diff options
Diffstat (limited to 'js/src/vm/ArrayBufferObject.cpp')
| -rw-r--r-- | js/src/vm/ArrayBufferObject.cpp | 3305 |
1 files changed, 3305 insertions, 0 deletions
diff --git a/js/src/vm/ArrayBufferObject.cpp b/js/src/vm/ArrayBufferObject.cpp new file mode 100644 index 0000000000..72c9ebeb18 --- /dev/null +++ b/js/src/vm/ArrayBufferObject.cpp @@ -0,0 +1,3305 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- + * vim: set ts=8 sts=2 et sw=2 tw=80: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "vm/ArrayBufferObject-inl.h" +#include "vm/ArrayBufferObject.h" + +#include "mozilla/Assertions.h" +#include "mozilla/Attributes.h" +#include "mozilla/DebugOnly.h" +#include "mozilla/Likely.h" +#include "mozilla/Maybe.h" +#include "mozilla/ScopeExit.h" +#include "mozilla/TaggedAnonymousMemory.h" + +#include <algorithm> // std::max, std::min +#include <memory> // std::uninitialized_copy_n +#include <string.h> +#if !defined(XP_WIN) && !defined(__wasi__) +# include <sys/mman.h> +#endif +#include <tuple> // std::tuple +#include <type_traits> +#ifdef MOZ_VALGRIND +# include <valgrind/memcheck.h> +#endif + +#include "jsnum.h" +#include "jstypes.h" + +#include "gc/Barrier.h" +#include "gc/Memory.h" +#include "js/ArrayBuffer.h" +#include "js/Conversions.h" +#include "js/experimental/TypedData.h" // JS_IsArrayBufferViewObject +#include "js/friend/ErrorMessages.h" // js::GetErrorMessage, JSMSG_* +#include "js/MemoryMetrics.h" +#include "js/Prefs.h" +#include "js/PropertySpec.h" +#include "js/SharedArrayBuffer.h" +#include "js/Wrapper.h" +#include "util/WindowsWrapper.h" +#include "vm/GlobalObject.h" +#include "vm/JSContext.h" +#include "vm/JSObject.h" +#include "vm/SharedArrayObject.h" +#include "vm/Warnings.h" // js::WarnNumberASCII +#include "wasm/WasmConstants.h" +#include "wasm/WasmLog.h" +#include "wasm/WasmMemory.h" +#include "wasm/WasmModuleTypes.h" +#include "wasm/WasmProcess.h" + +#include "gc/GCContext-inl.h" +#include "gc/Marking-inl.h" +#include "vm/NativeObject-inl.h" +#include "vm/Realm-inl.h" // js::AutoRealm + +using JS::ToInt32; + +using js::wasm::IndexType; +using js::wasm::Pages; +using mozilla::Atomic; +using mozilla::CheckedInt; +using mozilla::DebugOnly; +using mozilla::Maybe; +using mozilla::Nothing; +using mozilla::Some; + +using namespace js; + +// Wasm allows large amounts of memory to be reserved at a time. On 64-bit +// platforms (with "huge memories") we reserve around 4GB of virtual address +// space for every wasm memory; on 32-bit platforms we usually do not, but users +// often initialize memories in the hundreds of megabytes. +// +// If too many wasm memories remain live, we run up against system resource +// exhaustion (address space or number of memory map descriptors) - see bug +// 1068684, bug 1073934, bug 1517412, bug 1502733 for details. The limiting case +// seems to be Android on ARM64, where the per-process address space is limited +// to 4TB (39 bits) by the organization of the page tables. An earlier problem +// was Windows Vista Home 64-bit, where the per-process address space is limited +// to 8TB (40 bits). And 32-bit platforms only have 4GB of address space anyway. +// +// Thus we track the amount of memory reserved for wasm, and set a limit per +// process. We trigger GC work when we approach the limit and we throw an OOM +// error if the per-process limit is exceeded. The limit (WasmReservedBytesMax) +// is specific to architecture, OS, and OS configuration. +// +// Since the WasmReservedBytesMax limit is not generally accounted for by +// any existing GC-trigger heuristics, we need an extra heuristic for triggering +// GCs when the caller is allocating memories rapidly without other garbage +// (e.g. bug 1773225). Thus, once the reserved memory crosses the threshold +// WasmReservedBytesStartTriggering, we start triggering GCs every +// WasmReservedBytesPerTrigger bytes. Once we reach +// WasmReservedBytesStartSyncFullGC bytes reserved, we perform expensive +// non-incremental full GCs as a last-ditch effort to avoid unnecessary failure. +// Once we reach WasmReservedBytesMax, we perform further full GCs before giving +// up. +// +// (History: The original implementation only tracked the number of "huge +// memories" allocated by WASM, but this was found to be insufficient because +// 32-bit platforms have similar resource exhaustion issues. We now track +// reserved bytes directly.) +// +// (We also used to reserve significantly more than 4GB for huge memories, but +// this was reduced in bug 1442544.) + +// ASAN and TSAN use a ton of vmem for bookkeeping leaving a lot less for the +// program so use a lower limit. +#if defined(MOZ_TSAN) || defined(MOZ_ASAN) +static const uint64_t WasmMemAsanOverhead = 2; +#else +static const uint64_t WasmMemAsanOverhead = 1; +#endif + +// WasmReservedStartTriggering + WasmReservedPerTrigger must be well below +// WasmReservedStartSyncFullGC in order to provide enough time for incremental +// GC to do its job. + +#if defined(JS_CODEGEN_ARM64) && defined(ANDROID) + +static const uint64_t WasmReservedBytesMax = + 75 * wasm::HugeMappedSize / WasmMemAsanOverhead; +static const uint64_t WasmReservedBytesStartTriggering = + 15 * wasm::HugeMappedSize; +static const uint64_t WasmReservedBytesStartSyncFullGC = + WasmReservedBytesMax - 15 * wasm::HugeMappedSize; +static const uint64_t WasmReservedBytesPerTrigger = 15 * wasm::HugeMappedSize; + +#elif defined(WASM_SUPPORTS_HUGE_MEMORY) + +static const uint64_t WasmReservedBytesMax = + 1000 * wasm::HugeMappedSize / WasmMemAsanOverhead; +static const uint64_t WasmReservedBytesStartTriggering = + 100 * wasm::HugeMappedSize; +static const uint64_t WasmReservedBytesStartSyncFullGC = + WasmReservedBytesMax - 100 * wasm::HugeMappedSize; +static const uint64_t WasmReservedBytesPerTrigger = 100 * wasm::HugeMappedSize; + +#else // 32-bit (and weird 64-bit platforms without huge memory) + +static const uint64_t GiB = 1024 * 1024 * 1024; + +static const uint64_t WasmReservedBytesMax = + (4 * GiB) / 2 / WasmMemAsanOverhead; +static const uint64_t WasmReservedBytesStartTriggering = (4 * GiB) / 8; +static const uint64_t WasmReservedBytesStartSyncFullGC = + WasmReservedBytesMax - (4 * GiB) / 8; +static const uint64_t WasmReservedBytesPerTrigger = (4 * GiB) / 8; + +#endif + +// The total number of bytes reserved for wasm memories. +static Atomic<uint64_t, mozilla::ReleaseAcquire> wasmReservedBytes(0); +// The number of bytes of wasm memory reserved since the last GC trigger. +static Atomic<uint64_t, mozilla::ReleaseAcquire> wasmReservedBytesSinceLast(0); + +uint64_t js::WasmReservedBytes() { return wasmReservedBytes; } + +[[nodiscard]] static bool CheckArrayBufferTooLarge(JSContext* cx, + uint64_t nbytes) { + // Refuse to allocate too large buffers. + if (MOZ_UNLIKELY(nbytes > ArrayBufferObject::ByteLengthLimit)) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_BAD_ARRAY_LENGTH); + return false; + } + + return true; +} + +void* js::MapBufferMemory(wasm::IndexType t, size_t mappedSize, + size_t initialCommittedSize) { + MOZ_ASSERT(mappedSize % gc::SystemPageSize() == 0); + MOZ_ASSERT(initialCommittedSize % gc::SystemPageSize() == 0); + MOZ_ASSERT(initialCommittedSize <= mappedSize); + + auto failed = mozilla::MakeScopeExit( + [&] { wasmReservedBytes -= uint64_t(mappedSize); }); + wasmReservedBytes += uint64_t(mappedSize); + + // Test >= to guard against the case where multiple extant runtimes + // race to allocate. + if (wasmReservedBytes >= WasmReservedBytesMax) { + if (OnLargeAllocationFailure) { + OnLargeAllocationFailure(); + } + if (wasmReservedBytes >= WasmReservedBytesMax) { + return nullptr; + } + } + +#ifdef XP_WIN + void* data = VirtualAlloc(nullptr, mappedSize, MEM_RESERVE, PAGE_NOACCESS); + if (!data) { + return nullptr; + } + + if (!VirtualAlloc(data, initialCommittedSize, MEM_COMMIT, PAGE_READWRITE)) { + VirtualFree(data, 0, MEM_RELEASE); + return nullptr; + } +#elif defined(__wasi__) + void* data = nullptr; + if (int err = posix_memalign(&data, gc::SystemPageSize(), mappedSize)) { + MOZ_ASSERT(err == ENOMEM); + return nullptr; + } + MOZ_ASSERT(data); + memset(data, 0, mappedSize); +#else // !XP_WIN && !__wasi__ + void* data = + MozTaggedAnonymousMmap(nullptr, mappedSize, PROT_NONE, + MAP_PRIVATE | MAP_ANON, -1, 0, "wasm-reserved"); + if (data == MAP_FAILED) { + return nullptr; + } + + // Note we will waste a page on zero-sized memories here + if (mprotect(data, initialCommittedSize, PROT_READ | PROT_WRITE)) { + munmap(data, mappedSize); + return nullptr; + } +#endif // !XP_WIN && !__wasi__ + +#if defined(MOZ_VALGRIND) && \ + defined(VALGRIND_DISABLE_ADDR_ERROR_REPORTING_IN_RANGE) + VALGRIND_DISABLE_ADDR_ERROR_REPORTING_IN_RANGE( + (unsigned char*)data + initialCommittedSize, + mappedSize - initialCommittedSize); +#endif + + failed.release(); + return data; +} + +bool js::CommitBufferMemory(void* dataEnd, size_t delta) { + MOZ_ASSERT(delta); + MOZ_ASSERT(delta % gc::SystemPageSize() == 0); + +#ifdef XP_WIN + if (!VirtualAlloc(dataEnd, delta, MEM_COMMIT, PAGE_READWRITE)) { + return false; + } +#elif defined(__wasi__) + // posix_memalign'd memory is already committed + return true; +#else + if (mprotect(dataEnd, delta, PROT_READ | PROT_WRITE)) { + return false; + } +#endif // XP_WIN + +#if defined(MOZ_VALGRIND) && \ + defined(VALGRIND_DISABLE_ADDR_ERROR_REPORTING_IN_RANGE) + VALGRIND_ENABLE_ADDR_ERROR_REPORTING_IN_RANGE((unsigned char*)dataEnd, delta); +#endif + + return true; +} + +bool js::ExtendBufferMapping(void* dataPointer, size_t mappedSize, + size_t newMappedSize) { + MOZ_ASSERT(mappedSize % gc::SystemPageSize() == 0); + MOZ_ASSERT(newMappedSize % gc::SystemPageSize() == 0); + MOZ_ASSERT(newMappedSize >= mappedSize); + +#ifdef XP_WIN + void* mappedEnd = (char*)dataPointer + mappedSize; + uint32_t delta = newMappedSize - mappedSize; + if (!VirtualAlloc(mappedEnd, delta, MEM_RESERVE, PAGE_NOACCESS)) { + return false; + } + return true; +#elif defined(__wasi__) + return false; +#elif defined(XP_LINUX) + // Note this will not move memory (no MREMAP_MAYMOVE specified) + if (MAP_FAILED == mremap(dataPointer, mappedSize, newMappedSize, 0)) { + return false; + } + return true; +#else + // No mechanism for remapping on MacOS and other Unices. Luckily + // shouldn't need it here as most of these are 64-bit. + return false; +#endif +} + +void js::UnmapBufferMemory(wasm::IndexType t, void* base, size_t mappedSize) { + MOZ_ASSERT(mappedSize % gc::SystemPageSize() == 0); + +#ifdef XP_WIN + VirtualFree(base, 0, MEM_RELEASE); +#elif defined(__wasi__) + free(base); +#else + munmap(base, mappedSize); +#endif // XP_WIN + +#if defined(MOZ_VALGRIND) && \ + defined(VALGRIND_ENABLE_ADDR_ERROR_REPORTING_IN_RANGE) + VALGRIND_ENABLE_ADDR_ERROR_REPORTING_IN_RANGE((unsigned char*)base, + mappedSize); +#endif + + // Untrack reserved memory *after* releasing memory -- otherwise, a race + // condition could enable the creation of unlimited buffers. + wasmReservedBytes -= uint64_t(mappedSize); +} + +/* + * ArrayBufferObject + * + * This class holds the underlying raw buffer that the TypedArrayObject classes + * access. It can be created explicitly and passed to a TypedArrayObject, or + * can be created implicitly by constructing a TypedArrayObject with a size. + */ + +/* + * ArrayBufferObject (base) + */ + +static const JSClassOps ArrayBufferObjectClassOps = { + nullptr, // addProperty + nullptr, // delProperty + nullptr, // enumerate + nullptr, // newEnumerate + nullptr, // resolve + nullptr, // mayResolve + ArrayBufferObject::finalize, // finalize + nullptr, // call + nullptr, // construct + nullptr, // trace +}; + +static const JSFunctionSpec arraybuffer_functions[] = { + JS_FN("isView", ArrayBufferObject::fun_isView, 1, 0), + JS_FS_END, +}; + +static const JSPropertySpec arraybuffer_properties[] = { + JS_SELF_HOSTED_SYM_GET(species, "$ArrayBufferSpecies", 0), + JS_PS_END, +}; + +static const JSFunctionSpec arraybuffer_proto_functions[] = { + JS_SELF_HOSTED_FN("slice", "ArrayBufferSlice", 2, 0), +#ifdef NIGHTLY_BUILD + JS_FN("resize", ArrayBufferObject::resize, 1, 0), +#endif + JS_FN("transfer", ArrayBufferObject::transfer, 0, 0), + JS_FN("transferToFixedLength", ArrayBufferObject::transferToFixedLength, 0, + 0), + JS_FS_END, +}; + +static const JSPropertySpec arraybuffer_proto_properties[] = { + JS_PSG("byteLength", ArrayBufferObject::byteLengthGetter, 0), +#ifdef NIGHTLY_BUILD + JS_PSG("maxByteLength", ArrayBufferObject::maxByteLengthGetter, 0), + JS_PSG("resizable", ArrayBufferObject::resizableGetter, 0), +#endif + JS_PSG("detached", ArrayBufferObject::detachedGetter, 0), + JS_STRING_SYM_PS(toStringTag, "ArrayBuffer", JSPROP_READONLY), + JS_PS_END, +}; + +static JSObject* CreateArrayBufferPrototype(JSContext* cx, JSProtoKey key) { + return GlobalObject::createBlankPrototype(cx, cx->global(), + &ArrayBufferObject::protoClass_); +} + +static const ClassSpec ArrayBufferObjectClassSpec = { + GenericCreateConstructor<ArrayBufferObject::class_constructor, 