1517823 - Store out of line TypedArray data in ArrayBufferContentsArena?

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement)

Description

[André Bargull [:anba]]

bug 1052582 changed ArrayBuffers to use a separate arena for the ArrayBuffer contents, but no similar changed happened for TypedArray.

bug 1052582, comment #18 mentions:
> Allocating out of line ArrayBuffer data in a separate heap region *does* seem like a large security win to me, [...]

Doesn't this also apply for out of line TypedArray data [1,2]?

[1] https://searchfox.org/mozilla-central/rev/fef7f858efb695a76010b4c624da5277c16e95b3/js/src/jit/MacroAssembler.cpp#1194
[2] https://searchfox.org/mozilla-central/rev/fef7f858efb695a76010b4c624da5277c16e95b3/js/src/vm/TypedArrayObject.cpp#215

Comment 1

[André Bargull [:anba]]

We also ignore the requested arena_t in MallocProvider when we call onOutOfMemory. Which in turn means it's possible to create an ArrayBuffer in the js::MallocArena instead of the js::ArrayBufferContentsArena in near OOM situations.

Comment 2

[André Bargull [:anba]]

Attachment: bug1517823-part1-typedarray-data-arena.patch

Changes the inlined TypedArray constructor to use |js::ArrayBufferContentsArena| instead of |js::MallocArena| for its data. This should fix the issue noted in comment #0.

Applies on top of bug 1518101 and bug 1517259.

Comment 3

[André Bargull [:anba]]

Attachment: bug1517823-part2-requested-arena-on-retry-alloc.patch

When retrying an allocation after near OOM situations, the previously requested arena should be used again. Otherwise it's possible to create an ArrayBuffer/TypedArray whose data is in the normal js::MallocArena instead of js::ArrayBufferContentsArena.

Comment 4

[Steve Fink [:sfink] [:s:]]

Comment on attachment 9034718 [details] [diff] [review]
bug1517823-part1-typedarray-data-arena.patch

Review of attachment 9034718 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch.

Comment 5

[Steve Fink [:sfink] [:s:]]

Comment on attachment 9034719 [details] [diff] [review]
bug1517823-part2-requested-arena-on-retry-alloc.patch

Review of attachment 9034719 [details] [diff] [review]:
-----------------------------------------------------------------

Ouch. Thanks for the cleanup.

Comment 6

[André Bargull [:anba]]

Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=22537cf2fd00e4af6132abd7a05827c37bd79eda

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3d09512072a5
Part 1: Store out of line TypedArray data in ArrayBuffer malloc-arena. r=sfink
https://hg.mozilla.org/integration/mozilla-inbound/rev/752c683e631d
Part 2: Pass arena to MallocProvider client. r=sfink

Comment 8

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/3d09512072a5
https://hg.mozilla.org/mozilla-central/rev/752c683e631d