Skip to content

Commit 44b2995

Browse files
backesV8 LUCI CQ
backes
authored and
V8 LUCI CQ
committed
Unify TypedArray and ArrayBuffer max byte length
For any ArrayBuffer that we can create in V8, we should also be able to construct a TypedArray from it. This CL thus equalizes the maximum byte length of TypedArrays and ArrayBuffers. Note that this implies that different TypedArrays have different maximum lengths. We thus deprecate the kMaxLength field from v8::TypedArray and instead introduce a kMaxByteLength there, and a type-specific kMaxLength in the different subclasses of v8::TypedArray. This CL also adds a new test which tests all TypedArray methods that can be tested on huge TypedArrays. Those that would need to iterate the whole TypedArray are skipped, because executing them on a multiple GB large TypedArray would just take too long for an mjsunit test. This change might need adaption in embedders if they make any assumptions on maximum TypedArray lengths. Chromium tests are fixed in https://crrev.com/c/4872321 and https://crrev.com/c/4881380. Node tests are fixed in v8/node#161. [email protected] CC=​​​[email protected], [email protected] Bug: v8:4153 Change-Id: Ibda747b20458808ee764fd521281cbd4950e1922 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4872536 Reviewed-by: Thibaud Michaud <[email protected]> Commit-Queue: Clemens Backes <[email protected]> Reviewed-by: Jakob Kummerow <[email protected]> Reviewed-by: Michael Lippautz <[email protected]> Cr-Commit-Position: refs/heads/main@{#90106}
1 parent b633be3 commit 44b2995

26 files changed

+537
-152
lines changed

‎include/v8-typed-array.h

+97-7
Original file line numberDiff line numberDiff line change
@@ -5,27 +5,40 @@
55
#ifndef INCLUDE_V8_TYPED_ARRAY_H_
66
#define INCLUDE_V8_TYPED_ARRAY_H_
77

8+
#include <limits>
9+
810
#include "v8-array-buffer.h" // NOLINT(build/include_directory)
911
#include "v8-local-handle.h" // NOLINT(build/include_directory)
1012
#include "v8config.h" // NOLINT(build/include_directory)
1113

1214
namespace v8 {
1315

14-
class SharedArrayBuffer;
15-
1616
/**
1717
* A base class for an instance of TypedArray series of constructors
1818
* (ES6 draft 15.13.6).
1919
*/
2020
class V8_EXPORT TypedArray : public ArrayBufferView {
2121
public:
2222
/*
23-
* The largest typed array size that can be constructed using New.
23+
* The largest supported typed array byte size. Each subclass defines a
24+
* type-specific kMaxLength for the maximum length that can be passed to New.
2425
*/
25-
static constexpr size_t kMaxLength =
26-
internal::kApiSystemPointerSize == 4
27-
? internal::kSmiMaxValue
28-
: static_cast<size_t>(uint64_t{1} << 32);
26+
#if V8_ENABLE_SANDBOX
27+
static constexpr size_t kMaxByteLength =
28+
internal::kMaxSafeBufferSizeForSandbox;
29+
#elif V8_HOST_ARCH_32_BIT
30+
static constexpr size_t kMaxByteLength = std::numeric_limits<int>::max();
31+
#else
32+
// The maximum safe integer (2^53 - 1).
33+
static constexpr size_t kMaxByteLength =
34+
static_cast<size_t>((uint64_t{1} << 53) - 1);
35+
#endif
36+
37+
/*
38+
* Deprecated: Use |kMaxByteLength| or the type-specific |kMaxLength| fields.
39+
*/
40+
V8_DEPRECATE_SOON("Use kMaxByteLength")
41+
static constexpr size_t kMaxLength = kMaxByteLength;
2942

