Fix bug when transferring SharedArrayBuffer to multiple Workers.

src/d8.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 
 // Defined when linking against shared lib on Windows.
 #if defined(USING_V8_SHARED) && !defined(V8_SHARED)
 #define V8_SHARED
 #endif
 
@@ skipping 1515 matching lines @@
   if (thread_ == NULL) return;
   if (Shell::options.last_run) {
     thread_->Join();
   } else {
     done_semaphore_.Wait();
   }
 }
 
 
 SerializationData::~SerializationData() {
-  // Any ArrayBuffer::Contents are owned by this SerializationData object.
-  // SharedArrayBuffer::Contents may be used by other threads, so must be
+  // Any ArrayBuffer::Contents are owned by this SerializationData object if
+  // ownership hasn't been transferred out via ReadArrayBufferContents.
+  // SharedArrayBuffer::Contents may be used by multiple threads, so must be
   // cleaned up by the main thread in Shell::CleanupWorkers().
-  for (int i = 0; i < array_buffer_contents.length(); ++i) {
-    ArrayBuffer::Contents& contents = array_buffer_contents[i];
-    Shell::array_buffer_allocator->Free(contents.Data(), contents.ByteLength());
+  for (int i = 0; i < array_buffer_contents_.length(); ++i) {
+    ArrayBuffer::Contents& contents = array_buffer_contents_[i];
+    if (contents.Data()) {

[jochen (gone - plz use gerrit), 2015/07/03 14:29:37]

how can data ever be null?

[Jarin, 2015/07/06 05:04:19]

As the comment above says, ReadArrayBufferContents can set the contents to empty
(line 1600). No?

[binji, 2015/07/06 06:23:27]

Yes, that's correct.

+      Shell::array_buffer_allocator->Free(contents.Data(),
+                                          contents.ByteLength());
+    }
   }
 }
 
 
-void SerializationData::WriteTag(SerializationTag tag) { data.Add(tag); }
+void SerializationData::WriteTag(SerializationTag tag) { data_.Add(tag); }
 
 
 void SerializationData::WriteMemory(const void* p, int length) {
   if (length > 0) {
-    i::Vector<uint8_t> block = data.AddBlock(0, length);
+    i::Vector<uint8_t> block = data_.AddBlock(0, length);
     memcpy(&block[0], p, length);
   }
 }
 
 
 void SerializationData::WriteArrayBufferContents(
     const ArrayBuffer::Contents& contents) {
-  array_buffer_contents.Add(contents);
+  array_buffer_contents_.Add(contents);
   WriteTag(kSerializationTagTransferredArrayBuffer);
-  int index = array_buffer_contents.length() - 1;
+  int index = array_buffer_contents_.length() - 1;
   Write(index);
 }
 
 
 void SerializationData::WriteSharedArrayBufferContents(
     const SharedArrayBuffer::Contents& contents) {
-  shared_array_buffer_contents.Add(contents);
+  shared_array_buffer_contents_.Add(contents);
   WriteTag(kSerializationTagTransferredSharedArrayBuffer);
-  int index = shared_array_buffer_contents.length() - 1;
+  int index = shared_array_buffer_contents_.length() - 1;
   Write(index);
 }
 
 
 SerializationTag SerializationData::ReadTag(int* offset) const {
   return static_cast<SerializationTag>(Read<uint8_t>(offset));
 }
 
 
 void SerializationData::ReadMemory(void* p, int length, int* offset) const {
   if (length > 0) {
-    memcpy(p, &data[*offset], length);
+    memcpy(p, &data_[*offset], length);
     (*offset) += length;
   }
 }
 
 
 void SerializationData::ReadArrayBufferContents(ArrayBuffer::Contents* contents,
                                                 int* offset) const {
   int index = Read<int>(offset);
-  DCHECK(index < array_buffer_contents.length());
-  *contents = array_buffer_contents[index];
+  DCHECK(index < array_buffer_contents_.length());
+  *contents = array_buffer_contents_[index];
+  // Ownership of this ArrayBuffer::Contents is passed to the caller. Neuter
+  // our copy so it won't be double-free'd when this SerializationData is
+  // destroyed.
+  array_buffer_contents_[index] = ArrayBuffer::Contents();
 }
 
 
 void SerializationData::ReadSharedArrayBufferContents(
     SharedArrayBuffer::Contents* contents, int* offset) const {
   int index = Read<int>(offset);
-  DCHECK(index < shared_array_buffer_contents.length());
-  *contents = shared_array_buffer_contents[index];
+  DCHECK(index < shared_array_buffer_contents_.length());
+  *contents = shared_array_buffer_contents_[index];
 }
 
