Skip to content

Commit

Permalink
LibWeb: Implement transfer for Resizable/ArrayBuffer
Browse files Browse the repository at this point in the history 
Implement transfer logic for ArrayBuffer and ResizableArrayBuffer.

Change TransferDataHolder data type to Vector<u32> to reuse existing
serialization infrastructure.

Fix 2 WPT tests in
`safe-passing-of-structured-data/window-postmessage.window.html`, as
well as `LibWeb/Text/input/Worker/Worker-postMessage-transfer.html`. The
latter is currently ignored due to flakiness in CI, so no rebaseline is
needed.
  • Loading branch information
@zetslief
zetslief committed Nov 24, 2024
1 parent 01f4bbb commit 5e6fb4f
Show file tree
Hide file tree
Showing 4 changed files with 81 additions and 25 deletions.
92 changes: 72 additions & 20 deletions Libraries/LibWeb/HTML/StructuredSerialize.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
#include <LibJS/Forward.h>
#include <LibJS/Runtime/Array.h>
#include <LibJS/Runtime/ArrayBuffer.h>
#include <LibJS/Runtime/ArrayBufferConstructor.h>
#include <LibJS/Runtime/BigInt.h>
#include <LibJS/Runtime/BigIntObject.h>
#include <LibJS/Runtime/BooleanObject.h>
Expand Down Expand Up @@ -1114,14 +1115,18 @@ WebIDL::ExceptionOr<SerializedTransferRecord> structured_serialize_with_transfer

// 2. For each transferable of transferList:
for (auto const& transferable : transfer_list) {
auto is_array_buffer = value.is_object() && is<JS::ArrayBuffer>(value.as_object());

// 1. If transferable has neither an [[ArrayBufferData]] internal slot nor a [[Detached]] internal slot, then throw a "DataCloneError" DOMException.
// FIXME: Handle transferring ArrayBufferData objects
if (!is<Bindings::Transferable>(*transferable)) {
// FIXME: Handle transferring objects with [[Detached]] internal slot.
if (!is_array_buffer && !is<Bindings::Transferable>(*transferable)) {
return WebIDL::DataCloneError::create(*vm.current_realm(), "Cannot transfer type"_string);
}

// FIXME: 2. If transferable has an [[ArrayBufferData]] internal slot and IsSharedArrayBuffer(transferable) is true, then throw a "DataCloneError" DOMException.
// 2. If transferable has an [[ArrayBufferData]] internal slot and IsSharedArrayBuffer(transferable) is true, then throw a "DataCloneError" DOMException.
if (is_array_buffer && verify_cast<JS::ArrayBuffer>(value.as_object()).is_shared_array_buffer()) {
return WebIDL::DataCloneError::create(*vm.current_realm(), "Cannot transfer shared array buffer"_string);
}

// 3. If memory[transferable] exists, then throw a "DataCloneError" DOMException.
auto transferable_value = JS::Value(transferable);
Expand All @@ -1130,7 +1135,7 @@ WebIDL::ExceptionOr<SerializedTransferRecord> structured_serialize_with_transfer
}

// 4. Set memory[transferable] to { [[Type]]: an uninitialized value }.
memory.set(GC::make_root(transferable_value), NumericLimits<u32>::max());
memory.set(GC::make_root(transferable_value), memory.size());
}

// 3. Let serialized be ? StructuredSerializeInternal(value, false, memory).
Expand All @@ -1142,7 +1147,13 @@ WebIDL::ExceptionOr<SerializedTransferRecord> structured_serialize_with_transfer

// 5. For each transferable of transferList:
for (auto& transferable : transfer_list) {
// 1. FIXME: If transferable has an [[ArrayBufferData]] internal slot and IsDetachedBuffer(transferable) is true, then throw a "DataCloneError" DOMException.
auto is_array_buffer = value.is_object() && is<JS::ArrayBuffer>(value.as_object());
auto is_detached = is_array_buffer && verify_cast<JS::ArrayBuffer>(value.as_object()).is_detached();

// 1. If transferable has an [[ArrayBufferData]] internal slot and IsDetachedBuffer(transferable) is true, then throw a "DataCloneError" DOMException.
if (is_detached) {
return WebIDL::DataCloneError::create(*vm.current_realm(), "Cannot transfer detached buffer"_string);
}

// 2. If transferable has a [[Detached]] internal slot and transferable.[[Detached]] is true, then throw a "DataCloneError" DOMException.
if (is<Bindings::Transferable>(*transferable)) {
Expand All @@ -1156,8 +1167,32 @@ WebIDL::ExceptionOr<SerializedTransferRecord> structured_serialize_with_transfer
// IMPLEMENTATION DEFINED: We just create a data holder here, our memory holds indices into the SerializationRecord
TransferDataHolder data_holder;