1, + gc::AllocKind::FUNCTION>, + CreateArrayBufferPrototype, + arraybuffer_functions, + arraybuffer_properties, + arraybuffer_proto_functions, + arraybuffer_proto_properties, +}; + +static const ClassExtension FixedLengthArrayBufferObjectClassExtension = { + ArrayBufferObject::objectMoved< + FixedLengthArrayBufferObject>, // objectMovedOp +}; + +static const ClassExtension ResizableArrayBufferObjectClassExtension = { + ArrayBufferObject::objectMoved< + ResizableArrayBufferObject>, // objectMovedOp +}; + +const JSClass ArrayBufferObject::protoClass_ = { + "ArrayBuffer.prototype", + JSCLASS_HAS_CACHED_PROTO(JSProto_ArrayBuffer), + JS_NULL_CLASS_OPS, + &ArrayBufferObjectClassSpec, +}; + +const JSClass FixedLengthArrayBufferObject::class_ = { + "ArrayBuffer", + JSCLASS_DELAY_METADATA_BUILDER | + JSCLASS_HAS_RESERVED_SLOTS(RESERVED_SLOTS) | + JSCLASS_HAS_CACHED_PROTO(JSProto_ArrayBuffer) | + JSCLASS_BACKGROUND_FINALIZE, + &ArrayBufferObjectClassOps, + &ArrayBufferObjectClassSpec, + &FixedLengthArrayBufferObjectClassExtension, +}; + +const JSClass ResizableArrayBufferObject::class_ = { + "ArrayBuffer", + JSCLASS_DELAY_METADATA_BUILDER | + JSCLASS_HAS_RESERVED_SLOTS(RESERVED_SLOTS) | + JSCLASS_HAS_CACHED_PROTO(JSProto_ArrayBuffer) | + JSCLASS_BACKGROUND_FINALIZE, + &ArrayBufferObjectClassOps, + &ArrayBufferObjectClassSpec, + &ResizableArrayBufferObjectClassExtension, +}; + +static bool IsArrayBuffer(HandleValue v) { + return v.isObject() && v.toObject().is<ArrayBufferObject>(); +} + +#ifdef NIGHTLY_BUILD +static bool IsResizableArrayBuffer(HandleValue v) { + return v.isObject() && v.toObject().is<ResizableArrayBufferObject>(); +} +#endif + +MOZ_ALWAYS_INLINE bool ArrayBufferObject::byteLengthGetterImpl( + JSContext* cx, const CallArgs& args) { + MOZ_ASSERT(IsArrayBuffer(args.thisv())); + auto* buffer = &args.thisv().toObject().as<ArrayBufferObject>(); + args.rval().setNumber(buffer->byteLength()); + return true; +} + +bool ArrayBufferObject::byteLengthGetter(JSContext* cx, unsigned argc, + Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + return CallNonGenericMethod<IsArrayBuffer, byteLengthGetterImpl>(cx, args); +} + +enum class PreserveResizability : bool { No, Yes }; + +/** + * ArrayBufferCopyAndDetach ( arrayBuffer, newLength, preserveResizability ) + * + * https://tc39.es/proposal-arraybuffer-transfer/#sec-arraybuffercopyanddetach + */ +static ArrayBufferObject* ArrayBufferCopyAndDetach( + JSContext* cx, Handle<ArrayBufferObject*> arrayBuffer, + Handle<Value> newLength, PreserveResizability preserveResizability) { + // Steps 1-2. (Not applicable in our implementation.) + + // Steps 3-4. + uint64_t newByteLength; + if (newLength.isUndefined()) { + // Step 3.a. + newByteLength = arrayBuffer->byteLength(); + } else { + // Step 4.a. + if (!ToIndex(cx, newLength, &newByteLength)) { + return nullptr; + } + } + + // Step 5. + if (arrayBuffer->isDetached()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_DETACHED); + return nullptr; + } + if (arrayBuffer->isLengthPinned()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_LENGTH_PINNED); + return nullptr; + } + + // Steps 6-7. + mozilla::Maybe<size_t> maxByteLength; + if (preserveResizability == PreserveResizability::Yes && + arrayBuffer->isResizable()) { + auto* resizableBuffer = &arrayBuffer->as<ResizableArrayBufferObject>(); + maxByteLength = mozilla::Some(resizableBuffer->maxByteLength()); + } + + // Step 8. + if (arrayBuffer->hasDefinedDetachKey()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_WASM_NO_TRANSFER); + return nullptr; + } + + // Steps 9-16. + // + // 25.1.2.1 AllocateArrayBuffer, step 2. + // 6.2.9.1 CreateByteDataBlock, step 2. + if (!CheckArrayBufferTooLarge(cx, newByteLength)) { + return nullptr; + } + + if (maxByteLength) { + if (size_t(newByteLength) > *maxByteLength) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_LENGTH_LARGER_THAN_MAXIMUM); + return nullptr; + } + + Rooted<ResizableArrayBufferObject*> resizableBuffer( + cx, &arrayBuffer->as<ResizableArrayBufferObject>()); + return ResizableArrayBufferObject::copyAndDetach(cx, size_t(newByteLength), + resizableBuffer); + } + + return ArrayBufferObject::copyAndDetach(cx, size_t(newByteLength), + arrayBuffer); +} + +#ifdef NIGHTLY_BUILD +/** + * get ArrayBuffer.prototype.maxByteLength + * + * https://tc39.es/ecma262/#sec-get-arraybuffer.prototype.maxbytelength + */ +bool ArrayBufferObject::maxByteLengthGetterImpl(JSContext* cx, + const CallArgs& args) { + MOZ_ASSERT(IsArrayBuffer(args.thisv())); + + auto* buffer = &args.thisv().toObject().as<ArrayBufferObject>(); + + // Steps 4-6. + size_t maxByteLength; + if (buffer->isResizable()) { + maxByteLength = buffer->as<ResizableArrayBufferObject>().maxByteLength(); + } else { + maxByteLength = buffer->byteLength(); + } + MOZ_ASSERT_IF(buffer->isDetached(), maxByteLength == 0); + + // Step 7. + args.rval().setNumber(maxByteLength); + return true; +} + +/** + * get ArrayBuffer.prototype.maxByteLength + * + * https://tc39.es/ecma262/#sec-get-arraybuffer.prototype.maxbytelength + */ +bool ArrayBufferObject::maxByteLengthGetter(JSContext* cx, unsigned argc, + Value* vp) { + // Steps 1-3. + CallArgs args = CallArgsFromVp(argc, vp); + return CallNonGenericMethod<IsArrayBuffer, maxByteLengthGetterImpl>(cx, args); +} + +/** + * get ArrayBuffer.prototype.resizable + * + * https://tc39.es/ecma262/#sec-get-arraybuffer.prototype.resizable + */ +bool ArrayBufferObject::resizableGetterImpl(JSContext* cx, + const CallArgs& args) { + MOZ_ASSERT(IsArrayBuffer(args.thisv())); + + // Step 4. + auto* buffer = &args.thisv().toObject().as<ArrayBufferObject>(); + args.rval().setBoolean(buffer->isResizable()); + return true; +} + +/** + * get ArrayBuffer.prototype.resizable + * + * https://tc39.es/ecma262/#sec-get-arraybuffer.prototype.resizable + */ +bool ArrayBufferObject::resizableGetter(JSContext* cx, unsigned argc, + Value* vp) { + // Steps 1-3. + CallArgs args = CallArgsFromVp(argc, vp); + return CallNonGenericMethod<IsArrayBuffer, resizableGetterImpl>(cx, args); +} +#endif + +/** + * get ArrayBuffer.prototype.detached + * + * https://tc39.es/proposal-arraybuffer-transfer/#sec-get-arraybuffer.prototype.detached + */ +bool ArrayBufferObject::detachedGetterImpl(JSContext* cx, + const CallArgs& args) { + MOZ_ASSERT(IsArrayBuffer(args.thisv())); + + // Step 4. + auto* buffer = &args.thisv().toObject().as<ArrayBufferObject>(); + args.rval().setBoolean(buffer->isDetached()); + return true; +} + +/** + * get ArrayBuffer.prototype.detached + * + * https://tc39.es/proposal-arraybuffer-transfer/#sec-get-arraybuffer.prototype.detached + */ +bool ArrayBufferObject::detachedGetter(JSContext* cx, unsigned argc, + Value* vp) { + // Steps 1-3. + CallArgs args = CallArgsFromVp(argc, vp); + return CallNonGenericMethod<IsArrayBuffer, detachedGetterImpl>(cx, args); +} + +/** + * ArrayBuffer.prototype.transfer ( [ newLength ] ) + * + * https://tc39.es/proposal-arraybuffer-transfer/#sec-arraybuffer.prototype.transfer + */ +bool ArrayBufferObject::transferImpl(JSContext* cx, const CallArgs& args) { + MOZ_ASSERT(IsArrayBuffer(args.thisv())); + + // Steps 1-2. + Rooted<ArrayBufferObject*> buffer( + cx, &args.thisv().toObject().as<ArrayBufferObject>()); + auto* newBuffer = ArrayBufferCopyAndDetach(cx, buffer, args.get(0), + PreserveResizability::Yes); + if (!newBuffer) { + return false; + } + + args.rval().setObject(*newBuffer); + return true; +} + +/** + * ArrayBuffer.prototype.transfer ( [ newLength ] ) + * + * https://tc39.es/proposal-arraybuffer-transfer/#sec-arraybuffer.prototype.transfer + */ +bool ArrayBufferObject::transfer(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + return CallNonGenericMethod<IsArrayBuffer, transferImpl>(cx, args); +} + +/** + * ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] ) + * + * https://tc39.es/proposal-arraybuffer-transfer/#sec-arraybuffer.prototype.transfertofixedlength + */ +bool ArrayBufferObject::transferToFixedLengthImpl(JSContext* cx, + const CallArgs& args) { + MOZ_ASSERT(IsArrayBuffer(args.thisv())); + + // Steps 1-2. + Rooted<ArrayBufferObject*> buffer( + cx, &args.thisv().toObject().as<ArrayBufferObject>()); + auto* newBuffer = ArrayBufferCopyAndDetach(cx, buffer, args.get(0), + PreserveResizability::No); + if (!newBuffer) { + return false; + } + + args.rval().setObject(*newBuffer); + return true; +} + +/** + * ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] ) + * + * https://tc39.es/proposal-arraybuffer-transfer/#sec-arraybuffer.prototype.transfertofixedlength + */ +bool ArrayBufferObject::transferToFixedLength(JSContext* cx, unsigned argc, + Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + return CallNonGenericMethod<IsArrayBuffer, transferToFixedLengthImpl>(cx, + args); +} + +#ifdef NIGHTLY_BUILD +/** + * ArrayBuffer.prototype.resize ( newLength ) + * + * https://tc39.es/ecma262/#sec-arraybuffer.prototype.resize + */ +bool ArrayBufferObject::resizeImpl(JSContext* cx, const CallArgs& args) { + MOZ_ASSERT(IsResizableArrayBuffer(args.thisv())); + + Rooted<ResizableArrayBufferObject*> obj( + cx, &args.thisv().toObject().as<ResizableArrayBufferObject>()); + + // Step 4. + uint64_t newByteLength; + if (!ToIndex(cx, args.get(0), &newByteLength)) { + return false; + } + + // Step 5. + if (obj->isDetached()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_DETACHED); + return false; + } + if (obj->isLengthPinned()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_LENGTH_PINNED); + return false; + } + + // Step 6. + if (newByteLength > obj->maxByteLength()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_LENGTH_LARGER_THAN_MAXIMUM); + return false; + } + + // Steps 7-15. + obj->resize(size_t(newByteLength)); + + // Step 16. + args.rval().setUndefined(); + return true; +} + +/** + * ArrayBuffer.prototype.resize ( newLength ) + * + * https://tc39.es/ecma262/#sec-arraybuffer.prototype.resize + */ +bool ArrayBufferObject::resize(JSContext* cx, unsigned argc, Value* vp) { + // Steps 1-3. + CallArgs args = CallArgsFromVp(argc, vp); + return CallNonGenericMethod<IsResizableArrayBuffer, resizeImpl>(cx, args); +} +#endif + +/* + * ArrayBuffer.isView(obj); ES6 (Dec 2013 draft) 24.1.3.1 + */ +bool ArrayBufferObject::fun_isView(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + args.rval().setBoolean(args.get(0).isObject() && + JS_IsArrayBufferViewObject(&args.get(0).toObject())); + return true; +} + +// ES2024 draft rev 3a773fc9fae58be023228b13dbbd402ac18eeb6b +// 25.1.4.1 ArrayBuffer ( length [ , options ] ) +bool ArrayBufferObject::class_constructor(JSContext* cx, unsigned argc, + Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + + // Step 1. + if (!ThrowIfNotConstructing(cx, args, "ArrayBuffer")) { + return false; + } + + // Step 2. + uint64_t byteLength; + if (!ToIndex(cx, args.get(0), &byteLength)) { + return false; + } + + // Step 3. + mozilla::Maybe<uint64_t> maxByteLength; +#ifdef NIGHTLY_BUILD + if (JS::Prefs::experimental_arraybuffer_resizable()) { + // Inline call to GetArrayBufferMaxByteLengthOption. + if (args.get(1).isObject()) { + Rooted<JSObject*> options(cx, &args[1].toObject()); + + Rooted<Value> val(cx); + if (!GetProperty(cx, options, options, cx->names().maxByteLength, &val)) { + return false; + } + if (!val.isUndefined()) { + uint64_t maxByteLengthInt; + if (!ToIndex(cx, val, &maxByteLengthInt)) { + return false; + } + + // 25.1.3.1 AllocateArrayBuffer, step 3.a. + if (byteLength > maxByteLengthInt) { + JS_ReportErrorNumberASCII( + cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_LENGTH_LARGER_THAN_MAXIMUM); + return false; + } + maxByteLength = mozilla::Some(maxByteLengthInt); + } + } + } +#endif + + // Step 4 (Inlined 25.1.3.1 AllocateArrayBuffer). + // 25.1.3.1, step 4 (Inlined 10.1.13 OrdinaryCreateFromConstructor, step 2). + RootedObject proto(cx); + if (!GetPrototypeFromBuiltinConstructor(cx, args, JSProto_ArrayBuffer, + &proto)) { + return false; + } + + // 25.1.3.1, step 5 (Inlined 6.2.9.1 CreateByteDataBlock, step 2). + if (!CheckArrayBufferTooLarge(cx, byteLength)) { + return false; + } + + if (maxByteLength) { + // 25.1.3.1, step 8.a. + if (!CheckArrayBufferTooLarge(cx, *maxByteLength)) { + return false; + } + + // 25.1.3.1, remaining steps. + auto* bufobj = ResizableArrayBufferObject::createZeroed( + cx, byteLength, *maxByteLength, proto); + if (!bufobj) { + return false; + } + args.rval().setObject(*bufobj); + return true; + } + + // 25.1.3.1, remaining steps. + JSObject* bufobj = createZeroed(cx, byteLength, proto); + if (!bufobj) { + return false; + } + args.rval().setObject(*bufobj); + return true; +} + +using ArrayBufferContents = UniquePtr<uint8_t[], JS::FreePolicy>; + +static ArrayBufferContents AllocateUninitializedArrayBufferContents( + JSContext* cx, size_t nbytes) { + // First attempt a normal allocation. + uint8_t* p = + cx->maybe_pod_arena_malloc<uint8_t>(js::ArrayBufferContentsArena, nbytes); + if (MOZ_UNLIKELY(!p)) { + // Otherwise attempt a large allocation, calling the + // large-allocation-failure callback if