3043
/**
3144
* Number of elements in this typed array
@@ -50,6 +63,13 @@ class V8_EXPORT TypedArray : public ArrayBufferView {
5063
*/
5164
class V8_EXPORT Uint8Array : public TypedArray {
5265
public:
66+
/*
67+
* The largest Uint8Array size that can be constructed using New.
68+
*/
69+
static constexpr size_t kMaxLength =
70+
TypedArray::kMaxByteLength / sizeof(uint8_t);
71+
static_assert(sizeof(uint8_t) == 1);
72+
5373
static Local<Uint8Array> New(Local<ArrayBuffer> array_buffer,
5474
size_t byte_offset, size_t length);
5575
static Local<Uint8Array> New(Local<SharedArrayBuffer> shared_array_buffer,
@@ -71,6 +91,13 @@ class V8_EXPORT Uint8Array : public TypedArray {
7191
*/
7292
class V8_EXPORT Uint8ClampedArray : public TypedArray {
7393
public:
94+
/*
95+
* The largest Uint8ClampedArray size that can be constructed using New.
96+
*/
97+
static constexpr size_t kMaxLength =
98+
TypedArray::kMaxByteLength / sizeof(uint8_t);
99+
static_assert(sizeof(uint8_t) == 1);
100+
74101
static Local<Uint8ClampedArray> New(Local<ArrayBuffer> array_buffer,
75102
size_t byte_offset, size_t length);
76103
static Local<Uint8ClampedArray> New(
@@ -93,6 +120,13 @@ class V8_EXPORT Uint8ClampedArray : public TypedArray {
93120
*/
94121
class V8_EXPORT Int8Array : public TypedArray {
95122
public:
123+
/*
124+
* The largest Int8Array size that can be constructed using New.
125+
*/
126+
static constexpr size_t kMaxLength =
127+
TypedArray::kMaxByteLength / sizeof(int8_t);
128+
static_assert(sizeof(int8_t) == 1);
129+
96130
static Local<Int8Array> New(Local<ArrayBuffer> array_buffer,
97131
size_t byte_offset, size_t length);
98132
static Local<Int8Array> New(Local<SharedArrayBuffer> shared_array_buffer,
@@ -114,6 +148,13 @@ class V8_EXPORT Int8Array : public TypedArray {
114148
*/
115149
class V8_EXPORT Uint16Array : public TypedArray {
116150
public:
151+
/*
152+
* The largest Uint16Array size that can be constructed using New.
153+
*/
154+
static constexpr size_t kMaxLength =
155+
TypedArray::kMaxByteLength / sizeof(uint16_t);
156+
static_assert(sizeof(uint16_t) == 2);
157+
117158
static Local<Uint16Array> New(Local<ArrayBuffer> array_buffer,
118159
size_t byte_offset, size_t length);
119160
static Local<Uint16Array> New(Local<SharedArrayBuffer> shared_array_buffer,
@@ -135,6 +176,13 @@ class V8_EXPORT Uint16Array : public TypedArray {
135176
*/
136177
class V8_EXPORT Int16Array : public TypedArray {
137178
public:
179+
/*
180+
* The largest Int16Array size that can be constructed using New.
181+
*/
182+
static constexpr size_t kMaxLength =
183+
TypedArray::kMaxByteLength / sizeof(int16_t);
184+
static_assert(sizeof(int16_t) == 2);
185+
138186
static Local<Int16Array> New(Local<ArrayBuffer> array_buffer,
139187
size_t byte_offset, size_t length);
140188
static Local<Int16Array> New(Local<SharedArrayBuffer> shared_array_buffer,
@@ -156,6 +204,13 @@ class V8_EXPORT Int16Array : public TypedArray {
156204
*/
157205
class V8_EXPORT Uint32Array : public TypedArray {
158206
public:
207+
/*
208+
* The largest Uint32Array size that can be constructed using New.
209+
*/
210+
static constexpr size_t kMaxLength =
211+
TypedArray::kMaxByteLength / sizeof(uint32_t);