// FIXME 4. If transferable has an [[ArrayBufferData]] internal slot, then:
if (false) {
// 4. If transferable has an [[ArrayBufferData]] internal slot, then:
if (is_array_buffer) {
// 1. If transferable has an [[ArrayBufferMaxByteLength]] internal slot, then:
auto& array_buffer = verify_cast<JS::ArrayBuffer>(value.as_object());
if (!array_buffer.is_fixed_length()) {
// 1. Set dataHolder.[[Type]] to "ResizableArrayBuffer".
// 2. Set dataHolder.[[ArrayBufferData]] to transferable.[[ArrayBufferData]].
// 3. Set dataHolder.[[ArrayBufferByteLength]] to transferable.[[ArrayBufferByteLength]].
// 4. Set dataHolder.[[ArrayBufferMaxByteLength]] to transferable.[[ArrayBufferMaxByteLength]].
serialize_enum<TransferType>(data_holder.data, TransferType::ResizableArrayBuffer);
MUST(serialize_bytes(vm, data_holder.data, array_buffer.buffer().bytes())); // serializes both byte length and bytes
serialize_primitive_type<size_t>(data_holder.data, array_buffer.max_byte_length());
}

// 2. Otherwise:
else {
// 1. Set dataHolder.[[Type]] to "ArrayBuffer".
// 2. Set dataHolder.[[ArrayBufferData]] to transferable.[[ArrayBufferData]].
// 3. Set dataHolder.[[ArrayBufferByteLength]] to transferable.[[ArrayBufferByteLength]].
serialize_enum<TransferType>(data_holder.data, TransferType::ArrayBuffer);
MUST(serialize_bytes(vm, data_holder.data, array_buffer.buffer().bytes())); // serializes both byte length and bytes
}

// 3. Perform ? DetachArrayBuffer(transferable).
// NOTE: Specifications can use the [[ArrayBufferDetachKey]] internal slot to prevent ArrayBuffers from being detached. This is used in WebAssembly JavaScript Interface, for example. See: https://html.spec.whatwg.org/multipage/references.html#refsWASMJS
MUST(JS::detach_array_buffer(vm, array_buffer));
}

// 5. Otherwise:
Expand All @@ -1170,7 +1205,7 @@ WebIDL::ExceptionOr<SerializedTransferRecord> structured_serialize_with_transfer
auto interface_name = transferable_object.primary_interface();

// 3. Set dataHolder.[[Type]] to interfaceName.
data_holder.data.append(to_underlying(interface_name));
serialize_enum<TransferType>(data_holder.data, interface_name);

// 4. Perform the appropriate transfer steps for the interface identified by interfaceName, given transferable and dataHolder.
TRY(transferable_object.transfer_steps(data_holder));
Expand All @@ -1187,15 +1222,15 @@ WebIDL::ExceptionOr<SerializedTransferRecord> structured_serialize_with_transfer
return SerializedTransferRecord { .serialized = move(serialized), .transfer_data_holders = move(transfer_data_holders) };
}

static bool is_interface_exposed_on_target_realm(u8 name, JS::Realm& realm)
static bool is_interface_exposed_on_target_realm(TransferType name, JS::Realm& realm)
{
auto const& intrinsics = Bindings::host_defined_intrinsics(realm);
switch (static_cast<TransferType>(name)) {
switch (name) {
case TransferType::MessagePort:
return intrinsics.is_exposed("MessagePort"sv);
break;
default:
dbgln("Unknown interface type for transfer: {}", name);
dbgln("Unknown interface type for transfer: {}", to_underlying(name));
break;
}
return false;
Expand All @@ -1209,6 +1244,9 @@ static WebIDL::ExceptionOr<GC::Ref<Bindings::PlatformObject>> create_transferred
TRY(message_port->transfer_receiving_steps(transfer_data_holder));
return message_port;
}
default:
dbgln("Unknown interface type for transfer: {}", to_underlying(name));
break;
}
VERIFY_NOT_REACHED();
}
Expand All @@ -1226,39 +1264,53 @@ WebIDL::ExceptionOr<DeserializedTransferRecord> structured_deserialize_with_tran

// 3. For each transferDataHolder of serializeWithTransferResult.[[TransferDataHolders]]:
for (auto& transfer_data_holder : serialize_with_transfer_result.transfer_data_holders) {
if(transfer_data_holder.data.is_empty()) continue;

// 1. Let value be an uninitialized value.
JS::Value value;

