TypedArray's .buffer does not return the JSArrayBuffer that was passed to it on creation.

• Component: JavaScriptCore
• Status: RESOLVED CONFIGURATION CHANGED

[Keith Miller]

For example:

buffer = new ArrayBuffer(16);
array = new Int32Array(buffer);
return array.buffer == buffer;

will return false.

[Keith Miller]

Created attachment 269374 [details]
Patch

[Geoffrey Garen]

Comment on attachment 269374 [details]
Patch

r=me

[WebKit Commit Bot]

Comment on attachment 269374 [details]
Patch

Clearing flags on attachment: 269374

Committed r195375: <http://trac.webkit.org/changeset/195375>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Alexey Proskuryakov]

I think that this has caused many crashes on GuardMalloc bots. The range is pretty large (r195374-195392), but this patch seems most relevant. Will try rolling out.

+fast/canvas/webgl/typed-arrays-in-workers.html	crash log sample	history
+fast/workers/worker-terminate-forever.html	crash log sample	history
+http/tests/websocket/tests/hybi/workers/receive-arraybuffer.html	crash log sample	history
+http/tests/websocket/tests/hybi/workers/receive-blob.html	crash log sample	history
+http/tests/websocket/tests/hybi/workers/send-arraybufferview.html	crash log sample	history
+imported/blink/fast/workers/worker-shared-asm-buffer.html	crash log sample	history
+webgl/1.0.2/conformance/typedarrays/typed-arrays-in-workers.html	crash log sample	history

Thread 23 Crashed:: WebCore: Worker
0   com.apple.JavaScriptCore      	0x000000011c5d2a17 JSC::weakClearSlowCase(JSC::WeakImpl*&) + 7
1   com.apple.JavaScriptCore      	0x000000011cbcca45 WTF::DeferrableRefCounted<JSC::ArrayBuffer>::setIsDeferred(bool) + 53
2   com.apple.JavaScriptCore      	0x000000011cbcc9e5 bool JSC::GCIncomingRefCounted<JSC::ArrayBuffer>::filterIncomingReferences<bool (JSC::JSCell*)>(bool (&)(JSC::JSCell*)) + 293
3   com.apple.JavaScriptCore      	0x000000011c766d4f JSC::Heap::~Heap() + 1679
4   com.apple.JavaScriptCore      	0x000000011c762fbd JSC::VM::~VM() + 7757
5   com.apple.JavaScriptCore      	0x000000011c5ccce2 JSC::JSLockHolder::~JSLockHolder() + 66
6   com.apple.WebCore             	0x000000011e310ee4 WebCore::WorkerScriptController::~WorkerScriptController() + 148
7   com.apple.WebCore             	0x000000011e3133e5 std::__1::__function::__func<WebCore::WorkerThread::stop()::$_0::operator()(WebCore::ScriptExecutionContext&) const::'lambda'(WebCore::ScriptExecutionContext&), std::__1::allocator<WebCore::WorkerThread::stop()::$_0::operator()(WebCore::ScriptExecutionContext&) const::'lambda'(WebCore::ScriptExecutionContext&)>, void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) + 37
8   com.apple.WebCore             	0x000000011e30fd6f WebCore::WorkerRunLoop::runCleanupTasks(WebCore::WorkerGlobalScope*) + 207

[WebKit Commit Bot]

Re-opened since this is blocked by bug 153300

[Anne van Kesteren]

This can't really be broken at this point.