Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 987be10500c90a06758e13c85bb65416c297f70e
https://github.com/WebKit/WebKit/commit/987be10500c90a06758e13c85bb65416c297f70e
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-27 (Sun, 27 Sep 2026)
Changed paths:
M Source/JavaScriptCore/runtime/ArrayBuffer.cpp
M Source/JavaScriptCore/runtime/BufferMemoryHandle.cpp
M Source/JavaScriptCore/runtime/BufferMemoryHandle.h
M Source/JavaScriptCore/wasm/WasmMemory.cpp
M Source/WTF/wtf/win/OSAllocatorWin.cpp
Log Message:
-----------
[Win] Wasm memory and resizable `ArrayBuffer` crash when the commit limit is
reached
https://bugs.webkit.org/show_bug.cgi?id=325406
Reviewed by Ian Grunert.
Since 321850@main, Windows only reserves the address range of a Wasm memory
or a growable buffer, and commits the bytes in use when the memory is
created or grown.
Windows has no overcommit, so this commit fails once the commit limit is
reached, and OSAllocator::commit() and OSAllocator::protect() crash when it
does. Creating or growing a Wasm memory, a resizable ArrayBuffer or a
growable SharedArrayBuffer crashed instead of throwing a RangeError or
returning -1 from memory.grow(). BufferMemoryManager allows up to three
times the RAM size, which can be above the commit limit.
This patch makes these paths commit through OSAllocator::tryProtect() on
Windows and report out of memory when it fails. tryProtect() now retries a
commit that hit the commit limit in the same way as libpas, which these
allocations went through before 321850@main. Other platforms keep calling
OSAllocator::protect().
* Source/JavaScriptCore/runtime/ArrayBuffer.cpp:
(JSC::tryAllocateResizableMemory):
(JSC::ArrayBuffer::resize):
(JSC::SharedArrayBufferContents::tryGrow):
* Source/JavaScriptCore/runtime/BufferMemoryHandle.cpp:
(JSC::BufferMemoryManager::tryMakeReadableAndWritable):
* Source/JavaScriptCore/runtime/BufferMemoryHandle.h:
* Source/JavaScriptCore/wasm/WasmMemory.cpp:
(JSC::Wasm::Memory::tryCreate):
(JSC::Wasm::Memory::grow):
* Source/WTF/wtf/win/OSAllocatorWin.cpp:
(WTF::tryCommitWithRetry):
(WTF::OSAllocator::tryProtect):
Canonical link: https://commits.webkit.org/322017@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
