Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-24 05:11:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1727084 - Memory64 - Huge-memory status depends on index type. r=yury

Browse Source 
Whether a memory is huge depends not just on whether huge memory has
been enabled in the process, but whether the memory's index type
allows the use of huge-memory optimization.  It also depends on
whether the input is wasm or asm.js.  (And in the future it may depend
on eg whether the memory, if it is i64, has a declared maximum.)

Together, this fundamentally means that the is-huge-memory attribute
cannot be computed before compilation starts but must be computed once
the memory has been declared.

The difference between asm.js and wasm, and the coming of large
"non-huge" memories, also means that a memory object must carry an
attribute as to whether it is huge or not.  It cannot be determined
from the process's huge memory setting without knowing the input type,
and it cannot be determined from the size of the memory.

To make this simple, we parameterize IsHugeMemoryEnabled() by the
index type, and plumb the index type through the code where we need it
(not too many places).  Features::hugeMemory can now be removed.

We also add an IsHuge attribute to WasmMemoryObject to carry that bit.
Structured cloning must transmit that bit too.

Test cases are in the last patch in the queue.

Differential Revision: https://phabricator.services.mozilla.com/D126186
This commit is contained in:
Lars T Hansen 2021-10-18 07:31:53 +00:00
parent 483cfde5a5
commit 0af22ab84d
15 changed files with 102 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/src/shell/js.cpp
View File

@ -7827,6 +7827,7 @@ struct SharedObjectMailbox {
struct {
SharedArrayRawBuffer* buffer;
size_t length;
bool isHugeMemory; // For a WasmMemory tag, otherwise false
} sarb;
JS::WasmModule* module;
double number;
@ -7929,7 +7930,8 @@ static bool GetSharedObject(JSContext* cx, unsigned argc, Value* vp) {
}
RootedObject proto(cx,
&cx->global()->getPrototype(JSProto_WasmMemory));
newObj = WasmMemoryObject::create(cx, maybesab, proto);
newObj = WasmMemoryObject::create(cx, maybesab,
mbx->val.sarb.isHugeMemory, proto);
MOZ_ASSERT_IF(newObj, newObj->as<WasmMemoryObject>().isShared());
if (!newObj) {
return false;
@ -7983,6 +7985,7 @@ static bool SetSharedObject(JSContext* cx, unsigned argc, Value* vp) {
tag = MailboxTag::SharedArrayBuffer;
value.sarb.buffer = sab->rawBufferObject();
value.sarb.length = sab->byteLength();
value.sarb.isHugeMemory = false;
if (!value.sarb.buffer->addReference()) {
JS_ReportErrorASCII(cx,
"Reference count overflow on SharedArrayBuffer");
@ -7999,6 +8002,7 @@ static bool SetSharedObject(JSContext* cx, unsigned argc, Value* vp) {
tag = MailboxTag::WasmMemory;
value.sarb.buffer = sab->rawBufferObject();
value.sarb.length = sab->byteLength();
value.sarb.isHugeMemory = obj->as<WasmMemoryObject>().isHuge();
if (!value.sarb.buffer->addReference()) {
JS_ReportErrorASCII(cx,
"Reference count overflow on SharedArrayBuffer");

