browsers.fail
← webkit

commit 9e3f76240a0e

Refactoring: rename Options::useSharedArrayBuffer to Options::alwaysUseSharedArrayBuffer.

webkit out-of-bounds heuristic JavaScriptCore

commit message

Refactoring: rename Options::useSharedArrayBuffer to Options::alwaysUseSharedArrayBuffer.
https://bugs.webkit.org/show_bug.cgi?id=330358
rdar://191971055

Reviewed by Anne van Kesteren.

This is done to disambiguate it from Options::allowSharedArrayBuffer.  Also restructure guard
checks in JSGlobalObject::exposeSharedArrayBuffer() to make it clear why we abort if
Options::alwaysUseSharedArrayBuffer is set.

No new tests because there is no behavior change.

* JSTests/test262/config.yaml:
* JSTests/wasm/stress/memory-type-reflects-current-size.js:
* LayoutTests/fast/workers/worker-terminate-atomics-wait.html:
* LayoutTests/fast/workers/worker-terminate-wasm-atomic-wait.html:
* LayoutTests/http/tests/broadcastchannel/postmessage-sharedarraybuffer.html:
* LayoutTests/js/Atomics-waitasync-invocable-on-main-thread.html:
* LayoutTests/js/dom/resizable-array-buffer-serialization.html:
* LayoutTests/js/dom/resizable-array-buffer-should-be-rejected-by-default.html:
* LayoutTests/js/dom/resizable-array-buffer-view-serialization-out-of-bounds-explicit-length.html:
* LayoutTests/js/dom/resizable-array-buffer-view-serialization-out-of-bounds.html:
* LayoutTests/js/dom/resizable-array-buffer-view-serialization.html:
* LayoutTests/js/dom/resizable-data-view-serialization-out-of-bounds-explicit-length.html:
* LayoutTests/js/dom/resizable-data-view-serialization-out-of-bounds.html:
* LayoutTests/js/dom/webassembly-memory-shared-basic.html:
* LayoutTests/js/dom/webassembly-memory-shared-zero-maximum-clone.html:
* LayoutTests/js/regress-311234.html:
* LayoutTests/js/shared-array-buffer-webgl.html:
* LayoutTests/js/structuredClone/structured-clone-of-ResizableSharedArrayBuffer.html:
* LayoutTests/webaudio/dom-exceptions.html:
* LayoutTests/webgl/webgl-allow-shared-typed-array.html:
* LayoutTests/webgl/webgl-allow-shared.html:
* LayoutTests/workers/sab/growable-shared-array-buffer-serialization.html:
* LayoutTests/workers/sab/growable-shared-array-buffer-view-serialization-explicit-length.html:
* LayoutTests/workers/sab/growable-shared-array-buffer-view-serialization.html:
* LayoutTests/workers/sab/postMessage-clones-growable.html:
* LayoutTests/workers/worker-set-delete-terminate-crash.html:
* LayoutTests/workers/worker-terminate-crash.html:
* Source/JavaScriptCore/jsc.cpp:
(CommandLine::parseArguments):
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::exposeSharedArrayBuffer):
* Source/JavaScriptCore/runtime/Options.cpp:
(JSC::disableAllSignalHandlerBasedOptions):
* Source/JavaScriptCore/runtime/OptionsList.h:
* Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.cpp:
(JSC::WebAssemblyMemoryConstructor::createMemoryFromDescriptor):
* Source/WebCore/bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneSerializer::allowsSharedMemorySerialization):
* Tools/Scripts/test262/README.md:
* Tools/Scripts/test262/runner_unittest.py:
(TestGetFeatureFlags.test_basic_feature_flag):
(TestGetFeatureFlags.test_multiple_features):
(TestGetFeatureFlags.test_unmapped_feature):
(TestGetFeatureFlags.test_no_features):
(TestGetFeatureFlags.test_can_block_with_features):
(TestRunJsc.test_feature_flags_in_command):

Canonical link: https://commits.webkit.org/325936@main

files

  • LayoutTests/fast/workers/worker-terminate-atomics-wait.html
  • LayoutTests/fast/workers/worker-terminate-wasm-atomic-wait.html
  • LayoutTests/http/tests/broadcastchannel/postmessage-sharedarraybuffer.html
  • LayoutTests/js/Atomics-waitasync-invocable-on-main-thread.html
  • LayoutTests/js/dom/resizable-array-buffer-serialization.html
  • LayoutTests/js/dom/resizable-array-buffer-should-be-rejected-by-default.html
  • LayoutTests/js/dom/resizable-array-buffer-view-serialization-out-of-bounds-explicit-length.html
  • LayoutTests/js/dom/resizable-array-buffer-view-serialization-out-of-bounds.html
  • LayoutTests/js/dom/resizable-array-buffer-view-serialization.html
  • LayoutTests/js/dom/resizable-data-view-serialization-out-of-bounds-explicit-length.html
  • LayoutTests/js/dom/resizable-data-view-serialization-out-of-bounds.html
  • LayoutTests/js/dom/webassembly-memory-shared-basic.html
  • LayoutTests/js/dom/webassembly-memory-shared-zero-maximum-clone.html
  • LayoutTests/js/regress-311234.html
  • LayoutTests/js/shared-array-buffer-webgl.html
  • LayoutTests/js/structuredClone/structured-clone-of-ResizableSharedArrayBuffer.html
  • LayoutTests/webaudio/dom-exceptions.html
  • LayoutTests/webgl/webgl-allow-shared-typed-array.html
  • LayoutTests/webgl/webgl-allow-shared.html
  • LayoutTests/workers/sab/growable-shared-array-buffer-serialization.html
  • LayoutTests/workers/sab/growable-shared-array-buffer-view-serialization-explicit-length.html
  • LayoutTests/workers/sab/growable-shared-array-buffer-view-serialization.html
  • LayoutTests/workers/sab/postMessage-clones-growable.html
  • LayoutTests/workers/worker-set-delete-terminate-crash.html
  • LayoutTests/workers/worker-terminate-crash.html
  • Source/JavaScriptCore/jsc.cpp
  • Source/JavaScriptCore/runtime/JSGlobalObject.cpp
  • Source/JavaScriptCore/runtime/Options.cpp
  • Source/JavaScriptCore/runtime/OptionsList.h
  • Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.cpp
  • Source/WebCore/bindings/js/SerializedScriptValue.cpp
  • Tools/Scripts/test262/README.md
  • Tools/Scripts/test262/runner_unittest.py

this commit matched a vulnerability pattern in its message. WebKit does not publish a security bug for every fix, so treat it as a lead, not as a CVE record.