 
 void SerializationDataQueue::Enqueue(SerializationData* data) {
   base::LockGuard<base::Mutex> lock_guard(&mutex_);
   data_.Add(data);
 }
 
 
 bool SerializationDataQueue::Dequeue(SerializationData** data) {
@@ skipping 422 matching lines @@
       return false;
     }
     seen_objects->Add(array_buffer);
     if (FindInObjectList(array_buffer, to_transfer)) {
       // Transfer ArrayBuffer
       if (!array_buffer->IsNeuterable()) {
         Throw(isolate, "Attempting to transfer an un-neuterable ArrayBuffer");
         return false;
       }
 
-      ArrayBuffer::Contents contents = array_buffer->Externalize();
+      ArrayBuffer::Contents contents = array_buffer->IsExternal()
+                                           ? array_buffer->GetContents()
+                                           : array_buffer->Externalize();
       array_buffer->Neuter();
       out_data->WriteArrayBufferContents(contents);
     } else {
       ArrayBuffer::Contents contents = array_buffer->GetContents();
       // Clone ArrayBuffer
       if (contents.ByteLength() > i::kMaxUInt32) {
         Throw(isolate, "ArrayBuffer is too big to clone");
         return false;
       }
 
       int byte_length = static_cast<int>(contents.ByteLength());
       out_data->WriteTag(kSerializationTagArrayBuffer);
       out_data->Write(byte_length);
       out_data->WriteMemory(contents.Data(),
                             static_cast<int>(contents.ByteLength()));
     }
   } else if (value->IsSharedArrayBuffer()) {
     Handle<SharedArrayBuffer> sab = Handle<SharedArrayBuffer>::Cast(value);
     if (FindInObjectList(sab, *seen_objects)) {
       Throw(isolate, "Duplicated shared array buffers not supported");
       return false;
     }
     seen_objects->Add(sab);
     if (!FindInObjectList(sab, to_transfer)) {
       Throw(isolate, "SharedArrayBuffer must be transferred");
       return false;
     }
 
-    SharedArrayBuffer::Contents contents = sab->Externalize();
+    SharedArrayBuffer::Contents contents;
+    if (sab->IsExternal()) {
+      contents = sab->GetContents();
+    } else {
+      contents = sab->Externalize();
+      externalized_shared_contents_.Add(contents);
+    }
     out_data->WriteSharedArrayBufferContents(contents);
-    externalized_shared_contents_.Add(contents);
   } else if (value->IsObject()) {
     Handle<Object> object = Handle<Object>::Cast(value);
     if (FindInObjectList(object, *seen_objects)) {
       Throw(isolate, "Duplicated objects not supported");
       return false;
     }
     seen_objects->Add(object);
     Local<Array> property_names;
     if (!object->GetOwnPropertyNames(context).ToLocal(&property_names)) {
       Throw(isolate, "Unable to get property names");
@@ skipping 95 matching lines @@
       Handle<ArrayBuffer> array_buffer = ArrayBuffer::New(isolate, byte_length);
       ArrayBuffer::Contents contents = array_buffer->GetContents();
       DCHECK(static_cast<size_t>(byte_length) == contents.ByteLength());
       data.ReadMemory(contents.Data(), byte_length, offset);
       result = array_buffer;
       break;
     }
     case kSerializationTagTransferredArrayBuffer: {
       ArrayBuffer::Contents contents;
       data.ReadArrayBufferContents(&contents, offset);
-      result =
-          ArrayBuffer::New(isolate, contents.Data(), contents.ByteLength());
+      result = ArrayBuffer::New(isolate, contents.Data(), contents.ByteLength(),
+                                ArrayBufferCreationMode::kInternalized);
       break;
     }
     case kSerializationTagTransferredSharedArrayBuffer: {
       SharedArrayBuffer::Contents contents;
       data.ReadSharedArrayBufferContents(&contents, offset);
       result = SharedArrayBuffer::New(isolate, contents.Data(),
                                       contents.ByteLength());
       break;
     }
     default:
@@ skipping 228 matching lines @@
 }
 
 }  // namespace v8
 
 
 #ifndef GOOGLE3
 int main(int argc, char* argv[]) {
   return v8::Shell::Main(argc, argv);
 }
 #endif