212+
static_assert(sizeof(uint32_t) == 4);
213+
159214
static Local<Uint32Array> New(Local<ArrayBuffer> array_buffer,
160215
size_t byte_offset, size_t length);
161216
static Local<Uint32Array> New(Local<SharedArrayBuffer> shared_array_buffer,
@@ -177,6 +232,13 @@ class V8_EXPORT Uint32Array : public TypedArray {
177232
*/
178233
class V8_EXPORT Int32Array : public TypedArray {
179234
public:
235+
/*
236+
* The largest Int32Array size that can be constructed using New.
237+
*/
238+
static constexpr size_t kMaxLength =
239+
TypedArray::kMaxByteLength / sizeof(int32_t);
240+
static_assert(sizeof(int32_t) == 4);
241+
180242
static Local<Int32Array> New(Local<ArrayBuffer> array_buffer,
181243
size_t byte_offset, size_t length);
182244
static Local<Int32Array> New(Local<SharedArrayBuffer> shared_array_buffer,
@@ -198,6 +260,13 @@ class V8_EXPORT Int32Array : public TypedArray {
198260
*/
199261
class V8_EXPORT Float32Array : public TypedArray {
200262
public:
263+
/*
264+
* The largest Float32Array size that can be constructed using New.
265+
*/
266+
static constexpr size_t kMaxLength =
267+
TypedArray::kMaxByteLength / sizeof(float);
268+
static_assert(sizeof(float) == 4);
269+
201270
static Local<Float32Array> New(Local<ArrayBuffer> array_buffer,
202271
size_t byte_offset, size_t length);
203272
static Local<Float32Array> New(Local<SharedArrayBuffer> shared_array_buffer,
@@ -219,6 +288,13 @@ class V8_EXPORT Float32Array : public TypedArray {
219288
*/
220289
class V8_EXPORT Float64Array : public TypedArray {
221290
public:
291+
/*
292+
* The largest Float64Array size that can be constructed using New.
293+
*/
294+
static constexpr size_t kMaxLength =
295+
TypedArray::kMaxByteLength / sizeof(double);
296+
static_assert(sizeof(double) == 8);
297+
222298
static Local<Float64Array> New(Local<ArrayBuffer> array_buffer,
223299
size_t byte_offset, size_t length);
224300
static Local<Float64Array> New(Local<SharedArrayBuffer> shared_array_buffer,
@@ -240,6 +316,13 @@ class V8_EXPORT Float64Array : public TypedArray {
240316
*/
241317
class V8_EXPORT BigInt64Array : public TypedArray {
242318
public:
319+
/*
320+
* The largest BigInt64Array size that can be constructed using New.
321+
*/
322+
static constexpr size_t kMaxLength =
323+
TypedArray::kMaxByteLength / sizeof(int64_t);
324+
static_assert(sizeof(int64_t) == 8);
325+
243326
static Local<BigInt64Array> New(Local<ArrayBuffer> array_buffer,
244327
size_t byte_offset, size_t length);
245328
static Local<BigInt64Array> New(Local<SharedArrayBuffer> shared_array_buffer,
@@ -261,6 +344,13 @@ class V8_EXPORT BigInt64Array : public TypedArray {
261344
*/
262345
class V8_EXPORT BigUint64Array : public TypedArray {
263346
public:
347+
/*
348+
* The largest BigUint64Array size that can be constructed using New.
349+
*/
350+
static constexpr size_t kMaxLength =
351+
TypedArray::kMaxByteLength / sizeof(uint64_t);
352+
static_assert(sizeof(uint64_t) == 8);
353+
264354
static Local<BigUint64Array> New(Local<ArrayBuffer> array_buffer,
265355
size_t byte_offset, size_t length);
266356
static Local<BigUint64Array> New(Local<SharedArrayBuffer> shared_array_buffer,