necessary. + p = static_cast<uint8_t*>(cx->runtime()->onOutOfMemoryCanGC( + js::AllocFunction::Malloc, js::ArrayBufferContentsArena, nbytes)); + if (!p) { + ReportOutOfMemory(cx); + } + } + + return ArrayBufferContents(p); +} + +static ArrayBufferContents AllocateArrayBufferContents(JSContext* cx, + size_t nbytes) { + // First attempt a normal allocation. + uint8_t* p = + cx->maybe_pod_arena_calloc<uint8_t>(js::ArrayBufferContentsArena, nbytes); + if (MOZ_UNLIKELY(!p)) { + // Otherwise attempt a large allocation, calling the + // large-allocation-failure callback if necessary. + p = static_cast<uint8_t*>(cx->runtime()->onOutOfMemoryCanGC( + js::AllocFunction::Calloc, js::ArrayBufferContentsArena, nbytes)); + if (!p) { + ReportOutOfMemory(cx); + } + } + + return ArrayBufferContents(p); +} + +static ArrayBufferContents ReallocateArrayBufferContents(JSContext* cx, + uint8_t* old, + size_t oldSize, + size_t newSize) { + // First attempt a normal reallocation. + uint8_t* p = cx->maybe_pod_arena_realloc<uint8_t>( + js::ArrayBufferContentsArena, old, oldSize, newSize); + if (MOZ_UNLIKELY(!p)) { + // Otherwise attempt a large allocation, calling the + // large-allocation-failure callback if necessary. + p = static_cast<uint8_t*>(cx->runtime()->onOutOfMemoryCanGC( + js::AllocFunction::Realloc, js::ArrayBufferContentsArena, newSize, + old)); + if (!p) { + ReportOutOfMemory(cx); + } + } + + return ArrayBufferContents(p); +} + +static ArrayBufferContents NewCopiedBufferContents( + JSContext* cx, Handle<ArrayBufferObject*> buffer) { + ArrayBufferContents dataCopy = + AllocateUninitializedArrayBufferContents(cx, buffer->byteLength()); + if (dataCopy) { + if (auto count = buffer->byteLength()) { + memcpy(dataCopy.get(), buffer->dataPointer(), count); + } + } + return dataCopy; +} + +/* static */ +void ArrayBufferObject::detach(JSContext* cx, + Handle<ArrayBufferObject*> buffer) { + cx->check(buffer); + MOZ_ASSERT(!buffer->isPreparedForAsmJS()); + MOZ_ASSERT(!buffer->isLengthPinned()); + + // Update all views of the buffer to account for the buffer having been + // detached, and clear the buffer's data and list of views. + // + // Typed object buffers are not exposed and cannot be detached. + + auto& innerViews = ObjectRealm::get(buffer).innerViews.get(); + if (InnerViewTable::ViewVector* views = + innerViews.maybeViewsUnbarriered(buffer)) { + for (size_t i = 0; i < views->length(); i++) { + JSObject* view = (*views)[i]; + view->as<ArrayBufferViewObject>().notifyBufferDetached(); + } + innerViews.removeViews(buffer); + } + if (JSObject* view = buffer->firstView()) { + view->as<ArrayBufferViewObject>().notifyBufferDetached(); + buffer->setFirstView(nullptr); + } + + if (buffer->dataPointer()) { + buffer->releaseData(cx->gcContext()); + buffer->setDataPointer(BufferContents::createNoData()); + } + + buffer->setByteLength(0); + buffer->setIsDetached(); + if (buffer->isResizable()) { + buffer->as<ResizableArrayBufferObject>().setMaxByteLength(0); + } +} + +void ResizableArrayBufferObject::resize(size_t newByteLength) { + MOZ_ASSERT(!isPreparedForAsmJS()); + MOZ_ASSERT(!isWasm()); + MOZ_ASSERT(!isDetached()); + MOZ_ASSERT(!isLengthPinned()); + MOZ_ASSERT(isResizable()); + MOZ_ASSERT(newByteLength <= maxByteLength()); + + // Clear the bytes between `data[newByteLength..oldByteLength]` when + // shrinking the buffer. We don't need to clear any bytes when growing the + // buffer, because the new space was either initialized to zero when creating + // the buffer, or a prior shrink zeroed it out here. + size_t oldByteLength = byteLength(); + if (newByteLength < oldByteLength) { + size_t nbytes = oldByteLength - newByteLength; + memset(dataPointer() + newByteLength, 0, nbytes); + } + + setByteLength(newByteLength); +} + +/* clang-format off */ +/* + * [SMDOC] WASM Linear Memory structure + * + * Wasm Raw Buf Linear Memory Structure + * + * The linear heap in Wasm is an mmaped array buffer. Several constants manage + * its lifetime: + * + * - byteLength - the wasm-visible current length of the buffer in + * bytes. Accesses in the range [0, byteLength] succeed. May only increase. + * + * - boundsCheckLimit - the size against which we perform bounds checks. The + * value of this depends on the bounds checking strategy chosen for the array + * buffer and the specific bounds checking semantics. For asm.js code and + * for wasm code running with explicit bounds checking, it is the always the + * same as the byteLength. For wasm code using the huge-memory trick, it is + * always wasm::GuardSize smaller than mappedSize. + * + * See also "Linear memory addresses and bounds checking" in + * wasm/WasmMemory.cpp. + * + * See also WasmMemoryObject::boundsCheckLimit(). + * + * - sourceMaxSize - the optional declared limit on how far byteLength can grow + * in pages. This is the unmodified maximum size from the source module or + * JS-API invocation. This may not be representable in byte lengths, nor + * feasible for a module to actually grow to due to implementation limits. + * It is used for correct linking checks and js-types reflection. + * + * - clampedMaxSize - the maximum size on how far the byteLength can grow in + * pages. This value respects implementation limits and is always + * representable as a byte length. Every memory has a clampedMaxSize, even if + * no maximum was specified in source. When a memory has no sourceMaxSize, + * the clampedMaxSize will be the maximum amount of memory that can be grown + * to while still respecting implementation limits. + * + * - mappedSize - the actual mmapped size. Access in the range [0, mappedSize] + * will either succeed, or be handled by the wasm signal handlers. If + * sourceMaxSize is present at initialization, then we attempt to map the + * whole clampedMaxSize. Otherwise we only map the region needed for the + * initial size. + * + * The below diagram shows the layout of the wasm heap. The wasm-visible portion + * of the heap starts at 0. There is one extra page prior to the start of the + * wasm heap which contains the WasmArrayRawBuffer struct at its end (i.e. right + * before the start of the WASM heap). + * + * WasmArrayRawBuffer + * \ ArrayBufferObject::dataPointer() + * \ / + * \ | + * ______|_|______________________________________________________ + * |______|_|______________|___________________|___________________| + * 0 byteLength clampedMaxSize mappedSize + * + * \_______________________/ + * COMMITED + * \_____________________________________/ + * SLOP + * \______________________________________________________________/ + * MAPPED + * + * Invariants on byteLength, clampedMaxSize, and mappedSize: + * - byteLength only increases + * - 0 <= byteLength <= clampedMaxSize <= mappedSize + * - if sourceMaxSize is not specified, mappedSize may grow. + * It is otherwise constant. + * - initialLength <= clampedMaxSize <= sourceMaxSize (if present) + * - clampedMaxSize <= wasm::MaxMemoryPages() + * + * Invariants on boundsCheckLimit: + * - for wasm code with the huge-memory trick, + * clampedMaxSize <= boundsCheckLimit <= mappedSize + * - for asm.js code or wasm with explicit bounds checking, + * byteLength == boundsCheckLimit <= clampedMaxSize + * - on ARM, boundsCheckLimit must be a valid ARM immediate. + * - if sourceMaxSize is not specified, boundsCheckLimit may grow as + * mappedSize grows. They are otherwise constant. + + * NOTE: For asm.js on 32-bit platforms and on all platforms when running with + * explicit bounds checking, we guarantee that + * + * byteLength == maxSize == boundsCheckLimit == mappedSize + * + * That is, signal handlers will not be invoked. + * + * The region between byteLength and mappedSize is the SLOP - an area where we use + * signal handlers to catch things that slip by bounds checks. Logically it has + * two parts: + * + * - from byteLength to boundsCheckLimit - this part of the SLOP serves to catch + * accesses to memory we have reserved but not yet grown into. This allows us + * to grow memory up to max (when present) without having to patch/update the + * bounds checks. + * + * - from boundsCheckLimit to mappedSize - this part of the SLOP allows us to + * bounds check against base pointers and fold some constant offsets inside + * loads. This enables better Bounds Check Elimination. See "Linear memory + * addresses and bounds checking" in wasm/WasmMemory.cpp. + * + */ +/* clang-format on */ + +[[nodiscard]] bool WasmArrayRawBuffer::growToPagesInPlace(Pages newPages) { + size_t newSize = newPages.byteLength(); + size_t oldSize = byteLength(); + + MOZ_ASSERT(newSize >= oldSize); + MOZ_ASSERT(newPages <= clampedMaxPages()); + MOZ_ASSERT(newSize <= mappedSize()); + + size_t delta = newSize - oldSize; + MOZ_ASSERT(delta % wasm::PageSize == 0); + + uint8_t* dataEnd = dataPointer() + oldSize; + MOZ_ASSERT(uintptr_t(dataEnd) % gc::SystemPageSize() == 0); + + if (delta && !CommitBufferMemory(dataEnd, delta)) { + return false; + } + + length_ = newSize; + + return true; +} + +bool WasmArrayRawBuffer::extendMappedSize(Pages maxPages) { + size_t newMappedSize = wasm::ComputeMappedSize(maxPages); + MOZ_ASSERT(mappedSize_ <= newMappedSize); + if (mappedSize_ == newMappedSize) { + return true; + } + + if (!ExtendBufferMapping(dataPointer(), mappedSize_, newMappedSize)) { + return false; + } + + mappedSize_ = newMappedSize; + return true; +} + +void WasmArrayRawBuffer::tryGrowMaxPagesInPlace(Pages deltaMaxPages) { + Pages newMaxPages = clampedMaxPages_; + + DebugOnly<bool> valid = newMaxPages.checkedIncrement(deltaMaxPages); + // Caller must ensure increment does not overflow or increase over the + // specified maximum pages. + MOZ_ASSERT(valid); + MOZ_ASSERT_IF(sourceMaxPages_.isSome(), newMaxPages <= *sourceMaxPages_); + + if (!extendMappedSize(newMaxPages)) { + return; + } + clampedMaxPages_ = newMaxPages; +} + +void WasmArrayRawBuffer::discard(size_t byteOffset, size_t byteLen) { + uint8_t* memBase = dataPointer(); + + // The caller is responsible for ensuring these conditions are met; see this + // function's comment in ArrayBufferObject.h. + MOZ_ASSERT(byteOffset % wasm::PageSize == 0); + MOZ_ASSERT(byteLen % wasm::PageSize == 0); + MOZ_ASSERT(wasm::MemoryBoundsCheck(uint64_t(byteOffset), uint64_t(byteLen), + byteLength())); + + // Discarding zero bytes "succeeds" with no effect. + if (byteLen == 0) { + return; + } + + void* addr = memBase + uintptr_t(byteOffset); + + // On POSIX-ish platforms, we discard memory by overwriting previously-mapped + // pages with freshly-mapped pages (which are all zeroed). The operating + // system recognizes this and decreases the process RSS, and eventually + // collects the abandoned physical pages. + // + // On Windows, committing over previously-committed pages has no effect, and + // the memory must be explicitly decommitted first. This is not the same as an + // munmap; the address space is still reserved. + +#ifdef XP_WIN + if (!VirtualFree(addr, byteLen, MEM_DECOMMIT)) { + MOZ_CRASH("wasm discard: failed to decommit memory"); + } + if (!VirtualAlloc(addr, byteLen, MEM_COMMIT, PAGE_READWRITE)) { + MOZ_CRASH("wasm discard: decommitted memory but failed to recommit"); + }; +#elif defined(__wasi__) + memset(addr, 0, byteLen); +#else // !XP_WIN + void* data = MozTaggedAnonymousMmap(addr, byteLen, PROT_READ | PROT_WRITE, + MAP_PRIVATE | MAP_ANON | MAP_FIXED, -1, 0, + "wasm-reserved"); + if (data == MAP_FAILED) { + MOZ_CRASH("failed to discard wasm memory; memory mappings may be broken"); + } +#endif +} + +/* static */ +WasmArrayRawBuffer* WasmArrayRawBuffer::AllocateWasm( + IndexType indexType, Pages initialPages, Pages clampedMaxPages, + const Maybe<Pages>& sourceMaxPages, const Maybe<size_t>& mapped) { + // Prior code has asserted that initial pages is within our implementation + // limits (wasm::MaxMemoryPages) and we can assume it is a valid size_t. + MOZ_ASSERT(initialPages.hasByteLength()); + size_t numBytes = initialPages.byteLength(); + + // If there is a specified maximum, attempt to map the whole range for + // clampedMaxPages. Or else map only what's required for initialPages. + Pages initialMappedPages = + sourceMaxPages.isSome() ? clampedMaxPages : initialPages; + + // Use an override mapped size, or else compute the mapped size from + // initialMappedPages. + size_t mappedSize = + mapped.isSome() ? *mapped : wasm::ComputeMappedSize(initialMappedPages); + + MOZ_RELEASE_ASSERT(mappedSize <= SIZE_MAX - gc::SystemPageSize()); + MOZ_RELEASE_ASSERT(numBytes <= SIZE_MAX - gc::SystemPageSize()); + MOZ_RELEASE_ASSERT(initialPages <= clampedMaxPages); + MOZ_ASSERT(numBytes % gc::SystemPageSize() == 0); + MOZ_ASSERT(mappedSize % gc::SystemPageSize() == 0); + + uint64_t mappedSizeWithHeader = mappedSize + gc::SystemPageSize(); + uint64_t numBytesWithHeader = numBytes + gc::SystemPageSize(); + + void* data = MapBufferMemory(indexType, (size_t)mappedSizeWithHeader, + (size_t)numBytesWithHeader); + if (!data) { + return nullptr; + } + + uint8_t* base = reinterpret_cast<uint8_t*>(data) + gc::SystemPageSize(); + uint8_t* header = base - sizeof(WasmArrayRawBuffer); + + auto rawBuf = new (header) WasmArrayRawBuffer( + indexType, base, clampedMaxPages, sourceMaxPages, mappedSize, numBytes); + return rawBuf; +} + +/* static */ +void WasmArrayRawBuffer::Release(void* mem) { + WasmArrayRawBuffer* header = + (WasmArrayRawBuffer*)((uint8_t*)mem - sizeof(WasmArrayRawBuffer)); + + MOZ_RELEASE_ASSERT(header->mappedSize() <= SIZE_MAX - gc::SystemPageSize()); + size_t mappedSizeWithHeader = header->mappedSize() + gc::SystemPageSize(); + + static_assert(std::is_trivially_destructible_v<WasmArrayRawBuffer>, + "no need to call the destructor"); + + UnmapBufferMemory(header->indexType(), header->basePointer(), + mappedSizeWithHeader); +} + +WasmArrayRawBuffer* ArrayBufferObject::BufferContents::wasmBuffer() const { + MOZ_RELEASE_ASSERT(kind_ == WASM); + return (WasmArrayRawBuffer*)(data_ - sizeof(WasmArrayRawBuffer)); +} + +template <typename ObjT, typename RawbufT> +static ArrayBufferObjectMaybeShared* CreateSpecificWasmBuffer( + JSContext* cx, const wasm::MemoryDesc& memory) { + bool useHugeMemory = wasm::IsHugeMemoryEnabled(memory.indexType()); + Pages initialPages = memory.initialPages(); + Maybe<Pages> sourceMaxPages = memory.maximumPages(); + Pages clampedMaxPages = wasm::ClampedMaxPages( + memory.indexType(), initialPages, sourceMaxPages, useHugeMemory); + + Maybe<size_t> mappedSize; +#ifdef WASM_SUPPORTS_HUGE_MEMORY + // Override the mapped size if we are using huge memory. If we are not, then + // it will be calculated by the raw buffer we are using. + if (useHugeMemory) { + mappedSize = Some(wasm::HugeMappedSize); + } +#endif + + RawbufT* buffer = + RawbufT::AllocateWasm(memory.limits.indexType, initialPages, + clampedMaxPages, sourceMaxPages, mappedSize); + if (!buffer) { + if (useHugeMemory) { + WarnNumberASCII(cx, JSMSG_WASM_HUGE_MEMORY_FAILED); + if (cx->isExceptionPending()) { + cx->clearPendingException(); + } + + ReportOutOfMemory(cx); + return nullptr; + } + + // If we fail, and have a sourceMaxPages, try to reserve the biggest + // chunk in the range [initialPages, clampedMaxPages) using log backoff. + if (!sourceMaxPages) { + wasm::Log(cx, "new Memory({initial=%" PRIu64 " pages}) failed", + initialPages.value()); + ReportOutOfMemory(cx); + return nullptr; + } + + uint64_t cur = clampedMaxPages.value() / 2; + for (; Pages(cur) > initialPages; cur /= 2) { + buffer = RawbufT::AllocateWasm(memory.limits.indexType, initialPages, + Pages(cur), sourceMaxPages, mappedSize); + if (buffer) { + break; + } + } + + if (!buffer) { + wasm::Log(cx, "new Memory({initial=%" PRIu64 " pages}) failed", + initialPages.value()); + ReportOutOfMemory(cx); + return nullptr; + } + + // Try to grow our chunk as much as possible. + for (size_t d = cur / 2; d >= 1; d /= 2) { + buffer->tryGrowMaxPagesInPlace(Pages(d)); + } + } + + // ObjT::createFromNewRawBuffer assumes ownership of |buffer| even in case + // of failure. + Rooted<ArrayBufferObjectMaybeShared*> object( + cx, ObjT::createFromNewRawBuffer(cx, buffer, initialPages.byteLength())); + if (!object) { + return nullptr; + } + + // See MaximumLiveMappedBuffers comment above. + if (wasmReservedBytes > WasmReservedBytesStartSyncFullGC) { + JS::PrepareForFullGC(cx); + JS::NonIncrementalGC(cx, JS::GCOptions::Normal, + JS::GCReason::TOO_MUCH_WASM_MEMORY); + wasmReservedBytesSinceLast = 0; + } else if (wasmReservedBytes > WasmReservedBytesStartTriggering) { + wasmReservedBytesSinceLast += uint64_t(buffer->mappedSize()); + if (wasmReservedBytesSinceLast > WasmReservedBytesPerTrigger) { + (void)cx->runtime()->gc.triggerGC(JS::GCReason::TOO_MUCH_WASM_MEMORY); + wasmReservedBytesSinceLast = 0; + } + } else { + wasmReservedBytesSinceLast = 0; + } + + // Log the result with details on the memory allocation + if (sourceMaxPages) { + if (useHugeMemory) { + wasm::Log(cx, + "new Memory({initial:%" PRIu64 " pages, maximum:%" PRIu64 + " pages}) succeeded", + initialPages.value(), sourceMaxPages->value()); + } else { + wasm::Log(cx, + "new Memory({initial:%" PRIu64 " pages, maximum:%" PRIu64 + " pages}) succeeded " + "with internal maximum of %" PRIu64 " pages", + initialPages.value(), sourceMaxPages->value(), + object->wasmClampedMaxPages().value()); + } + } else { + wasm::Log(cx, "new Memory({initial:%" PRIu64 " pages}) succeeded", + initialPages.value()); + } + + return object; +} + +ArrayBufferObjectMaybeShared* js::CreateWasmBuffer( + JSContext* cx, const wasm::MemoryDesc& memory) { + MOZ_RELEASE_ASSERT(memory.initialPages() <= + wasm::MaxMemoryPages(memory.indexType())); + MOZ_RELEASE_ASSERT(cx->wasm().haveSignalHandlers); + + if (memory.isShared()) { + if (!cx->realm()->creationOptions().getSharedMemoryAndAtomicsEnabled()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_WASM_NO_SHMEM_LINK); + return nullptr; + } + return CreateSpecificWasmBuffer<SharedArrayBufferObject, + WasmSharedArrayRawBuffer>(cx, memory); + } + return CreateSpecificWasmBuffer<ArrayBufferObject, WasmArrayRawBuffer>( + cx, memory); +} + +bool ArrayBufferObject::prepareForAsmJS() { + MOZ_ASSERT(byteLength() % wasm::PageSize == 0, + "prior size checking should have guaranteed page-size multiple"); + MOZ_ASSERT(byteLength() > 0, + "prior size checking should have excluded empty buffers"); + MOZ_ASSERT(!isResizable(), + "prior checks should have excluded resizable buffers"); + + switch (bufferKind()) { + case MALLOCED_ARRAYBUFFER_CONTENTS_ARENA: + case MALLOCED_UNKNOWN_ARENA: + case MAPPED: + case EXTERNAL: + // It's okay if this uselessly sets the flag a second time. + setIsPreparedForAsmJS(); + return true; + + case INLINE_DATA: + static_assert( + wasm::PageSize > FixedLengthArrayBufferObject::MaxInlineBytes, + "inline data must be too small to be a page size multiple"); + MOZ_ASSERT_UNREACHABLE( + "inline-data buffers should be implicitly excluded by size checks"); + return false; + + case NO_DATA: + MOZ_ASSERT_UNREACHABLE( + "size checking should have excluded detached or empty buffers"); + return false; + + // asm.js code and associated buffers are potentially long-lived. Yet a + // buffer of user-owned data *must* be detached by the user before the + // user-owned data is disposed. No caller wants to use a user-owned + // ArrayBuffer with asm.js, so just don't support this and avoid a mess of + // complexity. + case USER_OWNED: + // wasm buffers can be detached at any time. + case WASM: + MOZ_ASSERT(!isPreparedForAsmJS()); + return false; + } + + MOZ_ASSERT_UNREACHABLE("non-exhaustive kind-handling switch?"); + return false; +} + +ArrayBufferObject::BufferContents ArrayBufferObject::createMappedContents( + int fd, size_t offset, size_t length) { + void* data = + gc::AllocateMappedContent(fd, offset, length, ARRAY_BUFFER_ALIGNMENT); + return BufferContents::createMapped(data); +} + +uint8_t* FixedLengthArrayBufferObject::inlineDataPointer() const { + return static_cast<uint8_t*>(fixedData(JSCLASS_RESERVED_SLOTS(&class_))); +} + +uint8_t* ResizableArrayBufferObject::inlineDataPointer() const { + return static_cast<uint8_t*>(fixedData(JSCLASS_RESERVED_SLOTS(&class_))); +} + +uint8_t* ArrayBufferObject::dataPointer() const { + return static_cast<uint8_t*>(getFixedSlot(DATA_SLOT).toPrivate()); +} + +SharedMem<uint8_t*> ArrayBufferObject::dataPointerShared() const { + return SharedMem<uint8_t*>::unshared(getFixedSlot(DATA_SLOT).toPrivate()); +} + +ArrayBufferObject::FreeInfo* ArrayBufferObject::freeInfo() const { + MOZ_ASSERT(isExternal()); + MOZ_ASSERT(!isResizable()); + auto* data = as<FixedLengthArrayBufferObject>().inlineDataPointer(); + return reinterpret_cast<FreeInfo*>(data); +} + +void ArrayBufferObject::releaseData(JS::GCContext* gcx) { + switch (bufferKind()) { + case INLINE_DATA: + // Inline data doesn't require releasing. + break; + case MALLOCED_ARRAYBUFFER_CONTENTS_ARENA: + case MALLOCED_UNKNOWN_ARENA: + gcx->free_(this, dataPointer(), associatedBytes(), + MemoryUse::ArrayBufferContents); + break; + case NO_DATA: + // There's nothing to release if there's no data. + MOZ_ASSERT(dataPointer() == nullptr); + break; + case USER_OWNED: + // User-owned data is released by, well, the user. + break; + case MAPPED: + gc::DeallocateMappedContent(dataPointer(), byteLength()); + gcx->removeCellMemory(this, associatedBytes(), + MemoryUse::ArrayBufferContents); + break; + case WASM: + WasmArrayRawBuffer::Release(dataPointer()); + gcx->removeCellMemory(this, byteLength(), MemoryUse::ArrayBufferContents); + break; + case EXTERNAL: + MOZ_ASSERT(freeInfo()->freeFunc); + { + // The analyzer can't know for sure whether the embedder-supplied + // free function will GC. We give the analyzer a hint here. + // (Doing a GC in the free function is considered a programmer + // error.) + JS::AutoSuppressGCAnalysis nogc; + freeInfo()->freeFunc(dataPointer(), freeInfo()->freeUserData); + } + break; + } +} + +void ArrayBufferObject::setDataPointer(BufferContents contents) { + setFixedSlot(DATA_SLOT, PrivateValue(contents.data())); + setFlags((flags() & ~KIND_MASK) | contents.kind()); + + if (isExternal()) { + auto info = freeInfo(); + info->freeFunc = contents.freeFunc(); + info->freeUserData = contents.freeUserData(); + } +} + +size_t ArrayBufferObject::byteLength() const { + return size_t(getFixedSlot(BYTE_LENGTH_SLOT).toPrivate()); +} + +inline size_t ArrayBufferObject::associatedBytes() const { + if (isMalloced()) { + if (isResizable()) { + return as<ResizableArrayBufferObject>().maxByteLength(); + } + return byteLength(); + } + if (isMapped()) { + return RoundUp(byteLength(), js::gc::SystemPageSize()); + } + MOZ_CRASH("Unexpected buffer kind"); +} + +void ArrayBufferObject::setByteLength(size_t length) { + MOZ_ASSERT(length <= ArrayBufferObject::ByteLengthLimit); + setFixedSlot(BYTE_LENGTH_SLOT, PrivateValue(length)); +} + +size_t ArrayBufferObject::wasmMappedSize() const { + if (isWasm()) { + return contents().wasmBuffer()->mappedSize(); + } + return byteLength(); +} + +IndexType ArrayBufferObject::wasmIndexType() const { + if (isWasm()) { + return contents().wasmBuffer()->indexType(); + } + MOZ_ASSERT(isPreparedForAsmJS()); + return wasm::IndexType::I32; +} + +Pages ArrayBufferObject::wasmPages() const { + if (isWasm()) { + return contents().wasmBuffer()->pages(); + } + MOZ_ASSERT(isPreparedForAsmJS()); + return Pages::fromByteLengthExact(byteLength()); +} + +Pages ArrayBufferObject::wasmClampedMaxPages() const { + if (isWasm()) { + return contents().wasmBuffer()->clampedMaxPages(); + } + MOZ_ASSERT(isPreparedForAsmJS()); + return Pages::fromByteLengthExact(byteLength()); +} + +Maybe<Pages> ArrayBufferObject::wasmSourceMaxPages() const { + if (isWasm()) { + return contents().wasmBuffer()->sourceMaxPages(); + } + MOZ_ASSERT(isPreparedForAsmJS()); + return Some<Pages>(Pages::fromByteLengthExact(byteLength())); +} + +size_t js::WasmArrayBufferMappedSize(const ArrayBufferObjectMaybeShared* buf) { + if (buf->is<ArrayBufferObject>()) { + return buf->as<ArrayBufferObject>().wasmMappedSize(); + } + return buf->as<SharedArrayBufferObject>().wasmMappedSize(); +} + +IndexType js::WasmArrayBufferIndexType( + const ArrayBufferObjectMaybeShared* buf) { + if (buf->is<ArrayBufferObject>()) { + return buf->as<ArrayBufferObject>().wasmIndexType(); + } + return buf->as<SharedArrayBufferObject>().wasmIndexType(); +} +Pages js::WasmArrayBufferPages(const ArrayBufferObjectMaybeShared* buf) { + if (buf->is<ArrayBufferObject>()) { + return buf->as<ArrayBufferObject>().wasmPages(); + } + return buf->as<SharedArrayBufferObject>().volatileWasmPages(); +} +Pages js::WasmArrayBufferClampedMaxPages( + const ArrayBufferObjectMaybeShared* buf) { + if (buf->is<ArrayBufferObject>()) { + return buf->as<ArrayBufferObject>().wasmClampedMaxPages(); + } + return buf->as<SharedArrayBufferObject>().wasmClampedMaxPages(); +} +Maybe<Pages> js::WasmArrayBufferSourceMaxPages( + const ArrayBufferObjectMaybeShared* buf) { + if (buf->is<ArrayBufferObject>()) { + return buf->as<ArrayBufferObject>().wasmSourceMaxPages(); + } + return Some(buf->as<SharedArrayBufferObject>().wasmSourceMaxPages()); +} + +static void CheckStealPreconditions(Handle<ArrayBufferObject*> buffer, + JSContext* cx) { + cx->check(buffer); + + MOZ_ASSERT(!buffer->isDetached(), "can't steal from a detached buffer"); + MOZ_ASSERT(!buffer->isLengthPinned(), + "can't steal from a buffer with a pinned length"); + MOZ_ASSERT(!buffer->isPreparedForAsmJS(), + "asm.js-prepared buffers don't have detachable/stealable data"); +} + +/* static */ +ArrayBufferObject* ArrayBufferObject::wasmGrowToPagesInPlace( + wasm::IndexType t, Pages newPages, Handle<ArrayBufferObject*> oldBuf, + JSContext* cx) { + if (oldBuf->isLengthPinned()) { + return nullptr; + } + + CheckStealPreconditions(oldBuf, cx); + + MOZ_ASSERT(oldBuf->isWasm()); + + // Check that the new pages is within our allowable range. This will + // simultaneously check against the maximum specified in source and our + // implementation limits. + if (newPages > oldBuf->wasmClampedMaxPages()) { + return