24
js/src/vm/ArrayBufferObject.cpp
View File

@ -151,13 +151,16 @@ bool js::ArrayBufferObject::supportLargeBuffers = true;
return true;
}
void* js::MapBufferMemory(size_t mappedSize, size_t initialCommittedSize) {
void* js::MapBufferMemory(wasm::IndexType t, size_t mappedSize,
size_t initialCommittedSize) {
MOZ_ASSERT(mappedSize % gc::SystemPageSize() == 0);
MOZ_ASSERT(initialCommittedSize % gc::SystemPageSize() == 0);
MOZ_ASSERT(initialCommittedSize <= mappedSize);
auto decrement = mozilla::MakeScopeExit([&] { liveBufferCount--; });
if (wasm::IsHugeMemoryEnabled()) {
// Testing just IsHugeMemoryEnabled() here will overestimate the number of
// live buffers, as asm.js buffers are not huge. This is OK in practice.
if (wasm::IsHugeMemoryEnabled(t)) {
liveBufferCount++;
} else {
decrement.release();
@ -271,7 +274,7 @@ bool js::ExtendBufferMapping(void* dataPointer, size_t mappedSize,
#endif
}
void js::UnmapBufferMemory(void* base, size_t mappedSize) {
void js::UnmapBufferMemory(wasm::IndexType t, void* base, size_t mappedSize) {
MOZ_ASSERT(mappedSize % gc::SystemPageSize() == 0);
#ifdef XP_WIN
@ -288,9 +291,12 @@ void js::UnmapBufferMemory(void* base, size_t mappedSize) {
mappedSize);
#endif
if (wasm::IsHugeMemoryEnabled()) {
if (wasm::IsHugeMemoryEnabled(t)) {
// Decrement the buffer counter at the end -- otherwise, a race condition
// could enable the creation of unlimited buffers.
//
// Also see comment in MapBufferMemory about overestimation due to the
// imprecision of the above guard.
--liveBufferCount;
}
}
@ -695,8 +701,8 @@ WasmArrayRawBuffer* WasmArrayRawBuffer::AllocateWasm(
uint64_t mappedSizeWithHeader = mappedSize + gc::SystemPageSize();
uint64_t numBytesWithHeader = numBytes + gc::SystemPageSize();
void* data =
MapBufferMemory((size_t)mappedSizeWithHeader, (size_t)numBytesWithHeader);
void* data = MapBufferMemory(indexType, (size_t)mappedSizeWithHeader,
(size_t)numBytesWithHeader);
if (!data) {
return nullptr;
}
@ -717,7 +723,8 @@ void WasmArrayRawBuffer::Release(void* mem) {
MOZ_RELEASE_ASSERT(header->mappedSize() <= SIZE_MAX - gc::SystemPageSize());
size_t mappedSizeWithHeader = header->mappedSize() + gc::SystemPageSize();
UnmapBufferMemory(header->basePointer(), mappedSizeWithHeader);
UnmapBufferMemory(header->indexType(), header->basePointer(),
mappedSizeWithHeader);
}
WasmArrayRawBuffer* ArrayBufferObject::BufferContents::wasmBuffer() const {
@ -729,8 +736,7 @@ template <typename ObjT, typename RawbufT>
static bool CreateSpecificWasmBuffer32(
JSContext* cx, const wasm::MemoryDesc& memory,
MutableHandleArrayBufferObjectMaybeShared maybeSharedObject) {
bool useHugeMemory =
memory.indexType() == IndexType::I32 && wasm::IsHugeMemoryEnabled();
bool useHugeMemory = wasm::IsHugeMemoryEnabled(memory.indexType());
Pages initialPages = memory.initialPages();
Maybe<Pages> sourceMaxPages = memory.maximumPages();
Pages clampedMaxPages =

5
js/src/vm/ArrayBufferObject.h
View File

@ -34,7 +34,8 @@ struct MemoryDesc;
// of size `initialCommittedSize`. Both arguments denote bytes and must be
// multiples of the page size, with `initialCommittedSize` <= `mappedSize`.
// Returns nullptr on failure.
void* MapBufferMemory(size_t mappedSize, size_t initialCommittedSize);
void* MapBufferMemory(wasm::IndexType, size_t mappedSize,
size_t initialCommittedSize);
// Commit additional memory in an existing mapping. `dataEnd` must be the
// correct value for the end of the existing committed area, and `delta` must be
@ -52,7 +53,7 @@ bool ExtendBufferMapping(void* dataStart, size_t mappedSize,
// Remove an existing mapping. `dataStart` must be the pointer to the start of
// the mapping, and `mappedSize` the size of that mapping.
void UnmapBufferMemory(void* dataStart, size_t mappedSize);
void UnmapBufferMemory(wasm::IndexType t, void* dataStart, size_t mappedSize);
// Return the number of currently live mapped buffers.
int32_t LiveMappedBufferCount();

5
js/src/vm/SharedArrayObject.cpp
View File

@ -74,7 +74,8 @@ SharedArrayRawBuffer* SharedArrayRawBuffer::AllocateInternal(
uint64_t mappedSizeWithHeader = computedMappedSize + gc::SystemPageSize();
uint64_t accessibleSizeWithHeader = accessibleSize + gc::SystemPageSize();
void* p = MapBufferMemory(mappedSizeWithHeader, accessibleSizeWithHeader);
void* p = MapBufferMemory(wasmIndexType, mappedSizeWithHeader,
accessibleSizeWithHeader);
if (!p) {
return nullptr;
}
@ -198,7 +199,7 @@ void SharedArrayRawBuffer::dropReference() {
size_t mappedSizeWithHeader = mappedSize_ + gc::SystemPageSize();
// This was the final reference, so release the buffer.
UnmapBufferMemory(basePointer(), mappedSizeWithHeader);
UnmapBufferMemory(wasmIndexType(), basePointer(), mappedSizeWithHeader);
}
static bool IsSharedArrayBuffer(HandleValue v) {

