diff --git a/js/src/jit-test/tests/sharedbuf/size-with-uninitialized.js b/js/src/jit-test/tests/sharedbuf/size-with-uninitialized.js deleted file mode 100644 index 14f6e038ce31..000000000000 --- a/js/src/jit-test/tests/sharedbuf/size-with-uninitialized.js +++ /dev/null @@ -1,15 +0,0 @@ -// OOM during SharedArrayBuffer initialization can expose partially initialized -// object to metadata builder. -// It shouldn't crash. - -newGlobal({ newCompartment: true }).Debugger(this).memory.trackingAllocationSites = true; -for (let i = 0; i < 9; i++) { - oomTest(function () { - class C extends WebAssembly.Memory {} - new C({ - initial: 0, - maximum: 1, - shared: 1, - }); - }); -} diff --git a/js/src/vm/SharedArrayObject.cpp b/js/src/vm/SharedArrayObject.cpp index 703d51e85b59..e3e25e3de598 100644 --- a/js/src/vm/SharedArrayObject.cpp +++ b/js/src/vm/SharedArrayObject.cpp @@ -587,7 +587,6 @@ SharedArrayBufferType* SharedArrayBufferObject::NewWith( bool SharedArrayBufferObject::acceptRawBuffer(SharedArrayRawBuffer* buffer, size_t length) { - MOZ_ASSERT(!isInitialized()); if (!zone()->addSharedMemory(buffer, SharedArrayMappedSize(buffer->isWasm(), length), MemoryUse::SharedArrayRawBuffer)) { @@ -596,7 +595,6 @@ bool SharedArrayBufferObject::acceptRawBuffer(SharedArrayRawBuffer* buffer, setFixedSlot(RAWBUF_SLOT, PrivateValue(buffer)); setFixedSlot(LENGTH_SLOT, PrivateValue(length)); - MOZ_ASSERT(isInitialized()); return true; } @@ -607,7 +605,6 @@ void SharedArrayBufferObject::dropRawBuffer() { MemoryUse::SharedArrayRawBuffer); rawBufferObject()->dropReference(); setFixedSlot(RAWBUF_SLOT, UndefinedValue()); - MOZ_ASSERT(!isInitialized()); } SharedArrayRawBuffer* SharedArrayBufferObject::rawBufferObject() const { @@ -642,11 +639,6 @@ void SharedArrayBufferObject::addSizeOfExcludingThis( // the refcount goes down). But that's unlikely and hard to avoid, so we // just live with the risk. const SharedArrayBufferObject& buf = obj->as(); - - if (MOZ_UNLIKELY(!buf.isInitialized())) { - return; - } - size_t nbytes = buf.byteLengthOrMaxByteLength(); size_t owned = nbytes / buf.rawBufferObject()->refcount(); if (buf.isWasm()) { diff --git a/js/src/vm/SharedArrayObject.h b/js/src/vm/SharedArrayObject.h index e3d14254d4d5..525ee78451fb 100644 --- a/js/src/vm/SharedArrayObject.h +++ b/js/src/vm/SharedArrayObject.h @@ -344,13 +344,6 @@ class SharedArrayBufferObject : public ArrayBufferObjectMaybeShared { return rawBufferObject()->volatileByteLength(); } - private: - bool isInitialized() const { - bool initialized = getFixedSlot(RAWBUF_SLOT).isDouble(); - MOZ_ASSERT_IF(initialized, getFixedSlot(LENGTH_SLOT).isDouble()); - return initialized; - } - public: // Returns either the byte length for fixed-length shared arrays. Or the // maximum byte length for growable shared arrays.