nullptr; + } + MOZ_ASSERT(newPages <= wasm::MaxMemoryPages(t) && + newPages.byteLength() <= ArrayBufferObject::ByteLengthLimit); + + // We have checked against the clamped maximum and so we know we can convert + // to byte lengths now. + size_t newSize = newPages.byteLength(); + + // On failure, do not throw and ensure that the original buffer is + // unmodified and valid. After WasmArrayRawBuffer::growToPagesInPlace(), the + // wasm-visible length of the buffer has been increased so it must be the + // last fallible operation. + + auto* newBuf = ArrayBufferObject::createEmpty(cx); + if (!newBuf) { + cx->clearPendingException(); + return nullptr; + } + + MOZ_ASSERT(newBuf->isNoData()); + + if (!oldBuf->contents().wasmBuffer()->growToPagesInPlace(newPages)) { + return nullptr; + } + + // Extract the grown contents from |oldBuf|. + BufferContents oldContents = oldBuf->contents(); + + // Overwrite |oldBuf|'s data pointer *without* releasing old data. + oldBuf->setDataPointer(BufferContents::createNoData()); + + // Detach |oldBuf| now that doing so won't release |oldContents|. + RemoveCellMemory(oldBuf, oldBuf->byteLength(), + MemoryUse::ArrayBufferContents); + ArrayBufferObject::detach(cx, oldBuf); + + // Set |newBuf|'s contents to |oldBuf|'s original contents. + newBuf->initialize(newSize, oldContents); + AddCellMemory(newBuf, newSize, MemoryUse::ArrayBufferContents); + + return newBuf; +} + +/* static */ +ArrayBufferObject* ArrayBufferObject::wasmMovingGrowToPages( + IndexType t, Pages newPages, Handle<ArrayBufferObject*> oldBuf, + JSContext* cx) { + // On failure, do not throw and ensure that the original buffer is + // unmodified and valid. + if (oldBuf->isLengthPinned()) { + return nullptr; + } + + // Check that the new pages is within our allowable range. This will + // simultaneously check against the maximum specified in source and our + // implementation limits. + if (newPages > oldBuf->wasmClampedMaxPages()) { + return nullptr; + } + MOZ_ASSERT(newPages <= wasm::MaxMemoryPages(t) && + newPages.byteLength() < ArrayBufferObject::ByteLengthLimit); + + // We have checked against the clamped maximum and so we know we can convert + // to byte lengths now. + size_t newSize = newPages.byteLength(); + + if (wasm::ComputeMappedSize(newPages) <= oldBuf->wasmMappedSize() || + oldBuf->contents().wasmBuffer()->extendMappedSize(newPages)) { + return wasmGrowToPagesInPlace(t, newPages, oldBuf, cx); + } + + Rooted<ArrayBufferObject*> newBuf(cx, ArrayBufferObject::createEmpty(cx)); + if (!newBuf) { + cx->clearPendingException(); + return nullptr; + } + + Pages clampedMaxPages = + wasm::ClampedMaxPages(t, newPages, Nothing(), /* hugeMemory */ false); + WasmArrayRawBuffer* newRawBuf = WasmArrayRawBuffer::AllocateWasm( + oldBuf->wasmIndexType(), newPages, clampedMaxPages, Nothing(), Nothing()); + if (!newRawBuf) { + return nullptr; + } + + AddCellMemory(newBuf, newSize, MemoryUse::ArrayBufferContents); + + BufferContents contents = + BufferContents::createWasm(newRawBuf->dataPointer()); + newBuf->initialize(newSize, contents); + + memcpy(newBuf->dataPointer(), oldBuf->dataPointer(), oldBuf->byteLength()); + ArrayBufferObject::detach(cx, oldBuf); + + return newBuf; +} + +/* static */ +void ArrayBufferObject::wasmDiscard(Handle<ArrayBufferObject*> buf, + uint64_t byteOffset, uint64_t byteLen) { + MOZ_ASSERT(buf->isWasm()); + buf->contents().wasmBuffer()->discard(byteOffset, byteLen); +} + +uint32_t ArrayBufferObject::flags() const { + return uint32_t(getFixedSlot(FLAGS_SLOT).toInt32()); +} + +void ArrayBufferObject::setFlags(uint32_t flags) { + setFixedSlot(FLAGS_SLOT, Int32Value(flags)); +} + +static constexpr js::gc::AllocKind GetArrayBufferGCObjectKind(size_t numSlots) { + if (numSlots <= 4) { + return js::gc::AllocKind::ARRAYBUFFER4; + } + if (numSlots <= 8) { + return js::gc::AllocKind::ARRAYBUFFER8; + } + if (numSlots <= 12) { + return js::gc::AllocKind::ARRAYBUFFER12; + } + return js::gc::AllocKind::ARRAYBUFFER16; +} + +template <class ArrayBufferType> +static ArrayBufferType* NewArrayBufferObject(JSContext* cx, HandleObject proto_, + gc::AllocKind allocKind) { + MOZ_ASSERT(allocKind == gc::AllocKind::ARRAYBUFFER4 || + allocKind == gc::AllocKind::ARRAYBUFFER8 || + allocKind == gc::AllocKind::ARRAYBUFFER12 || + allocKind == gc::AllocKind::ARRAYBUFFER16); + + static_assert(std::is_same_v<ArrayBufferType, FixedLengthArrayBufferObject> || + std::is_same_v<ArrayBufferType, ResizableArrayBufferObject>); + + RootedObject proto(cx, proto_); + if (!proto) { + proto = GlobalObject::getOrCreatePrototype(cx, JSProto_ArrayBuffer); + if (!proto) { + return nullptr; + } + } + + const JSClass* clasp = &ArrayBufferType::class_; + + // Array buffers can store data inline so we only use fixed slots to cover the + // reserved slots, ignoring the AllocKind. + MOZ_ASSERT(ClassCanHaveFixedData(clasp)); + constexpr size_t nfixed = ArrayBufferType::RESERVED_SLOTS; + static_assert(nfixed <= NativeObject::MAX_FIXED_SLOTS); + + Rooted<SharedShape*> shape( + cx, + SharedShape::getInitialShape(cx, clasp, cx->realm(), AsTaggedProto(proto), + nfixed, ObjectFlags())); + if (!shape) { + return nullptr; + } + + // Array buffers can't be nursery allocated but can be background-finalized. + MOZ_ASSERT(IsBackgroundFinalized(allocKind)); + MOZ_ASSERT(!CanNurseryAllocateFinalizedClass(clasp)); + constexpr gc::Heap heap = gc::Heap::Tenured; + + return NativeObject::create<ArrayBufferType>(cx, allocKind, heap, shape); +} + +// Creates a new ArrayBufferObject with %ArrayBuffer.prototype% as proto and no +// space for inline data. +static ArrayBufferObject* NewArrayBufferObject(JSContext* cx) { + constexpr auto allocKind = + GetArrayBufferGCObjectKind(FixedLengthArrayBufferObject::RESERVED_SLOTS); + return NewArrayBufferObject<FixedLengthArrayBufferObject>(cx, nullptr, + allocKind); +} +static ResizableArrayBufferObject* NewResizableArrayBufferObject( + JSContext* cx) { + constexpr auto allocKind = + GetArrayBufferGCObjectKind(ResizableArrayBufferObject::RESERVED_SLOTS); + return NewArrayBufferObject<ResizableArrayBufferObject>(cx, nullptr, + allocKind); +} + +ArrayBufferObject* ArrayBufferObject::createForContents( + JSContext* cx, size_t nbytes, BufferContents contents) { + MOZ_ASSERT(contents); + MOZ_ASSERT(contents.kind() != INLINE_DATA); + MOZ_ASSERT(contents.kind() != NO_DATA); + MOZ_ASSERT(contents.kind() != WASM); + + // 24.1.1.1, step 3 (Inlined 6.2.6.1 CreateByteDataBlock, step 2). + if (!CheckArrayBufferTooLarge(cx, nbytes)) { + return nullptr; + } + + // Some |contents| kinds need to store extra data in the ArrayBuffer beyond a + // data pointer. If needed for the particular kind, add extra fixed slots to + // the ArrayBuffer for use as raw storage to store such information. + constexpr size_t reservedSlots = FixedLengthArrayBufferObject::RESERVED_SLOTS; + + size_t nAllocated = 0; + size_t nslots = reservedSlots; + if (contents.kind() == USER_OWNED) { + // No accounting to do in this case. + } else if (contents.kind() == EXTERNAL) { + // Store the FreeInfo in the inline data slots so that we + // don't use up slots for it in non-refcounted array buffers. + constexpr size_t freeInfoSlots = HowMany(sizeof(FreeInfo), sizeof(Value)); + static_assert( + reservedSlots + freeInfoSlots <= NativeObject::MAX_FIXED_SLOTS, + "FreeInfo must fit in inline slots"); + nslots += freeInfoSlots; + } else { + // The ABO is taking ownership, so account the bytes against the zone. + nAllocated = nbytes; + if (contents.kind() == MAPPED) { + nAllocated = RoundUp(nbytes, js::gc::SystemPageSize()); + } else { + MOZ_ASSERT(contents.kind() == MALLOCED_ARRAYBUFFER_CONTENTS_ARENA || + contents.kind() == MALLOCED_UNKNOWN_ARENA, + "should have handled all possible callers' kinds"); + } + } + + gc::AllocKind allocKind = GetArrayBufferGCObjectKind(nslots); + + AutoSetNewObjectMetadata metadata(cx); + Rooted<ArrayBufferObject*> buffer( + cx, NewArrayBufferObject<FixedLengthArrayBufferObject>(cx, nullptr, + allocKind)); + if (!buffer) { + return nullptr; + } + + MOZ_ASSERT(!gc::IsInsideNursery(buffer), + "ArrayBufferObject has a finalizer that must be called to not " + "leak in some cases, so it can't be nursery-allocated"); + + buffer->initialize(nbytes, contents); + + if (contents.kind() == MAPPED || + contents.kind() == MALLOCED_ARRAYBUFFER_CONTENTS_ARENA || + contents.kind() == MALLOCED_UNKNOWN_ARENA) { + AddCellMemory(buffer, nAllocated, MemoryUse::ArrayBufferContents); + } + + return buffer; +} + +template <class ArrayBufferType, ArrayBufferObject::FillContents FillType> +/* static */ std::tuple<ArrayBufferType*, uint8_t*> +ArrayBufferObject::createUninitializedBufferAndData( + JSContext* cx, size_t nbytes, AutoSetNewObjectMetadata&, + JS::Handle<JSObject*> proto) { + MOZ_ASSERT(nbytes <= ArrayBufferObject::ByteLengthLimit, + "caller must validate the byte count it passes"); + + static_assert(std::is_same_v<ArrayBufferType, FixedLengthArrayBufferObject> || + std::is_same_v<ArrayBufferType, ResizableArrayBufferObject>); + + // Try fitting the data inline with the object by repurposing fixed-slot + // storage. Add extra fixed slots if necessary to accomplish this, but don't + // exceed the maximum number of fixed slots! + size_t nslots = ArrayBufferType::RESERVED_SLOTS; + ArrayBufferContents data; + if (nbytes <= ArrayBufferType::MaxInlineBytes) { + int newSlots = HowMany(nbytes, sizeof(Value)); + MOZ_ASSERT(int(nbytes) <= newSlots * int(sizeof(Value))); + + nslots += newSlots; + } else { + data = FillType == FillContents::Uninitialized + ? AllocateUninitializedArrayBufferContents(cx, nbytes) + : AllocateArrayBufferContents(cx, nbytes); + if (!data) { + return {nullptr, nullptr}; + } + } + + gc::AllocKind allocKind = GetArrayBufferGCObjectKind(nslots); + + auto* buffer = NewArrayBufferObject<ArrayBufferType>(cx, proto, allocKind); + if (!buffer) { + return {nullptr, nullptr}; + } + + MOZ_ASSERT(!gc::IsInsideNursery(buffer), + "ArrayBufferObject has a finalizer that must be called to not " + "leak in some cases, so it can't be nursery-allocated"); + + if (data) { + return {buffer, data.release()}; + } + + if constexpr (FillType == FillContents::Zero) { + memset(buffer->inlineDataPointer(), 0, nbytes); + } + return {buffer, nullptr}; +} + +template <ArrayBufferObject::FillContents FillType> +/* static */ std::tuple<ArrayBufferObject*, uint8_t*> +ArrayBufferObject::createBufferAndData( + JSContext* cx, size_t nbytes, AutoSetNewObjectMetadata& metadata, + JS::Handle<JSObject*> proto /* = nullptr */) { + MOZ_ASSERT(nbytes <= ArrayBufferObject::ByteLengthLimit, + "caller must validate the byte count it passes"); + + auto [buffer, data] = + createUninitializedBufferAndData<FixedLengthArrayBufferObject, FillType>( + cx, nbytes, metadata, proto); + if (!buffer) { + return {nullptr, nullptr}; + } + + if (data) { + buffer->initialize( + nbytes, BufferContents::createMallocedArrayBufferContentsArena(data)); + AddCellMemory(buffer, nbytes, MemoryUse::ArrayBufferContents); + } else { + data = buffer->inlineDataPointer(); + buffer->initialize(nbytes, BufferContents::createInlineData(data)); + } + return {buffer, data}; +} + +template <ArrayBufferObject::FillContents FillType> +/* static */ std::tuple<ResizableArrayBufferObject*, uint8_t*> +ResizableArrayBufferObject::createBufferAndData( + JSContext* cx, size_t byteLength, size_t maxByteLength, + AutoSetNewObjectMetadata& metadata, Handle<JSObject*> proto) { + MOZ_ASSERT(byteLength <= maxByteLength); + MOZ_ASSERT(maxByteLength <= ArrayBufferObject::ByteLengthLimit, + "caller must validate the byte count it passes"); + + // NOTE: The spec proposal for resizable ArrayBuffers suggests to use a + // virtual memory based approach to avoid eagerly allocating the maximum byte + // length. We don't yet support this and instead are allocating the maximum + // byte length direct from the start. + size_t nbytes = maxByteLength; + + auto [buffer, data] = + createUninitializedBufferAndData<ResizableArrayBufferObject, FillType>( + cx, nbytes, metadata, proto); + if (!buffer) { + return {nullptr, nullptr}; + } + + if (data) { + buffer->initialize( + byteLength, maxByteLength, + BufferContents::createMallocedArrayBufferContentsArena(data)); + AddCellMemory(buffer, nbytes, MemoryUse::ArrayBufferContents); + } else { + data = buffer->inlineDataPointer(); + buffer->initialize(byteLength, maxByteLength, + BufferContents::createInlineData(data)); + } + return {buffer, data}; +} + +/* static */ ArrayBufferObject* ArrayBufferObject::copy( + JSContext* cx, size_t newByteLength, + JS::Handle<ArrayBufferObject*> source) { + MOZ_ASSERT(!source->isDetached()); + MOZ_ASSERT(newByteLength <= ArrayBufferObject::ByteLengthLimit, + "caller must validate the byte count it passes"); + + size_t sourceByteLength = source->byteLength(); + + if (newByteLength > sourceByteLength) { + // Copy into a larger buffer. + AutoSetNewObjectMetadata metadata(cx); + auto [buffer, toFill] = createBufferAndData<FillContents::Zero>( + cx, newByteLength, metadata, nullptr); + if (!buffer) { + return nullptr; + } + + std::copy_n(source->dataPointer(), sourceByteLength, toFill); + + return buffer; + } + + // Copy into a smaller or same size buffer. + AutoSetNewObjectMetadata metadata(cx); + auto [buffer, toFill] = createBufferAndData<FillContents::Uninitialized>( + cx, newByteLength, metadata, nullptr); + if (!buffer) { + return nullptr; + } + + std::uninitialized_copy_n(source->dataPointer(), newByteLength, toFill); + + return buffer; +} + +/* static */ ResizableArrayBufferObject* ResizableArrayBufferObject::copy( + JSContext* cx, size_t newByteLength, + JS::Handle<ResizableArrayBufferObject*> source) { + MOZ_ASSERT(!source->isDetached()); + MOZ_ASSERT(newByteLength <= source->maxByteLength()); + + size_t sourceByteLength = source->byteLength(); + size_t newMaxByteLength = source->maxByteLength(); + + if (newByteLength > sourceByteLength) { + // Copy into a larger buffer. + AutoSetNewObjectMetadata metadata(cx); + auto [buffer, toFill] = createBufferAndData<FillContents::Zero>( + cx, newByteLength, newMaxByteLength, metadata, nullptr); + if (!buffer) { + return nullptr; + } + + // The `createBufferAndData()` call first zero-initializes the complete + // buffer and then we copy over |sourceByteLength| bytes from |source|. It + // seems prudent to only zero-initialize the trailing bytes of |toFill| + // to avoid writing twice to `toFill[0..newByteLength]`. We don't yet + // implement this optimization, because this method is only called for + // small, inline buffers, so any write optimizations probably won't make + // much of a difference. + std::copy_n(source->dataPointer(), sourceByteLength, toFill); + + return buffer; + } + + // Copy into a smaller or same size buffer. + AutoSetNewObjectMetadata metadata(cx); + auto [buffer, toFill] = createBufferAndData<FillContents::Uninitialized>( + cx, newByteLength, newMaxByteLength, metadata, nullptr); + if (!buffer) { + return nullptr; + } + + std::uninitialized_copy_n(source->dataPointer(), newByteLength, toFill); + + return buffer; +} + +/* static */ ArrayBufferObject* ArrayBufferObject::copyAndDetach( + JSContext* cx, size_t newByteLength, + JS::Handle<ArrayBufferObject*> source) { + MOZ_ASSERT(!source->isDetached()); + MOZ_ASSERT(!source->isLengthPinned()); + MOZ_ASSERT(newByteLength <= ArrayBufferObject::ByteLengthLimit, + "caller must validate the byte count it passes"); + + if (newByteLength > FixedLengthArrayBufferObject::MaxInlineBytes && + source->isMalloced()) { + if (newByteLength == source->associatedBytes()) { + return copyAndDetachSteal(cx, source); + } + if (source->bufferKind() == + ArrayBufferObject::MALLOCED_ARRAYBUFFER_CONTENTS_ARENA) { + return copyAndDetachRealloc(cx, newByteLength, source); + } + } + + auto* newBuffer = ArrayBufferObject::copy(cx, newByteLength, source); + if (!newBuffer) { + return nullptr; + } + ArrayBufferObject::detach(cx, source); + + return newBuffer; +} + +/* static */ ArrayBufferObject* ArrayBufferObject::copyAndDetachSteal( + JSContext* cx, JS::Handle<ArrayBufferObject*> source) { + MOZ_ASSERT(!source->isDetached()); + MOZ_ASSERT(!source->isLengthPinned()); + MOZ_ASSERT(source->isMalloced()); + + size_t newByteLength = source->associatedBytes(); + MOZ_ASSERT(newByteLength > FixedLengthArrayBufferObject::MaxInlineBytes, + "prefer copying small buffers"); + MOZ_ASSERT(source->byteLength() <= newByteLength, + "source length is less-or-equal to |newByteLength|"); + + auto* newBuffer = ArrayBufferObject::createEmpty(cx); + if (!newBuffer) { + return nullptr; + } + + // Extract the contents from |source|. + BufferContents contents = source->contents(); + MOZ_ASSERT(contents); + MOZ_ASSERT(contents.kind() == MALLOCED_ARRAYBUFFER_CONTENTS_ARENA || + contents.kind() == MALLOCED_UNKNOWN_ARENA); + + // Overwrite |source|'s data pointer *without* releasing the data. + source->setDataPointer(BufferContents::createNoData()); + + // Detach |source| now that doing so won't release |contents|. + RemoveCellMemory(source, newByteLength, MemoryUse::ArrayBufferContents); + ArrayBufferObject::detach(cx, source); + + // Set |newBuffer|'s contents to |source|'s original contents. + newBuffer->initialize(newByteLength, contents); + AddCellMemory(newBuffer, newByteLength, MemoryUse::ArrayBufferContents); + + return newBuffer; +} + +/* static */ ArrayBufferObject* ArrayBufferObject::copyAndDetachRealloc( + JSContext* cx, size_t newByteLength, + JS::Handle<ArrayBufferObject*> source) { + MOZ_ASSERT(!source->isDetached()); + MOZ_ASSERT(!source->isLengthPinned()); + MOZ_ASSERT(source->bufferKind() == MALLOCED_ARRAYBUFFER_CONTENTS_ARENA); + MOZ_ASSERT(newByteLength > FixedLengthArrayBufferObject::MaxInlineBytes, + "prefer copying small buffers"); + MOZ_ASSERT(newByteLength <= ArrayBufferObject::ByteLengthLimit, + "caller must validate the byte count it passes"); + + size_t oldByteLength = source->associatedBytes(); + MOZ_ASSERT(oldByteLength != newByteLength, + "steal instead of realloc same size buffers"); + MOZ_ASSERT(source->byteLength() <= oldByteLength, + "source length is less-or-equal to |oldByteLength|"); + + Rooted<ArrayBufferObject*> newBuffer(cx, ArrayBufferObject::createEmpty(cx)); + if (!newBuffer) { + return nullptr; + } + + // Extract the contents from |source|. + BufferContents contents = source->contents(); + MOZ_ASSERT(contents); + MOZ_ASSERT(contents.kind() == MALLOCED_ARRAYBUFFER_CONTENTS_ARENA); + + // Reallocate the data pointer. + auto newData = ReallocateArrayBufferContents(cx, contents.data(), + oldByteLength, newByteLength); + if (!newData) { + // If reallocation failed, the old pointer is still valid, so just return. + return nullptr; + } + auto newContents = + BufferContents::createMallocedArrayBufferContentsArena(newData.release()); + + // Overwrite |source|'s data pointer *without* releasing the data. + source->setDataPointer(BufferContents::createNoData()); + + // Detach |source| now that doing so won't release |contents|. + RemoveCellMemory(source, oldByteLength, MemoryUse::ArrayBufferContents); + ArrayBufferObject::detach(cx, source); + + // Set |newBuffer|'s contents to |newContents|. + newBuffer->initialize(newByteLength, newContents); + AddCellMemory(newBuffer, newByteLength, MemoryUse::ArrayBufferContents); + + // Zero initialize the newly allocated memory, if necessary. + if (newByteLength > oldByteLength) { + size_t count = newByteLength - oldByteLength; + std::uninitialized_fill_n(newContents.data() + oldByteLength, count, 0); + } + + return newBuffer; +} + +/* static */ ResizableArrayBufferObject* +ResizableArrayBufferObject::copyAndDetach( + JSContext* cx, size_t newByteLength, + JS::Handle<ResizableArrayBufferObject*> source) { + MOZ_ASSERT(!source->isDetached()); + MOZ_ASSERT(!source->isLengthPinned()); + MOZ_ASSERT(newByteLength <= source->maxByteLength()); + + if (source->maxByteLength() > ResizableArrayBufferObject::MaxInlineBytes && + source->isMalloced()) { + return copyAndDetachSteal(cx, newByteLength, source); + } + + auto* newBuffer = ResizableArrayBufferObject::copy(cx, newByteLength, source); + if (!newBuffer) { + return nullptr; + } + ArrayBufferObject::detach(cx, source); + + return newBuffer; +} + +/* static */ ResizableArrayBufferObject* +ResizableArrayBufferObject::copyAndDetachSteal( + JSContext* cx, size_t newByteLength, + JS::Handle<ResizableArrayBufferObject*> source) { + MOZ_ASSERT(!source->isDetached()); + MOZ_ASSERT(!source->isLengthPinned()); + MOZ_ASSERT(newByteLength <= source->maxByteLength()); + MOZ_ASSERT(source->isMalloced()); + + size_t sourceByteLength = source->byteLength(); + size_t maxByteLength = source->maxByteLength(); + MOZ_ASSERT(maxByteLength > ResizableArrayBufferObject::MaxInlineBytes, + "prefer copying small buffers"); + + auto* newBuffer = ResizableArrayBufferObject::createEmpty(cx); + if (!newBuffer) { + return nullptr; + } + + // Extract the contents from |source|. + BufferContents contents = source->contents(); + MOZ_ASSERT(contents); + MOZ_ASSERT(contents.kind() == MALLOCED_ARRAYBUFFER_CONTENTS_ARENA || + contents.kind() == MALLOCED_UNKNOWN_ARENA); + + // Overwrite |source|'s data pointer *without* releasing the data. + source->setDataPointer(BufferContents::createNoData()); + + // Detach |source| now that doing so won't release |contents|. + RemoveCellMemory(source, maxByteLength, MemoryUse::ArrayBufferContents); + ArrayBufferObject::detach(cx, source); + + // Set |newBuffer|'s contents to |source|'s original contents. + newBuffer->initialize(newByteLength, maxByteLength, contents); + AddCellMemory(newBuffer, maxByteLength, MemoryUse::ArrayBufferContents); + + // Clear the bytes between `data[newByteLength..sourceByteLength]`. + if (newByteLength < sourceByteLength) { + size_t nbytes = sourceByteLength - newByteLength; + memset(newBuffer->dataPointer() + newByteLength, 0, nbytes); + } + + return newBuffer; +} + +ArrayBufferObject* ArrayBufferObject::createZeroed( + JSContext* cx, size_t nbytes, HandleObject proto /* = nullptr */) { + // 24.1.1.1, step 3 (Inlined 6.2.6.1 CreateByteDataBlock, step 2). + if (!CheckArrayBufferTooLarge(cx, nbytes)) { + return nullptr; + } + + AutoSetNewObjectMetadata metadata(cx); + auto [buffer, toFill] = + createBufferAndData<FillContents::Zero>(cx, nbytes, metadata, proto); + (void)toFill; + return buffer; +} + +ResizableArrayBufferObject* ResizableArrayBufferObject::createZeroed( + JSContext* cx, size_t byteLength, size_t maxByteLength, + HandleObject proto /* = nullptr */) { + // 24.1.1.1, step 3 (Inlined 6.2.6.1 CreateByteDataBlock, step 2). + if (!CheckArrayBufferTooLarge(cx, byteLength) || + !CheckArrayBufferTooLarge(cx, maxByteLength)) { + return nullptr; + } + if (byteLength > maxByteLength) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_LENGTH_LARGER_THAN_MAXIMUM); + return nullptr; + } + + AutoSetNewObjectMetadata metadata(cx); + auto [buffer, toFill] = createBufferAndData<FillContents::Zero>( + cx, byteLength, maxByteLength, metadata, proto); + (void)toFill; + return buffer; +} + +ArrayBufferObject* ArrayBufferObject::createEmpty(JSContext* cx) { + AutoSetNewObjectMetadata metadata(cx); + ArrayBufferObject* obj = NewArrayBufferObject(cx); + if (!obj) { + return nullptr; + } + + obj->initialize(0, BufferContents::createNoData()); + return obj; +} + +ResizableArrayBufferObject* ResizableArrayBufferObject::createEmpty( + JSContext* cx) { + AutoSetNewObjectMetadata metadata(cx); + auto* obj = NewResizableArrayBufferObject(cx); + if (!obj) { + return nullptr; + } + + obj->initialize(0, 0, BufferContents::createNoData()); + return obj; +} + +ArrayBufferObject* ArrayBufferObject::createFromNewRawBuffer( + JSContext* cx, WasmArrayRawBuffer* rawBuffer, size_t initialSize) { + AutoSetNewObjectMetadata metadata(cx); + ArrayBufferObject* buffer = NewArrayBufferObject(cx); + if (!buffer) { + WasmArrayRawBuffer::Release(rawBuffer->dataPointer()); + return nullptr; + } + + MOZ_ASSERT(initialSize == rawBuffer->byteLength()); + + auto contents = BufferContents::createWasm(rawBuffer->dataPointer()); + buffer->initialize(initialSize, contents); + + AddCellMemory(buffer, initialSize, MemoryUse::ArrayBufferContents); + + return buffer; +} + +/* static */ uint8_t* ArrayBufferObject::stealMallocedContents( + JSContext* cx, Handle<ArrayBufferObject*> buffer) { + CheckStealPreconditions(buffer, cx); + + switch (buffer->bufferKind()) { + case MALLOCED_ARRAYBUFFER_CONTENTS_ARENA: + case MALLOCED_UNKNOWN_ARENA: { + uint8_t* stolenData = buffer->dataPointer(); + MOZ_ASSERT(stolenData); + + // Resizable buffers are initially allocated with their maximum + // byte-length. When stealing the buffer contents shrink the allocated + // memory to the actually used byte-length. + if (buffer->isResizable()) { + auto* resizableBuffer = &buffer->as<ResizableArrayBufferObject>(); + size_t byteLength = resizableBuffer->byteLength(); + size_t maxByteLength = resizableBuffer->maxByteLength(); + MOZ_ASSERT(byteLength <= maxByteLength); + + if (byteLength < maxByteLength) { + auto newData = ReallocateArrayBufferContents( + cx, stolenData, maxByteLength, byteLength); + if (!newData) { + // If reallocation failed, the old pointer is still valid. The + // ArrayBuffer isn't detached and still owns the malloc'ed memory. + return nullptr; + } + + // The following code must be infallible, because the data pointer of + // |buffer| is possibly no longer valid after the above realloc. + + stolenData = newData.release(); + } + } + + RemoveCellMemory(buffer, buffer->associatedBytes(), + MemoryUse::ArrayBufferContents); + + // Overwrite the old data pointer *without* releasing the contents + // being stolen. + buffer->setDataPointer(BufferContents::createNoData()); + + // Detach |buffer| now that doing so won't free |stolenData|. + ArrayBufferObject::detach(cx, buffer); + return stolenData; + } + + case INLINE_DATA: + case NO_DATA: + case USER_OWNED: + case MAPPED: + case EXTERNAL: { + // We can't use these data types directly. Make a copy to return. + ArrayBufferContents