12
js/src/vm/StructuredClone.cpp
View File

@ -1397,7 +1397,7 @@ bool JSStructuredCloneWriter::writeSharedWasmMemory(HandleObject obj) {
}
// If this changes, might need to change what we write.
MOZ_ASSERT(WasmMemoryObject::RESERVED_SLOTS == 2);
MOZ_ASSERT(WasmMemoryObject::RESERVED_SLOTS == 3);
Rooted<WasmMemoryObject*> memoryObj(context(),
&obj->unwrapAs<WasmMemoryObject>());
@ -1405,6 +1405,7 @@ bool JSStructuredCloneWriter::writeSharedWasmMemory(HandleObject obj) {
context(), &memoryObj->buffer().as<SharedArrayBufferObject>());
return out.writePair(SCTAG_SHARED_WASM_MEMORY_OBJECT, 0) &&
out.writePair(SCTAG_BOOLEAN, memoryObj->isHuge()) &&
writeSharedArrayBuffer(sab);
}
@ -2448,6 +2449,12 @@ bool JSStructuredCloneReader::readSharedWasmMemory(uint32_t nbytes,
return false;
}
// Read the isHuge flag
RootedValue isHuge(cx);
if (!startRead(&isHuge)) {
return false;
}
// Read the SharedArrayBuffer object.
RootedValue payload(cx);
if (!startRead(&payload)) {
@ -2466,7 +2473,8 @@ bool JSStructuredCloneReader::readSharedWasmMemory(uint32_t nbytes,
// Construct the memory.
RootedObject proto(cx, &cx->global()->getPrototype(JSProto_WasmMemory));
RootedObject memory(cx, WasmMemoryObject::create(cx, sab, proto));
RootedObject memory(
cx, WasmMemoryObject::create(cx, sab, isHuge.toBoolean(), proto));
if (!memory) {
return false;
}

3
js/src/wasm/AsmJS.cpp
View File

@ -6918,7 +6918,8 @@ static bool TryInstantiate(JSContext* cx, CallArgs args, const Module& module,
return false;
}
imports.get().memory = WasmMemoryObject::create(cx, buffer, nullptr);
imports.get().memory =
WasmMemoryObject::create(cx, buffer, /* hugeMemory= */ false, nullptr);
if (!imports.get().memory) {
return false;
}

1
js/src/wasm/WasmCompile.cpp
View File

@ -87,7 +87,6 @@ FeatureArgs FeatureArgs::build(JSContext* cx, const FeatureOptions& options) {
features.sharedMemory =
wasm::ThreadsAvailable(cx) ? Shareable::True : Shareable::False;
features.hugeMemory = wasm::IsHugeMemoryEnabled();
// See comments in WasmConstants.h regarding the meaning of the wormhole
// options.

2
js/src/wasm/WasmCompileArgs.h
View File

@ -90,7 +90,6 @@ struct FeatureArgs {
JS_FOR_WASM_FEATURES(WASM_FEATURE, WASM_FEATURE)
#undef WASM_FEATURE
sharedMemory(Shareable::False),
hugeMemory(false),
simdWormhole(false),
intrinsics(false) {
}
@ -105,7 +104,6 @@ struct FeatureArgs {
#undef WASM_FEATURE
Shareable sharedMemory;
bool hugeMemory;
bool simdWormhole;
bool intrinsics;
};