‎src/api/api.cc

+3-5
Original file line numberDiff line numberDiff line change
@@ -4238,8 +4238,6 @@ void v8::ArrayBufferView::CheckCast(Value* that) {
42384238
"Value is not an ArrayBufferView");
42394239
}
42404240

4241-
constexpr size_t v8::TypedArray::kMaxLength;
4242-
42434241
void v8::TypedArray::CheckCast(Value* that) {
42444242
i::Handle<i::Object> obj = Utils::OpenHandle(that);
42454243
Utils::ApiCheck(i::IsJSTypedArray(*obj), "v8::TypedArray::Cast()",
@@ -8990,9 +8988,9 @@ size_t v8::TypedArray::Length() {
89908988
return obj->WasDetached() ? 0 : obj->GetLength();
89918989
}
89928990

8993-
static_assert(
8994-
v8::TypedArray::kMaxLength == i::JSTypedArray::kMaxLength,
8995-
"v8::TypedArray::kMaxLength must match i::JSTypedArray::kMaxLength");
8991+
static_assert(v8::TypedArray::kMaxByteLength == i::JSTypedArray::kMaxByteLength,
8992+
"v8::TypedArray::kMaxByteLength must match "
8993+
"i::JSTypedArray::kMaxByteLength");
89968994

89978995
#define TYPED_ARRAY_NEW(Type, type, TYPE, ctype) \
89988996
Local<Type##Array> Type##Array::New(Local<ArrayBuffer> array_buffer, \

‎src/builtins/base.tq

-2
Original file line numberDiff line numberDiff line change
@@ -487,8 +487,6 @@ extern enum PropertyAttributes extends int31 {
487487

488488
const kArrayBufferMaxByteLength:
489489
constexpr uintptr generates 'JSArrayBuffer::kMaxByteLength';
490-
const kTypedArrayMaxLength:
491-
constexpr uintptr generates 'JSTypedArray::kMaxLength';
492490
const kMaxTypedArrayInHeap:
493491
constexpr int31 generates 'JSTypedArray::kMaxSizeInHeap';
494492
// CSA does not support 64-bit types on 32-bit platforms so as a workaround the

‎src/builtins/builtins-arraybuffer.cc

+3-8
Original file line numberDiff line numberDiff line change
@@ -73,15 +73,10 @@ Tagged<Object> ConstructBuffer(Isolate* isolate, Handle<JSFunction> target,
7373
BackingStore::Allocate(isolate, byte_length, shared, initialized);
7474
max_byte_length = byte_length;
7575
} else {
76-
// We need to check the max length against both
77-
// JSArrayBuffer::kMaxByteLength and JSTypedArray::kMaxLength, since it's
78-
// possible to create length-tracking TypedArrays and resize the underlying
79-
// buffer. If the max byte length was larger than JSTypedArray::kMaxLength,
80-
// that'd result in having a TypedArray with length larger than
81-
// JSTypedArray::kMaxLength.
76+
static_assert(JSArrayBuffer::kMaxByteLength ==
77+
JSTypedArray::kMaxByteLength);
8278
if (!TryNumberToSize(*max_length, &max_byte_length) ||
83-
max_byte_length > JSArrayBuffer::kMaxByteLength ||
84-
max_byte_length > JSTypedArray::kMaxLength) {
79+
max_byte_length > JSArrayBuffer::kMaxByteLength) {
8580
THROW_NEW_ERROR_RETURN_FAILURE(
8681
isolate,
8782
NewRangeError(MessageTemplate::kInvalidArrayBufferMaxLength));

‎src/builtins/typed-array-createtypedarray.tq

+1-2
Original file line numberDiff line numberDiff line change
@@ -297,8 +297,7 @@ transitioning macro ConstructByArrayBuffer(
297297
if (bufferByteLength < offset) goto IfInvalidOffset;
298298

299299
newByteLength = bufferByteLength - offset;
300-
newLength = elementsInfo.CalculateLength(newByteLength)
301-
otherwise IfInvalidLength;
300+
newLength = elementsInfo.CalculateLength(newByteLength);
302301
} else {
303302
// b. Else,
304303
// i. Let newByteLength be newLength × elementSize.

‎src/builtins/typed-array.tq

+2-5
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ type RabGsabUint8Elements extends ElementsKind;
2525
struct TypedArrayElementsInfo {
2626
// Calculates the number of bytes required for specified number of elements.
2727
macro CalculateByteLength(length: uintptr): uintptr labels IfInvalid {
28-
if (length > kTypedArrayMaxLength) goto IfInvalid;
2928
const maxArrayLength = kArrayBufferMaxByteLength >>> this.sizeLog2;
3029
if (length > maxArrayLength) goto IfInvalid;
3130
const byteLength = length << this.sizeLog2;
@@ -34,10 +33,8 @@ struct TypedArrayElementsInfo {
3433

3534
// Calculates the maximum number of elements supported by a specified number
3635
// of bytes.
37-
macro CalculateLength(byteLength: uintptr): uintptr labels IfInvalid {
38-
const length = byteLength >>> this.sizeLog2;
39-
if (length > kTypedArrayMaxLength) goto IfInvalid;
40-
return length;
36+
macro CalculateLength(byteLength: uintptr): uintptr {
37+
return byteLength >>> this.sizeLog2;
4138
}
4239

