1893651 - TypedArrayObject::getElements doesn't handle concurrent modifications when growing shared array buffer

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[André Bargull [:anba]]

Run with while js --enable-arraybuffer-resizable /tmp/test.js; do true ; done.

Expected: No crash
Actual: *** stack smashing detected ***: terminated

Test case:

let maxByteLength = 500 * 1000;
let sab = new SharedArrayBuffer(0, {maxByteLength});

setSharedObject(sab);
evalInWorker(`
  let sab = getSharedObject();
  while (sab.byteLength < sab.maxByteLength) {
    sab.grow(Math.min(sab.byteLength + 13, sab.maxByteLength));
  }
  print("done worker");
`);

let ta = new Int8Array(sab);
while (ta.byteLength < maxByteLength) {
  Math.min.apply(null, ta);
}
print("done main");

Comment 1

[André Bargull [:anba]]

Attachment: Bug 1893651: Avoid repeated typed array length reads. r=jandem!

Comment 2

[André Bargull [:anba]]

Resizable array buffers can only be enabled through a (defaulted to off) preference in Nightly builds, so Release, Beta, and ESR are all unaffected.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a6ce02781fe2
Avoid repeated typed array length reads. r=jandem

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/a6ce02781fe2