22
js/src/wasm/WasmJS.cpp
View File

@ -779,10 +779,6 @@ bool wasm::CompileAndSerialize(const ShareableBytes& bytecode,
// be used into CompileAndSerialize().
compileArgs->ionEnabled = true;
// The caller must ensure that huge memory support is configured the same in
// the receiving process of this serialized module.
compileArgs->features.hugeMemory = wasm::IsHugeMemoryEnabled();
SerializeListener listener(serialized);
UniqueChars error;
@ -2575,7 +2571,7 @@ void WasmMemoryObject::finalize(JSFreeOp* fop, JSObject* obj) {
/* static */
WasmMemoryObject* WasmMemoryObject::create(
JSContext* cx, HandleArrayBufferObjectMaybeShared buffer,
JSContext* cx, HandleArrayBufferObjectMaybeShared buffer, bool isHuge,
HandleObject proto) {
AutoSetNewObjectMetadata metadata(cx);
auto* obj = NewObjectWithGivenProto<WasmMemoryObject>(cx, proto);
@ -2584,6 +2580,7 @@ WasmMemoryObject* WasmMemoryObject::create(
}
obj->initReservedSlot(BUFFER_SLOT, ObjectValue(*buffer));
obj->initReservedSlot(ISHUGE_SLOT, BooleanValue(isHuge));
MOZ_ASSERT(!obj->hasObservers());
return obj;
@ -2634,8 +2631,9 @@ bool WasmMemoryObject::construct(JSContext* cx, unsigned argc, Value* vp) {
return false;
}
RootedWasmMemoryObject memoryObj(cx,
WasmMemoryObject::create(cx, buffer, proto));
RootedWasmMemoryObject memoryObj(
cx, WasmMemoryObject::create(
cx, buffer, IsHugeMemoryEnabled(limits.indexType), proto));
if (!memoryObj) {
return false;
}
@ -2829,15 +2827,7 @@ WasmMemoryObject::InstanceSet* WasmMemoryObject::getOrCreateObservers(
}
bool WasmMemoryObject::isHuge() const {
#ifdef WASM_SUPPORTS_HUGE_MEMORY
// TODO: Turn this into a static_assert, if we are able to make
// MaxMemoryBytes() constexpr once the dust settles for the 4GB heaps.
MOZ_ASSERT(MaxMemoryBytes() < HugeMappedSize,
"Non-huge buffer may be confused as huge");
return buffer().wasmMappedSize() >= HugeMappedSize;
#else
return false;
#endif
return getReservedSlot(ISHUGE_SLOT).toBoolean();
}
bool WasmMemoryObject::movingGrowable() const {

5
js/src/wasm/WasmJS.h
View File

@ -365,6 +365,7 @@ class WasmInstanceObject : public NativeObject {
class WasmMemoryObject : public NativeObject {
static const unsigned BUFFER_SLOT = 0;
static const unsigned OBSERVERS_SLOT = 1;
static const unsigned ISHUGE_SLOT = 2;
static const JSClassOps classOps_;
static const ClassSpec classSpec_;
static void finalize(JSFreeOp* fop, JSObject* obj);
@ -385,7 +386,7 @@ class WasmMemoryObject : public NativeObject {
InstanceSet* getOrCreateObservers(JSContext* cx);
public:
static const unsigned RESERVED_SLOTS = 2;
static const unsigned RESERVED_SLOTS = 3;
static const JSClass class_;
static const JSClass& protoClass_;
static const JSPropertySpec properties[];
@ -395,7 +396,7 @@ class WasmMemoryObject : public NativeObject {
static WasmMemoryObject* create(JSContext* cx,
Handle<ArrayBufferObjectMaybeShared*> buffer,
HandleObject proto);
bool isHuge, HandleObject proto);
// `buffer()` returns the current buffer object always. If the buffer
// represents shared memory then `buffer().byteLength()` never changes, and

8
js/src/wasm/WasmMemory.cpp
View File

@ -377,14 +377,6 @@ static_assert(HugeOffsetGuardLimit < UINT32_MAX,
# error "Not an expected configuration"
# endif
// TODO: We want this static_assert back, but it reqires MaxMemory32Bytes to be
// a constant or constexpr function, not a regular function as now.
//
// The assert is also present in WasmMemoryObject::isHuge and
// WasmMemoryObject::grow, so it's OK to comment out here for now.
// static_assert(MaxMemory32Bytes < HugeMappedSize(),
// "Normal array buffer could be confused with huge memory");
#endif
// On !WASM_SUPPORTS_HUGE_MEMORY platforms:

10
js/src/wasm/WasmModule.cpp
View File

@ -424,7 +424,7 @@ bool wasm::GetOptimizedEncodingBuildId(JS::BuildIdCharVector* buildId) {
uint32_t cpu = ObservedCPUFeatures();
if (!buildId->reserve(buildId->length() +
12 /* "()" + 8 nibbles + "m[+-]" */)) {
13 /* "()" + 8 nibbles + "m[+-][+-]" */)) {
return false;
}
@ -436,7 +436,10 @@ bool wasm::GetOptimizedEncodingBuildId(JS::BuildIdCharVector* buildId) {
buildId->infallibleAppend(')');
buildId->infallibleAppend('m');
buildId->infallibleAppend(wasm::IsHugeMemoryEnabled() ? '+' : '-');
buildId->infallibleAppend(wasm::IsHugeMemoryEnabled(IndexType::I32) ? '+'
: '-');
buildId->infallibleAppend(wasm::IsHugeMemoryEnabled(IndexType::I64) ? '+'
: '-');
return true;
}
@ -794,7 +797,8 @@ bool Module::instantiateMemory(JSContext* cx,
}
RootedObject proto(cx, &cx->global()->getPrototype(JSProto_WasmMemory));
memory.set(WasmMemoryObject::create(cx, buffer, proto));
memory.set(WasmMemoryObject::create(
cx, buffer, IsHugeMemoryEnabled(desc.indexType()), proto));
if (!memory) {
return false;
}