4340
// Determines if `bytes` (byte offset or length) cannot be evenly divided by

‎src/codegen/code-stub-assembler.cc

+1-1
Original file line numberDiff line numberDiff line change
@@ -1720,7 +1720,7 @@ void CodeStubAssembler::StoreBoundedSizeToObject(TNode<HeapObject> object,
17201720
TNode<IntPtrT> offset,
17211721
TNode<UintPtrT> value) {
17221722
#ifdef V8_ENABLE_SANDBOX
1723-
CSA_DCHECK(this, UintPtrLessThan(
1723+
CSA_DCHECK(this, UintPtrLessThanOrEqual(
17241724
value, IntPtrConstant(kMaxSafeBufferSizeForSandbox)));
17251725
TNode<Uint64T> raw_value = ReinterpretCast<Uint64T>(value);
17261726
TNode<Uint64T> shift_amount = Uint64Constant(kBoundedSizeShift);

‎src/common/globals.h

+1
Original file line numberDiff line numberDiff line change
@@ -1695,6 +1695,7 @@ constexpr uint64_t kHoleNanInt64 =
16951695

16961696
// ES6 section 20.1.2.6 Number.MAX_SAFE_INTEGER
16971697
constexpr uint64_t kMaxSafeIntegerUint64 = 9007199254740991; // 2^53-1
1698+
static_assert(kMaxSafeIntegerUint64 == (uint64_t{1} << 53) - 1);
16981699
constexpr double kMaxSafeInteger = static_cast<double>(kMaxSafeIntegerUint64);
16991700
// ES6 section 21.1.2.8 Number.MIN_SAFE_INTEGER
17001701
constexpr double kMinSafeInteger = -kMaxSafeInteger;

‎src/compiler/type-cache.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -124,9 +124,9 @@ class V8_EXPORT_PRIVATE TypeCache final {
124124
Type const kJSArrayBufferViewByteOffsetType = kJSArrayBufferByteLengthType;
125125

126126
// The JSTypedArray::length property always contains an untagged number in
127-
// the range [0, JSTypedArray::kMaxLength].
127+
// the range [0, JSTypedArray::kMaxByteLength].
128128
Type const kJSTypedArrayLengthType =
129-
CreateRange(0.0, JSTypedArray::kMaxLength);
129+
CreateRange(0.0, JSTypedArray::kMaxByteLength);
130130

131131
// The String::length property always contains a smi in the range
132132
// [0, String::kMaxLength].

‎src/diagnostics/objects-debug.cc

+1-1
Original file line numberDiff line numberDiff line change
@@ -1817,7 +1817,7 @@ void JSArrayBufferView::JSArrayBufferViewVerify(Isolate* isolate) {
18171817

18181818
void JSTypedArray::JSTypedArrayVerify(Isolate* isolate) {
18191819
TorqueGeneratedClassVerifiers::JSTypedArrayVerify(*this, isolate);
1820-
CHECK_LE(GetLength(), JSTypedArray::kMaxLength);
1820+
CHECK_LE(GetLength(), JSTypedArray::kMaxByteLength / element_size());
18211821
}
18221822

18231823
void JSDataView::JSDataViewVerify(Isolate* isolate) {

‎src/heap/factory.cc

+2-4
Original file line numberDiff line numberDiff line change
@@ -3241,12 +3241,10 @@ Handle<JSTypedArray> Factory::NewJSTypedArray(ExternalArrayType type,
32413241
length = 0;
32423242
}
32433243

3244+
CHECK_LE(length, JSTypedArray::kMaxByteLength / element_size);
3245+
CHECK_EQ(0, byte_offset % element_size);
32443246
size_t byte_length = length * element_size;
32453247

3246-
CHECK_LE(length, JSTypedArray::kMaxLength);
3247-
CHECK_EQ(length, byte_length / element_size);
3248-
CHECK_EQ(0, byte_offset % ElementsKindToByteSize(elements_kind));
3249-
32503248
Handle<JSTypedArray> typed_array =
32513249
Handle<JSTypedArray>::cast(NewJSArrayBufferView(
32523250
map, empty_byte_array(), buffer, byte_offset, byte_length));

