Backed out changeset 3a4588287c80 (bug 1891412) for causing sm bustages. CLOSED TREE

js/src/jit-test/tests/sharedbuf/size-with-uninitialized.js

@@ -1,15 +0,0 @@
-// OOM during SharedArrayBuffer initialization can expose partially initialized
-// object to metadata builder.
-// It shouldn't crash.
-
-newGlobal({ newCompartment: true }).Debugger(this).memory.trackingAllocationSites = true;
-for (let i = 0; i < 9; i++) {
-  oomTest(function () {
-    class C extends WebAssembly.Memory {}
-    new C({
-      initial: 0,
-      maximum: 1,
-      shared: 1,
-    });
-  });
-}

js/src/vm/SharedArrayObject.cpp

@@ -587,7 +587,6 @@ SharedArrayBufferType* SharedArrayBufferObject::NewWith(
 
 bool SharedArrayBufferObject::acceptRawBuffer(SharedArrayRawBuffer* buffer,
                                               size_t length) {
-  MOZ_ASSERT(!isInitialized());
   if (!zone()->addSharedMemory(buffer,
                                SharedArrayMappedSize(buffer->isWasm(), length),
                                MemoryUse::SharedArrayRawBuffer)) {
@@ -596,7 +595,6 @@ bool SharedArrayBufferObject::acceptRawBuffer(SharedArrayRawBuffer* buffer,
 
   setFixedSlot(RAWBUF_SLOT, PrivateValue(buffer));
   setFixedSlot(LENGTH_SLOT, PrivateValue(length));
-  MOZ_ASSERT(isInitialized());
   return true;
 }
 
@@ -607,7 +605,6 @@ void SharedArrayBufferObject::dropRawBuffer() {
                                           MemoryUse::SharedArrayRawBuffer);
   rawBufferObject()->dropReference();
   setFixedSlot(RAWBUF_SLOT, UndefinedValue());
-  MOZ_ASSERT(!isInitialized());
 }
 
 SharedArrayRawBuffer* SharedArrayBufferObject::rawBufferObject() const {
@@ -642,11 +639,6 @@ void SharedArrayBufferObject::addSizeOfExcludingThis(
   // the refcount goes down). But that's unlikely and hard to avoid, so we
   // just live with the risk.
   const SharedArrayBufferObject& buf = obj->as<SharedArrayBufferObject>();
-
-  if (MOZ_UNLIKELY(!buf.isInitialized())) {
-    return;
-  }
-
   size_t nbytes = buf.byteLengthOrMaxByteLength();
   size_t owned = nbytes / buf.rawBufferObject()->refcount();
   if (buf.isWasm()) {

js/src/vm/SharedArrayObject.h

@@ -344,13 +344,6 @@ class SharedArrayBufferObject : public ArrayBufferObjectMaybeShared {
     return rawBufferObject()->volatileByteLength();
   }
 
- private:
-  bool isInitialized() const {
-    bool initialized = getFixedSlot(RAWBUF_SLOT).isDouble();
-    MOZ_ASSERT_IF(initialized, getFixedSlot(LENGTH_SLOT).isDouble());
-    return initialized;
-  }
-
  public:
   // Returns either the byte length for fixed-length shared arrays. Or the
   // maximum byte length for growable shared arrays.