copiedData = NewCopiedBufferContents(cx, buffer); + if (!copiedData) { + return nullptr; + } + + // Detach |buffer|. This immediately releases the currently owned + // contents, freeing or unmapping data in the MAPPED and EXTERNAL cases. + ArrayBufferObject::detach(cx, buffer); + return copiedData.release(); + } + + case WASM: + MOZ_ASSERT_UNREACHABLE( + "wasm buffers aren't stealable except by a " + "memory.grow operation that shouldn't call this " + "function"); + return nullptr; + } + + MOZ_ASSERT_UNREACHABLE("garbage kind computed"); + return nullptr; +} + +/* static */ ArrayBufferObject::BufferContents +ArrayBufferObject::extractStructuredCloneContents( + JSContext* cx, Handle<ArrayBufferObject*> buffer) { + if (buffer->isLengthPinned()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_LENGTH_PINNED); + return BufferContents::createFailed(); + } + + CheckStealPreconditions(buffer, cx); + + // We don't yet support extracting the contents of resizable buffers. + MOZ_ASSERT(!buffer->isResizable(), + "extracting the contents of resizable buffers not supported"); + + BufferContents contents = buffer->contents(); + + switch (contents.kind()) { + case INLINE_DATA: + case NO_DATA: + case USER_OWNED: { + ArrayBufferContents copiedData = NewCopiedBufferContents(cx, buffer); + if (!copiedData) { + return BufferContents::createFailed(); + } + + ArrayBufferObject::detach(cx, buffer); + return BufferContents::createMallocedArrayBufferContentsArena( + copiedData.release()); + } + + case MALLOCED_ARRAYBUFFER_CONTENTS_ARENA: + case MALLOCED_UNKNOWN_ARENA: + case MAPPED: { + MOZ_ASSERT(contents); + + RemoveCellMemory(buffer, buffer->associatedBytes(), + MemoryUse::ArrayBufferContents); + + // Overwrite the old data pointer *without* releasing old data. + buffer->setDataPointer(BufferContents::createNoData()); + + // Detach |buffer| now that doing so won't release |oldContents|. + ArrayBufferObject::detach(cx, buffer); + return contents; + } + + case WASM: + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_WASM_NO_TRANSFER); + return BufferContents::createFailed(); + + case EXTERNAL: + MOZ_ASSERT_UNREACHABLE( + "external ArrayBuffer shouldn't have passed the " + "structured-clone preflighting"); + break; + } + + MOZ_ASSERT_UNREACHABLE("garbage kind computed"); + return BufferContents::createFailed(); +} + +/* static */ +bool ArrayBufferObject::ensureNonInline(JSContext* cx, + Handle<ArrayBufferObject*> buffer) { + if (buffer->isDetached() || buffer->isPreparedForAsmJS()) { + return true; + } + + if (buffer->isLengthPinned()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_LENGTH_PINNED); + return false; + } + + BufferContents inlineContents = buffer->contents(); + if (inlineContents.kind() != INLINE_DATA) { + return true; + } + + size_t nbytes = buffer->byteLength(); + ArrayBufferContents copy = NewCopiedBufferContents(cx, buffer); + if (!copy) { + return false; + } + BufferContents outOfLineContents = + BufferContents::createMallocedArrayBufferContentsArena(copy.release()); + buffer->setDataPointer(outOfLineContents); + AddCellMemory(buffer, nbytes, MemoryUse::ArrayBufferContents); + + if (!buffer->firstView()) { + return true; // No views! Easy! + } + + buffer->firstView()->as<ArrayBufferViewObject>().notifyBufferMoved( + inlineContents.data(), outOfLineContents.data()); + + auto& innerViews = ObjectRealm::get(buffer).innerViews.get(); + if (InnerViewTable::ViewVector* views = + innerViews.maybeViewsUnbarriered(buffer)) { + for (JSObject* view : *views) { + view->as<ArrayBufferViewObject>().notifyBufferMoved( + inlineContents.data(), outOfLineContents.data()); + } + } + + return true; +} + +/* static */ +void ArrayBufferObject::addSizeOfExcludingThis( + JSObject* obj, mozilla::MallocSizeOf mallocSizeOf, JS::ClassInfo* info, + JS::RuntimeSizes* runtimeSizes) { + auto& buffer = obj->as<ArrayBufferObject>(); + switch (buffer.bufferKind()) { + case INLINE_DATA: + // Inline data's size should be reported by this object's size-class + // reporting. + break; + case MALLOCED_ARRAYBUFFER_CONTENTS_ARENA: + case MALLOCED_UNKNOWN_ARENA: + if (buffer.isPreparedForAsmJS()) { + info->objectsMallocHeapElementsAsmJS += + mallocSizeOf(buffer.dataPointer()); + } else { + info->objectsMallocHeapElementsNormal += + mallocSizeOf(buffer.dataPointer()); + } + break; + case NO_DATA: + // No data is no memory. + MOZ_ASSERT(buffer.dataPointer() == nullptr); + break; + case USER_OWNED: + // User-owned data should be accounted for by the user. + break; + case EXTERNAL: + // External data will be accounted for by the owner of the buffer, + // not this view. + break; + case MAPPED: + info->objectsNonHeapElementsNormal += buffer.byteLength(); + break; + case WASM: + if (!buffer.isDetached()) { + info->objectsNonHeapElementsWasm += buffer.byteLength(); + if (runtimeSizes) { + MOZ_ASSERT(buffer.wasmMappedSize() >= buffer.byteLength()); + runtimeSizes->wasmGuardPages += + buffer.wasmMappedSize() - buffer.byteLength(); + } + } + break; + } +} + +/* static */ +void ArrayBufferObject::finalize(JS::GCContext* gcx, JSObject* obj) { + obj->as<ArrayBufferObject>().releaseData(gcx); +} + +/* static */ +void ArrayBufferObject::copyData(ArrayBufferObject* toBuffer, size_t toIndex, + ArrayBufferObject* fromBuffer, + size_t fromIndex, size_t count) { + MOZ_ASSERT(!toBuffer->isDetached()); + MOZ_ASSERT(toBuffer->byteLength() >= count); + MOZ_ASSERT(toBuffer->byteLength() >= toIndex + count); + MOZ_ASSERT(!fromBuffer->isDetached()); + MOZ_ASSERT(fromBuffer->byteLength() >= fromIndex); + MOZ_ASSERT(fromBuffer->byteLength() >= fromIndex + count); + + memcpy(toBuffer->dataPointer() + toIndex, + fromBuffer->dataPointer() + fromIndex, count); +} + +template <class ArrayBufferType> +/* static */ +size_t ArrayBufferObject::objectMoved(JSObject* obj, JSObject* old) { + auto& dst = obj->as<ArrayBufferType>(); + const auto& src = old->as<ArrayBufferType>(); + + MOZ_ASSERT( + !obj->runtimeFromMainThread()->gc.nursery().isInside(src.dataPointer())); + + // Fix up possible inline data pointer. + if (src.hasInlineData()) { + dst.setFixedSlot(DATA_SLOT, PrivateValue(dst.inlineDataPointer())); + } + + return 0; +} + +JSObject* ArrayBufferObject::firstView() { + return getFixedSlot(FIRST_VIEW_SLOT).isObject() + ? &getFixedSlot(FIRST_VIEW_SLOT).toObject() + : nullptr; +} + +void ArrayBufferObject::setFirstView(ArrayBufferViewObject* view) { + setFixedSlot(FIRST_VIEW_SLOT, ObjectOrNullValue(view)); +} + +bool ArrayBufferObject::addView(JSContext* cx, ArrayBufferViewObject* view) { + if (!firstView()) { + setFirstView(view); + return true; + } + + return ObjectRealm::get(this).innerViews.get().addView(cx, this, view); +} + +#if defined(DEBUG) || defined(JS_JITSPEW) + +template <typename KnownF, typename UnknownF> +void BufferKindToString(ArrayBufferObject::BufferKind kind, KnownF known, + UnknownF unknown) { + switch (kind) { + case ArrayBufferObject::BufferKind::INLINE_DATA: + known("INLINE_DATA"); + break; + case ArrayBufferObject::BufferKind::MALLOCED_ARRAYBUFFER_CONTENTS_ARENA: + known("MALLOCED_ARRAYBUFFER_CONTENTS_ARENA"); + break; + case ArrayBufferObject::BufferKind::NO_DATA: + known("NO_DATA"); + break; + case ArrayBufferObject::BufferKind::USER_OWNED: + known("USER_OWNED"); + break; + case ArrayBufferObject::BufferKind::WASM: + known("WASM"); + break; + case ArrayBufferObject::BufferKind::MAPPED: + known("MAPPED"); + break; + case ArrayBufferObject::BufferKind::EXTERNAL: + known("EXTERNAL"); + break; + case ArrayBufferObject::BufferKind::MALLOCED_UNKNOWN_ARENA: + known("MALLOCED_UNKNOWN_ARENA"); + break; + default: + unknown(uint8_t(kind)); + break; + } +} + +template <typename KnownF, typename UnknownF> +void ForEachArrayBufferFlag(uint32_t flags, KnownF known, UnknownF unknown) { + for (uint32_t i = ArrayBufferObject::ArrayBufferFlags::BUFFER_KIND_MASK + 1; + i; i = i << 1) { + if (!(flags & i)) { + continue; + } + switch (ArrayBufferObject::ArrayBufferFlags(flags & i)) { + case ArrayBufferObject::ArrayBufferFlags::DETACHED: + known("DETACHED"); + break; + case ArrayBufferObject::ArrayBufferFlags::FOR_ASMJS: + known("FOR_ASMJS"); + break; + default: + unknown(i); + break; + } + } +} + +void ArrayBufferObject::dumpOwnFields(js::JSONPrinter& json) const { + json.formatProperty("byteLength", "%zu", + size_t(getFixedSlot(BYTE_LENGTH_SLOT).toPrivate())); + + BufferKindToString( + bufferKind(), + [&](const char* name) { json.property("bufferKind", name); }, + [&](uint8_t value) { + json.formatProperty("bufferKind", "Unknown(%02x)", value); + }); + + json.beginInlineListProperty("flags"); + ForEachArrayBufferFlag( + flags(), [&](const char* name) { json.value("%s", name); }, + [&](uint32_t value) { json.value("Unknown(%08x)", value); }); + json.endInlineList(); + + void* data = dataPointer(); + if (data) { + json.formatProperty("data", "0x%p", data); + } else { + json.nullProperty("data"); + } +} + +void ArrayBufferObject::dumpOwnStringContent(js::GenericPrinter& out) const { + out.printf("byteLength=%zu, ", + size_t(getFixedSlot(BYTE_LENGTH_SLOT).toPrivate())); + + BufferKindToString( + bufferKind(), + [&](const char* name) { out.printf("bufferKind=%s, ", name); }, + [&](uint8_t value) { out.printf("bufferKind=Unknown(%02x), ", value); }); + + out.printf("flags=["); + bool first = true; + ForEachArrayBufferFlag( + flags(), + [&](const char* name) { + if (!first) { + out.put(","); + } + first = false; + out.put(name); + }, + [&](uint32_t value) { + if (!first) { + out.put(","); + } + first = false; + out.printf("Unknown(%08x)", value); + }); + out.put("], "); + + void* data = dataPointer(); + if (data) { + out.printf("data=0x%p", data); + } else { + out.put("data=null"); + } +} +#endif + +/* + * InnerViewTable + */ + +inline bool InnerViewTable::Views::empty() { return views.empty(); } + +inline bool InnerViewTable::Views::hasNurseryViews() { + return firstNurseryView < views.length(); +} + +bool InnerViewTable::Views::addView(ArrayBufferViewObject* view) { + // Add the view to the list, ensuring that all nursery views are at end. + + if (!views.append(view)) { + return false; + } + + if (!gc::IsInsideNursery(view)) { + // Move tenured views before |firstNurseryView|. + if (firstNurseryView != views.length() - 1) { + std::swap(views[firstNurseryView], views.back()); + } + firstNurseryView++; + } + + check(); + + return true; +} + +bool InnerViewTable::Views::sweepAfterMinorGC(JSTracer* trc) { + return traceWeak(trc, firstNurseryView); +} + +bool InnerViewTable::Views::traceWeak(JSTracer* trc, size_t startIndex) { + // Use |trc| to trace the view vector from |startIndex| to the end, removing + // dead views and updating |firstNurseryView|. + + size_t index = startIndex; + bool sawNurseryView = false; + views.mutableEraseIf( + [&](auto& view) { + if (!JS::GCPolicy<ViewVector::ElementType>::traceWeak(trc, &view)) { + return true; + } + + if (!sawNurseryView && gc::IsInsideNursery(view)) { + sawNurseryView = true; + firstNurseryView = index; + } + + index++; + return false; + }, + startIndex); + + if (!sawNurseryView) { + firstNurseryView = views.length(); + } + + check(); + + return !views.empty(); +} + +inline void InnerViewTable::Views::check() { +#ifdef DEBUG + MOZ_ASSERT(firstNurseryView <= views.length()); + if (views.length() < 100) { + for (size_t i = 0; i < views.length(); i++) { + MOZ_ASSERT(gc::IsInsideNursery(views[i]) == (i >= firstNurseryView)); + } + } +#endif +} + +bool InnerViewTable::addView(JSContext* cx, ArrayBufferObject* buffer, + ArrayBufferViewObject* view) { + // ArrayBufferObject entries are only added when there are multiple views. + MOZ_ASSERT(buffer->firstView()); + MOZ_ASSERT(!gc::IsInsideNursery(buffer)); + + // Ensure the buffer is present in the map, getting the list of views. + auto ptr = map.lookupForAdd(buffer); + if (!ptr && !map.add(ptr, buffer, Views(cx->zone()))) { + ReportOutOfMemory(cx); + return false; + } + Views& views = ptr->value(); + + bool isNurseryView = gc::IsInsideNursery(view); + bool hadNurseryViews = views.hasNurseryViews(); + if (!views.addView(view)) { + ReportOutOfMemory(cx); + return false; + } + + // If we added the first nursery view, add the buffer to the list of buffers + // which have nursery views. + if (isNurseryView && !hadNurseryViews && nurseryKeysValid) { +#ifdef DEBUG + if (nurseryKeys.length() < 100) { + for (auto* key : nurseryKeys) { + MOZ_ASSERT(key != buffer); + } + } +#endif + if (!nurseryKeys.append(buffer)) { + nurseryKeysValid = false; + } + } + + return true; +} + +InnerViewTable::ViewVector* InnerViewTable::maybeViewsUnbarriered( + ArrayBufferObject* buffer) { + auto ptr = map.lookup(buffer); + if (ptr) { + return &ptr->value().views; + } + return nullptr; +} + +void InnerViewTable::removeViews(ArrayBufferObject* buffer) { + auto ptr = map.lookup(buffer); + MOZ_ASSERT(ptr); + + map.remove(ptr); +} + +bool InnerViewTable::traceWeak(JSTracer* trc) { return map.traceWeak(trc); } + +void InnerViewTable::sweepAfterMinorGC(JSTracer* trc) { + MOZ_ASSERT(needsSweepAfterMinorGC()); + + if (nurseryKeysValid) { + for (size_t i = 0; i < nurseryKeys.length(); i++) { + ArrayBufferObject* buffer = nurseryKeys[i]; + MOZ_ASSERT(!gc::IsInsideNursery(buffer)); + auto ptr = map.lookup(buffer); + if (ptr && !ptr->value().sweepAfterMinorGC(trc)) { + map.remove(ptr); + } + } + } else { + for (ArrayBufferViewMap::Enum e(map); !e.empty(); e.popFront()) { + MOZ_ASSERT(!gc::IsInsideNursery(e.front().key())); + if (!e.front().value().sweepAfterMinorGC(trc)) { + e.removeFront(); + } + } + } + + nurseryKeys.clear(); + nurseryKeysValid = true; +} + +size_t InnerViewTable::sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) { + size_t vectorSize = 0; + for (auto r = map.all(); !r.empty(); r.popFront()) { + vectorSize += r.front().value().views.sizeOfExcludingThis(mallocSizeOf); + } + + return vectorSize + map.shallowSizeOfExcludingThis(mallocSizeOf) + + nurseryKeys.sizeOfExcludingThis(mallocSizeOf); +} + +template <> +bool JSObject::is<js::ArrayBufferObjectMaybeShared>() const { + return is<ArrayBufferObject>() || is<SharedArrayBufferObject>(); +} + +JS_PUBLIC_API size_t JS::GetArrayBufferByteLength(JSObject* obj) { + ArrayBufferObject* aobj = obj->maybeUnwrapAs<ArrayBufferObject>(); + return aobj ? aobj->byteLength() : 0; +} + +JS_PUBLIC_API uint8_t* JS::GetArrayBufferData(JSObject* obj, + bool* isSharedMemory, + const JS::AutoRequireNoGC&) { + ArrayBufferObject* aobj = obj->maybeUnwrapIf<ArrayBufferObject>(); + if (!aobj) { + return nullptr; + } + *isSharedMemory = false; + return aobj->dataPointer(); +} + +static ArrayBufferObject* UnwrapOrReportArrayBuffer( + JSContext* cx, JS::Handle<JSObject*> maybeArrayBuffer) { + JSObject* obj = CheckedUnwrapStatic(maybeArrayBuffer); + if (!obj) { + ReportAccessDenied(cx); + return nullptr; + } + + if (!obj->is<ArrayBufferObject>()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_REQUIRED); + return nullptr; + } + + return &obj->as<ArrayBufferObject>(); +} + +JS_PUBLIC_API bool JS::DetachArrayBuffer(JSContext* cx, HandleObject obj) { + AssertHeapIsIdle(); + CHECK_THREAD(cx); + cx->check(obj); + + Rooted<ArrayBufferObject*> unwrappedBuffer( + cx, UnwrapOrReportArrayBuffer(cx, obj)); + if (!unwrappedBuffer) { + return false; + } + + if (unwrappedBuffer->hasDefinedDetachKey()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_WASM_NO_TRANSFER); + return false; + } + if (unwrappedBuffer->isLengthPinned()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_LENGTH_PINNED); + return false; + } + + AutoRealm ar(cx, unwrappedBuffer); + ArrayBufferObject::detach(cx, unwrappedBuffer); + return true; +} + +JS_PUBLIC_API bool JS::HasDefinedArrayBufferDetachKey(JSContext* cx, + HandleObject obj, + bool* isDefined) { + Rooted<ArrayBufferObject*> unwrappedBuffer( + cx, UnwrapOrReportArrayBuffer(cx, obj)); + if (!unwrappedBuffer) { + return false; + } + + *isDefined = unwrappedBuffer->hasDefinedDetachKey(); + return true; +} + +JS_PUBLIC_API bool JS::IsDetachedArrayBufferObject(JSObject* obj) { + ArrayBufferObject* aobj = obj->maybeUnwrapIf<ArrayBufferObject>(); + if (!aobj) { + return false; + } + + return aobj->isDetached(); +} + +JS_PUBLIC_API JSObject* JS::NewArrayBuffer(JSContext* cx, size_t nbytes) { + AssertHeapIsIdle(); + CHECK_THREAD(cx); + + return ArrayBufferObject::createZeroed(cx, nbytes); +} + +JS_PUBLIC_API JSObject* JS::NewArrayBufferWithContents( + JSContext* cx, size_t nbytes, + mozilla::UniquePtr<void, JS::FreePolicy> contents) { + auto* result = NewArrayBufferWithContents( + cx, nbytes, contents.get(), + JS::NewArrayBufferOutOfMemory::CallerMustFreeMemory); + if (result) { + // If and only if an ArrayBuffer is successfully created, ownership of + // |contents| is transferred to the new ArrayBuffer. + (void)contents.release(); + } + return result; +} + +JS_PUBLIC_API JSObject* JS::NewArrayBufferWithContents( + JSContext* cx, size_t nbytes, void* data, NewArrayBufferOutOfMemory) { + AssertHeapIsIdle(); + CHECK_THREAD(cx); + MOZ_ASSERT_IF(!data, nbytes == 0); + + if (!data) { + // Don't pass nulled contents to |createForContents|. + return ArrayBufferObject::createZeroed(cx, 0); + } + + using BufferContents = ArrayBufferObject::BufferContents; + + BufferContents contents = BufferContents::createMallocedUnknownArena(data); + return ArrayBufferObject::createForContents(cx, nbytes, contents); +} + +JS_PUBLIC_API JSObject* JS::CopyArrayBuffer(JSContext* cx, + Handle<JSObject*> arrayBuffer) { + AssertHeapIsIdle(); + CHECK_THREAD(cx); + + MOZ_ASSERT(arrayBuffer != nullptr); + + Rooted<ArrayBufferObject*> unwrappedSource( + cx, UnwrapOrReportArrayBuffer(cx, arrayBuffer)); + if (!unwrappedSource) { + return nullptr; + } + + if (unwrappedSource->isDetached()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_DETACHED); + return nullptr; + } + + return ArrayBufferObject::copy(cx, unwrappedSource->byteLength(), + unwrappedSource); +} + +JS_PUBLIC_API JSObject* JS::NewExternalArrayBuffer( + JSContext* cx, size_t nbytes, + mozilla::UniquePtr<void, JS::BufferContentsDeleter> contents) { + AssertHeapIsIdle(); + CHECK_THREAD(cx); + + MOZ_ASSERT(contents); + + using BufferContents = ArrayBufferObject::BufferContents; + + BufferContents bufferContents = BufferContents::createExternal( + contents.get(), contents.get_deleter().freeFunc(), + contents.get_deleter().userData()); + auto* result = + ArrayBufferObject::createForContents(cx, nbytes, bufferContents); + if (result) { + // If and only if an ArrayBuffer is successfully created, ownership of + // |contents| is transferred to the new ArrayBuffer. + (void)contents.release(); + } + return result; +} + +JS_PUBLIC_API JSObject* JS::NewArrayBufferWithUserOwnedContents(JSContext* cx, + size_t nbytes, + void* data) { + AssertHeapIsIdle(); + CHECK_THREAD(cx); + + MOZ_ASSERT(data); + + using BufferContents = ArrayBufferObject::BufferContents; + + BufferContents contents = BufferContents::createUserOwned(data); + return ArrayBufferObject::createForContents(cx, nbytes, contents); +} + +JS_PUBLIC_API bool JS::IsArrayBufferObject(JSObject* obj) { + return obj->canUnwrapAs<ArrayBufferObject>(); +} + +JS_PUBLIC_API bool JS::ArrayBufferHasData(JSObject* obj) { + return !obj->unwrapAs<ArrayBufferObject>().isDetached(); +} + +JS_PUBLIC_API JSObject* JS::UnwrapArrayBuffer(JSObject* obj) { + return obj->maybeUnwrapIf<ArrayBufferObject>(); +} + +JS_PUBLIC_API JSObject* JS::UnwrapSharedArrayBuffer(JSObject* obj) { + return obj->maybeUnwrapIf<SharedArrayBufferObject>(); +} + +JS_PUBLIC_API void* JS::StealArrayBufferContents(JSContext* cx, + HandleObject obj) { + AssertHeapIsIdle(); + CHECK_THREAD(cx); + cx->check(obj); + + Rooted<ArrayBufferObject*> unwrappedBuffer( + cx, UnwrapOrReportArrayBuffer(cx, obj)); + if (!unwrappedBuffer) { + return nullptr; + } + + if (unwrappedBuffer->isDetached()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_DETACHED); + return nullptr; + } + if (unwrappedBuffer->isLengthPinned()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_LENGTH_PINNED); + return nullptr; + } + + if (unwrappedBuffer->hasDefinedDetachKey()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_WASM_NO_TRANSFER); + return nullptr; + } + + AutoRealm ar(cx, unwrappedBuffer); + return ArrayBufferObject::stealMallocedContents(cx, unwrappedBuffer); +} + +JS_PUBLIC_API JSObject* JS::NewMappedArrayBufferWithContents(JSContext* cx, + size_t nbytes, + void* data) { + AssertHeapIsIdle(); + CHECK_THREAD(cx); + + MOZ_ASSERT(data); + + using BufferContents = ArrayBufferObject::BufferContents; + + BufferContents contents = BufferContents::createMapped(data); + return ArrayBufferObject::createForContents(cx, nbytes, contents); +} + +JS_PUBLIC_API void* JS::CreateMappedArrayBufferContents(int fd, size_t offset, + size_t length) { + return ArrayBufferObject::createMappedContents(fd, offset, length).data(); +} + +JS_PUBLIC_API void JS::ReleaseMappedArrayBufferContents(void* contents, + size_t length) { + gc::DeallocateMappedContent(contents, length); +} + +JS_PUBLIC_API bool JS::IsMappedArrayBufferObject(JSObject* obj) { + ArrayBufferObject* aobj = obj->maybeUnwrapIf<ArrayBufferObject>(); + if (!aobj) { + return false; + } + + return aobj->isMapped(); +} + +JS_PUBLIC_API JSObject* JS::GetObjectAsArrayBuffer(JSObject* obj, + size_t* length, + uint8_t** data) { + ArrayBufferObject* aobj = obj->maybeUnwrapIf<ArrayBufferObject>(); + if (!aobj) { + return nullptr; + } + + *length = aobj->byteLength(); + *data = aobj->dataPointer(); + + return aobj; +} + +JS_PUBLIC_API void JS::GetArrayBufferLengthAndData(JSObject* obj, + size_t* length, + bool* isSharedMemory, + uint8_t** data) { + auto& aobj = obj->as<ArrayBufferObject>(); + *length = aobj.byteLength(); + *data = aobj.dataPointer(); + *isSharedMemory = false; +} + +const JSClass* const JS::ArrayBuffer::FixedLengthUnsharedClass = + &FixedLengthArrayBufferObject::class_; +const JSClass* const JS::ArrayBuffer::ResizableUnsharedClass = + &ResizableArrayBufferObject::class_; +const JSClass* const JS::ArrayBuffer::FixedLengthSharedClass = + &FixedLengthSharedArrayBufferObject::class_; +const JSClass* const JS::ArrayBuffer::GrowableSharedClass = + &GrowableSharedArrayBufferObject::class_; + +/* static */ JS::ArrayBuffer JS::ArrayBuffer::create(JSContext* cx, + size_t nbytes) { + AssertHeapIsIdle(); + CHECK_THREAD(cx); + return JS::ArrayBuffer(ArrayBufferObject::createZeroed(cx, nbytes)); +} + +mozilla::Span<uint8_t> JS::ArrayBuffer::getData( + bool* isSharedMemory, const JS::AutoRequireNoGC& nogc) { + auto* buffer = obj->maybeUnwrapAs<ArrayBufferObjectMaybeShared>(); + if (!buffer) { + return nullptr; + } + size_t length = buffer->byteLength(); + if (buffer->is<SharedArrayBufferObject>()) { + *isSharedMemory = true; + return {buffer->dataPointerEither().unwrap(), length}; + } + *isSharedMemory = false; + return {buffer->as<ArrayBufferObject>().dataPointer(), length}; +}; + +JS::ArrayBuffer JS::ArrayBuffer::unwrap(JSObject* maybeWrapped) { + if (!maybeWrapped) { + return JS::ArrayBuffer(nullptr); + } + auto* ab = maybeWrapped->maybeUnwrapIf<ArrayBufferObjectMaybeShared>(); + return fromObject(ab); +} + +bool JS::ArrayBufferCopyData(JSContext* cx, Handle<JSObject*> toBlock, + size_t toIndex, Handle<JSObject*> fromBlock, + size_t fromIndex, size_t count) { + Rooted<ArrayBufferObjectMaybeShared*> unwrappedToBlock( + cx, toBlock->maybeUnwrapIf<ArrayBufferObjectMaybeShared>()); + if (!unwrappedToBlock) { + ReportAccessDenied(cx); + return false; + } + + Rooted<ArrayBufferObjectMaybeShared*> unwrappedFromBlock( + cx, fromBlock->maybeUnwrapIf<ArrayBufferObjectMaybeShared>()); + if (!unwrappedFromBlock) { + ReportAccessDenied(cx); + return false; + } + + // Verify that lengths still make sense and throw otherwise. + if (toIndex + count < toIndex || // size_t overflow + fromIndex + count < fromIndex || // size_t overflow + toIndex + count > unwrappedToBlock->byteLength() || + fromIndex + count > unwrappedFromBlock->byteLength()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_ARRAYBUFFER_COPY_RANGE); + return false; + } + + // If both are array buffers, can use ArrayBufferCopyData + if (unwrappedToBlock->is<ArrayBufferObject>() && + unwrappedFromBlock->is<ArrayBufferObject>()) { + Rooted<ArrayBufferObject*> toArray( + cx, &unwrappedToBlock->as<ArrayBufferObject>()); + Rooted<ArrayBufferObject*> fromArray( + cx, &unwrappedFromBlock->as<ArrayBufferObject>()); + ArrayBufferObject::copyData(toArray, toIndex, fromArray, fromIndex, count); + return true; + } + + Rooted<ArrayBufferObjectMaybeShared*> toArray( + cx, &unwrappedToBlock->as<ArrayBufferObjectMaybeShared>()); + Rooted<ArrayBufferObjectMaybeShared*> fromArray( + cx, &unwrappedFromBlock->as<ArrayBufferObjectMaybeShared>()); + SharedArrayBufferObject::copyData(toArray, toIndex, fromArray, fromIndex, + count); + + return true; +} + +// https://tc39.es/ecma262/#sec-clonearraybuffer +// We only support the case where cloneConstructor is %ArrayBuffer%. Note, +// this means that cloning a SharedArrayBuffer will produce an ArrayBuffer +JSObject* JS::ArrayBufferClone(JSContext* cx, Handle<JSObject*> srcBuffer, + size_t srcByteOffset, size_t srcLength) { + MOZ_ASSERT(srcBuffer->is<ArrayBufferObjectMaybeShared>()); + + // 2. (reordered) If IsDetachedBuffer(srcBuffer) is true, throw a TypeError + // exception. + if (IsDetachedArrayBufferObject(srcBuffer)) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_DETACHED); + return nullptr; + } + + // 1. Let targetBuffer be ? AllocateArrayBuffer(cloneConstructor, srcLength). + JS::RootedObject targetBuffer(cx, JS::NewArrayBuffer(cx, srcLength)); + if (!targetBuffer) { + return nullptr; + } + + // 3. Let srcBlock be srcBuffer.[[ArrayBufferData]]. + // 4. Let targetBlock be targetBuffer.[[ArrayBufferData]]. + // 5. Perform CopyDataBlockBytes(targetBlock, 0, srcBlock, srcByteOffset, + // srcLength). + if (!ArrayBufferCopyData(cx, targetBuffer, 0, srcBuffer, srcByteOffset, + srcLength)) { + return nullptr; + } + + // 6. Return targetBuffer. + return targetBuffer; +} |