‎src/objects/js-array-buffer.h

+2-4
Original file line numberDiff line numberDiff line change
@@ -279,10 +279,8 @@ class JSArrayBufferView
279279
class JSTypedArray
280280
: public TorqueGeneratedJSTypedArray<JSTypedArray, JSArrayBufferView> {
281281
public:
282-
// TODO(v8:4153): This should be equal to JSArrayBuffer::kMaxByteLength
283-
// eventually.
284-
static constexpr size_t kMaxLength = v8::TypedArray::kMaxLength;
285-
static_assert(kMaxLength <= JSArrayBuffer::kMaxByteLength);
282+
static constexpr size_t kMaxByteLength = JSArrayBuffer::kMaxByteLength;
283+
static_assert(kMaxByteLength == v8::TypedArray::kMaxByteLength);
286284

287285
// [length]: length of typed array in elements.
288286
DECL_PRIMITIVE_GETTER(length, size_t)

‎src/runtime/runtime-debug.cc

+2-5
Original file line numberDiff line numberDiff line change
@@ -324,10 +324,8 @@ MaybeHandle<JSArray> Runtime::GetInternalProperties(Isolate* isolate,
324324
isolate->factory()->true_value());
325325
} else {
326326
const size_t byte_length = js_array_buffer->byte_length();
327-
// TODO(v8:4153): Remove this code once the maximum lengths are equal (and
328-
// add a static assertion that it stays that way).
329-
static_assert(JSTypedArray::kMaxLength < JSArrayBuffer::kMaxByteLength);
330-
CHECK_LE(byte_length, JSArrayBuffer::kMaxByteLength);
327+
static_assert(JSTypedArray::kMaxByteLength ==
328+
JSArrayBuffer::kMaxByteLength);
331329
using DataView = std::tuple<const char*, ExternalArrayType, size_t>;
332330
for (auto [name, type, elem_size] :
333331
{DataView{"[[Int8Array]]", kExternalInt8Array, 1},
@@ -336,7 +334,6 @@ MaybeHandle<JSArray> Runtime::GetInternalProperties(Isolate* isolate,
336334
DataView{"[[Int32Array]]", kExternalInt32Array, 4}}) {
337335
if ((byte_length % elem_size) != 0) continue;
338336
size_t length = byte_length / elem_size;
339-
if (length > JSTypedArray::kMaxLength) continue;
340337
result =
341338
ArrayList::Add(isolate, result,
342339
isolate->factory()->NewStringFromAsciiChecked(name),

‎src/runtime/runtime-test.cc

-8
Original file line numberDiff line numberDiff line change
@@ -1880,14 +1880,6 @@ RUNTIME_FUNCTION(Runtime_ArrayBufferMaxByteLength) {
18801880
return *isolate->factory()->NewNumber(JSArrayBuffer::kMaxByteLength);
18811881
}
18821882

1883-
RUNTIME_FUNCTION(Runtime_TypedArrayMaxLength) {
1884-
HandleScope shs(isolate);
1885-
if (args.length() != 0) {
1886-
return CrashUnlessFuzzing(isolate);
1887-
}
1888-
return *isolate->factory()->NewNumber(JSTypedArray::kMaxLength);
1889-
}
1890-
18911883
RUNTIME_FUNCTION(Runtime_CompleteInobjectSlackTracking) {
18921884
HandleScope scope(isolate);
18931885
if (args.length() != 1) {

‎src/runtime/runtime.h

+1-2
Original file line numberDiff line numberDiff line change
@@ -301,8 +301,7 @@ namespace internal {
301301
F(NumberToStringSlow, 1, 1) \
302302
F(StringParseFloat, 1, 1) \
303303
F(StringParseInt, 2, 1) \
304-
F(StringToNumber, 1, 1) \
305-
F(TypedArrayMaxLength, 0, 1)
304+
F(StringToNumber, 1, 1)
306305

307306
#define FOR_EACH_INTRINSIC_OBJECT(F, I) \
308307
F(AddDictionaryProperty, 3, 1) \

0 commit comments

Comments
 (0)