gecko-dev/js
Lars T Hansen 21e53c53a8 Bug 1674353 - Do not assume ArrayBuffer's length is a valid wasm heap length. r=rhunt
In bug 1673818 an intermediary getter was introduced for the buffer
length, in anticipation of larger buffers and a distinction between
32-bit and 64-bit wasm memories.  This getter asserts that the value
it gets is below the limit for the appropriate memory type, eg,
ByteLength32 asserts that the value it gets is below MaxMemory32Bytes,
which is currently 2^31-64K.  However, ArrayBuffers up to 2^31-1 can
be constructed and passed to asm.js, so asm.js must not use this
getter until after it has validated that the buffer length is below
MaxMemory32Bytes.

Thus we use the unchecked byteLength() accessor on the buffer, and
introduce an additional guard in IsValidAsmJSHeapLength that the
length is also a valid wasm length.  This will have no impact on
asm.js in SpiderMonkey as the largest valid asm.js length is already
below the wasm maximum. (The largest valid asm.js length is the
largest value below 2^31-1 whose low 24 bits are all zero.)

Differential Revision: https://phabricator.services.mozilla.com/D95563
2020-11-05 10:37:20 +00:00
..
ductwork/debugger Bug 1654103: Standardize on Black for Python code in mozilla-central. 2020-10-26 18:34:53 +00:00
examples
public Bug 1674465 - Add CompileOptions::useStencilXDR. r=arai 2020-10-31 04:52:15 +00:00
rust Bug 1663365 - Followup jsglue.cpp fix. 2020-10-30 07:38:46 +00:00
src Bug 1674353 - Do not assume ArrayBuffer's length is a valid wasm heap length. r=rhunt 2020-11-05 10:37:20 +00:00
xpconnect Bug 1506812 - Wrap all accesses to URLPreloader's mReaderThread in a mutex. r=decoder,nika 2020-11-02 23:26:05 +00:00
app.mozbuild
ffi.configure Bug 1654103: Standardize on Black for Python code in mozilla-central. 2020-10-26 18:34:53 +00:00
moz.build Bug 1654103: Standardize on Black for Python code in mozilla-central. 2020-10-26 18:34:53 +00:00
moz.configure Bug 1654103: Standardize on Black for Python code in mozilla-central. 2020-10-26 18:34:53 +00:00
sub.configure Bug 1654103: Standardize on Black for Python code in mozilla-central. 2020-10-26 18:34:53 +00:00