Skip to content

Commit 20b1e6c

Browse files
targosBethGriggs
authored andcommitted
deps: V8: backport dfcf1e86fac0
Original commit message: [wasm] PostMessage of Memory.buffer should throw PostMessage of an ArrayBuffer that is not detachable should result in a DataCloneError. Bug: chromium:1170176, chromium:961059 Change-Id: Ib89bbc10d2b58918067fd1a90365cad10a0db9ec Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2653810 Reviewed-by: Adam Klein <[email protected]> Reviewed-by: Andreas Haas <[email protected]> Commit-Queue: Deepti Gandluri <[email protected]> Cr-Commit-Position: refs/heads/master@{#72415} Refs: v8/v8@dfcf1e8 PR-URL: #37245 Reviewed-By: Daniel Bevenius <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Rich Trott <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Vladimir de Turckheim <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>
1 parent f206505 commit 20b1e6c

File tree

4 files changed

+15
-1
lines changed

4 files changed

+15
-1
lines changed

common.gypi

+1-1
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636

3737
# Reset this number to 0 on major V8 upgrades.
3838
# Increment by one for each non-official patch applied to deps/v8.
39-
'v8_embedder_string': '-node.17',
39+
'v8_embedder_string': '-node.18',
4040

4141
##### V8 defaults for Node.js #####
4242

deps/v8/src/common/message-template.h

+2
Original file line numberDiff line numberDiff line change
@@ -567,6 +567,8 @@ namespace internal {
567567
T(DataCloneErrorOutOfMemory, "Data cannot be cloned, out of memory.") \
568568
T(DataCloneErrorDetachedArrayBuffer, \
569569
"An ArrayBuffer is detached and could not be cloned.") \
570+
T(DataCloneErrorNonDetachableArrayBuffer, \
571+
"ArrayBuffer is not detachable and could not be cloned.") \
570572
T(DataCloneErrorSharedArrayBufferTransferred, \
571573
"A SharedArrayBuffer could not be cloned. SharedArrayBuffer must not be " \
572574
"transferred.") \

deps/v8/src/objects/value-serializer.cc

+5
Original file line numberDiff line numberDiff line change
@@ -860,6 +860,11 @@ Maybe<bool> ValueSerializer::WriteJSArrayBuffer(
860860
WriteVarint(index.FromJust());
861861
return ThrowIfOutOfMemory();
862862
}
863+
if (!array_buffer->is_detachable()) {
864+
ThrowDataCloneError(
865+
MessageTemplate::kDataCloneErrorNonDetachableArrayBuffer);
866+
return Nothing<bool>();
867+
}
863868

864869
uint32_t* transfer_entry = array_buffer_transfer_map_.Find(array_buffer);
865870
if (transfer_entry) {

deps/v8/test/mjsunit/wasm/worker-memory.js

+7
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,13 @@
1111
assertThrows(() => worker.postMessage(memory), Error);
1212
})();
1313

14+
(function TestPostMessageUnsharedMemoryBuffer() {
15+
let worker = new Worker('', {type: 'string'});
16+
let memory = new WebAssembly.Memory({initial: 1, maximum: 2});
17+
18+
assertThrows(() => worker.postMessage(memory.buffer), Error);
19+
})();
20+
1421
// Can't use assert in a worker.
1522
let workerHelpers =
1623
`function assertTrue(value, msg) {

0 commit comments

Comments
 (0)