50
js/src/wasm/WasmProcess.cpp
View File

@ -334,25 +334,50 @@ static const size_t MinVirtualMemoryLimitForHugeMemory =
size_t(1) << MinAddressBitsForHugeMemory;
#endif
ExclusiveData<ReadLockFlag> sHugeMemoryEnabled(mutexid::WasmHugeMemoryEnabled);
ExclusiveData<ReadLockFlag> sHugeMemoryEnabled32(
mutexid::WasmHugeMemoryEnabled);
ExclusiveData<ReadLockFlag> sHugeMemoryEnabled64(
mutexid::WasmHugeMemoryEnabled);
static bool IsHugeMemoryEnabledHelper() {
auto state = sHugeMemoryEnabled.lock();
static bool IsHugeMemoryEnabledHelper32() {
auto state = sHugeMemoryEnabled32.lock();
return state->get();
}
bool wasm::IsHugeMemoryEnabled() {
static bool enabled = IsHugeMemoryEnabledHelper();
return enabled;
static bool IsHugeMemoryEnabledHelper64() {
auto state = sHugeMemoryEnabled64.lock();
return state->get();
}
bool wasm::IsHugeMemoryEnabled(wasm::IndexType t) {
static bool enabled32 = IsHugeMemoryEnabledHelper32();
static bool enabled64 = IsHugeMemoryEnabledHelper64();
return t == IndexType::I32 ? enabled32 : enabled64;
}
bool wasm::DisableHugeMemory() {
auto state = sHugeMemoryEnabled.lock();
return state->set(false);
bool ok = true;
{
auto state = sHugeMemoryEnabled64.lock();
ok = ok && state->set(false);
}
{
auto state = sHugeMemoryEnabled32.lock();
ok = ok && state->set(false);
}
return ok;
}
void ConfigureHugeMemory() {
#ifdef WASM_SUPPORTS_HUGE_MEMORY
bool ok = true;
{
// Currently no huge memory for IndexType::I64, so always set to false.
auto state = sHugeMemoryEnabled64.lock();
ok = ok && state->set(false);
}
if (gc::SystemAddressBits() < MinAddressBitsForHugeMemory) {
return;
}
@ -362,9 +387,12 @@ void ConfigureHugeMemory() {
return;
}
auto state = sHugeMemoryEnabled.lock();
bool set = state->set(true);
MOZ_RELEASE_ASSERT(set);
{
auto state = sHugeMemoryEnabled32.lock();
ok = ok && state->set(true);
}
MOZ_RELEASE_ASSERT(ok);
#endif
}

8
js/src/wasm/WasmProcess.h
View File

@ -21,6 +21,8 @@
#include "mozilla/Atomics.h"
#include "wasm/WasmMemory.h"
namespace js {
namespace wasm {
@ -53,9 +55,11 @@ bool RegisterCodeSegment(const CodeSegment* cs);
void UnregisterCodeSegment(const CodeSegment* cs);
// Whether this process is configured to use huge memory or not.
// Whether this process is configured to use huge memory or not. Note that this
// is not precise enough to tell whether a particular memory uses huge memory,
// there are additional conditions for that.
bool IsHugeMemoryEnabled();
bool IsHugeMemoryEnabled(IndexType t);
[[nodiscard]] bool DisableHugeMemory();

5
js/src/wasm/WasmValidate.h
View File

@ -28,6 +28,7 @@
#include "wasm/WasmCompile.h"
#include "wasm/WasmCompileArgs.h"
#include "wasm/WasmModuleTypes.h"
#include "wasm/WasmProcess.h"
#include "wasm/WasmTypeDef.h"
namespace js {
@ -97,8 +98,8 @@ struct ModuleEnvironment {
#undef WASM_FEATURE
Shareable sharedMemoryEnabled() const { return features.sharedMemory; }
bool hugeMemoryEnabled() const {
return !isAsmJS() && features.hugeMemory && usesMemory() &&
memory->indexType() == IndexType::I32;
return !isAsmJS() && usesMemory() &&
IsHugeMemoryEnabled(memory->indexType());
}
bool simdWormholeEnabled() const { return features.simdWormhole; }
bool intrinsicsEnabled() const { return features.intrinsics; }