on every
thread,
and updateCachedMemories() reloaded all of that instance's memories -- including
its non-shared siblings. Those belong to the thread that owns the instance,
whose
own Memory::grow() frees the old handle when it swaps it in BoundsChecking mode.
The two share no lock, so the refresh reads a freed handle, and what it caches
is
the {base, boundsCheckingSize} pair the JIT bounds every access with.
Refresh only the slots backed by the memory that grew, matched on
Wasm::Memory::shared(), which is fixed at creation -- so the comparison reads
immutable state instead of a sibling handle.
Memory::grow() keeps the full refresh for the non-shared case: every anchor on a
non-shared handle is an instance on the growing thread, and the shared memories
those instances also import are safe to read concurrently, since growing a
shared
memory never frees its handle.
Test:
JSTests/wasm/stress/multimemory-shared-grow-refreshes-only-its-own-slots.js
* JSTests/wasm/stress/multimemory-shared-grow-refreshes-only-its-own-slots.js:
Added.
* Source/JavaScriptCore/runtime/ArrayBuffer.cpp:
(JSC::SharedArrayBufferContents::tryGrow):
* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:
Canonical link: https://commits.webkit.org/319937@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