// FIXME: 2. If transferDataHolder.[[Type]] is "ArrayBuffer", then set value to a new ArrayBuffer object in targetRealm
size_t data_holder_position = 0;
auto type = deserialize_primitive_type<TransferType>(transfer_data_holder.data.span(), data_holder_position);

// 2. If transferDataHolder.[[Type]] is "ArrayBuffer", then set value to a new ArrayBuffer object in targetRealm
// whose [[ArrayBufferData]] internal slot value is transferDataHolder.[[ArrayBufferData]], and
// whose [[ArrayBufferByteLength]] internal slot value is transferDataHolder.[[ArrayBufferByteLength]].
// NOTE: In cases where the original memory occupied by [[ArrayBufferData]] is accessible during the deserialization,
// this step is unlikely to throw an exception, as no new memory needs to be allocated: the memory occupied by
// [[ArrayBufferData]] is instead just getting transferred into the new ArrayBuffer. This could be true, for example,
// when both the source and target realms are in the same process.
if (false) {
if (type == TransferType::ArrayBuffer) {
auto bytes = TRY(deserialize_bytes(vm, transfer_data_holder.data, data_holder_position));
JS::ArrayBuffer* data = TRY(JS::allocate_array_buffer(vm, target_realm.intrinsics().array_buffer_constructor(), bytes.size()));
bytes.span().copy_to(data->buffer().span());
value = data;
}

// FIXME: 3. Otherwise, if transferDataHolder.[[Type]] is "ResizableArrayBuffer", then set value to a new ArrayBuffer object
// 3. Otherwise, if transferDataHolder.[[Type]] is "ResizableArrayBuffer", then set value to a new ArrayBuffer object
// in targetRealm whose [[ArrayBufferData]] internal slot value is transferDataHolder.[[ArrayBufferData]], whose
// [[ArrayBufferByteLength]] internal slot value is transferDataHolder.[[ArrayBufferByteLength]], and whose
// [[ArrayBufferMaxByteLength]] internal slot value is transferDataHolder.[[ArrayBufferMaxByteLength]].
// NOTE: For the same reason as the previous step, this step is also unlikely to throw an exception.
else if (false) {
else if (type == TransferType::ResizableArrayBuffer) {
auto bytes = TRY(deserialize_bytes(vm, transfer_data_holder.data, data_holder_position));
auto max_byte_length = deserialize_primitive_type<size_t>(transfer_data_holder.data, data_holder_position);
JS::ArrayBuffer* data = TRY(JS::allocate_array_buffer(vm, target_realm.intrinsics().array_buffer_constructor(), bytes.size()));
data->set_max_byte_length(max_byte_length);
bytes.span().copy_to(data->buffer().span());
value = data;
}

// 4. Otherwise:
else {
// 1. Let interfaceName be transferDataHolder.[[Type]].
u8 const interface_name = transfer_data_holder.data.take_first();

// 2. If the interface identified by interfaceName is not exposed in targetRealm, then throw a "DataCloneError" DOMException.
if (!is_interface_exposed_on_target_realm(interface_name, target_realm))
if (!is_interface_exposed_on_target_realm(type, target_realm))
return WebIDL::DataCloneError::create(target_realm, "Unknown type transferred"_string);

// 3. Set value to a new instance of the interface identified by interfaceName, created in targetRealm.
// 4. Perform the appropriate transfer-receiving steps for the interface identified by interfaceName given transferDataHolder and value.
value = TRY(create_transferred_value(static_cast<TransferType>(interface_name), target_realm, transfer_data_holder));
transfer_data_holder.data.remove(0, data_holder_position);
value = TRY(create_transferred_value(type, target_realm, transfer_data_holder));
}

// 5. Set memory[transferDataHolder] to value.
Expand Down Expand Up @@ -1351,7 +1403,7 @@ ErrorOr<void> encode(Encoder& encoder, ::Web::HTML::SerializedTransferRecord con
template<>
ErrorOr<::Web::HTML::TransferDataHolder> decode(Decoder& decoder)
{
auto data = TRY(decoder.decode<Vector<u8>>());
auto data = TRY(decoder.decode<Vector<u32>>());
auto fds = TRY(decoder.decode<Vector<IPC::File>>());
return ::Web::HTML::TransferDataHolder { move(data), move(fds) };
}
Expand Down
4 changes: 3 additions & 1 deletion Libraries/LibWeb/HTML/StructuredSerialize.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
namespace Web::HTML {

struct TransferDataHolder {
Vector<u8> data;
Vector<u32> data;
Vector<IPC::File> fds;
};

Expand All @@ -46,6 +46,8 @@ struct DeserializedRecord {

enum class TransferType : u8 {
MessagePort,
ArrayBuffer,
ResizableArrayBuffer,
};

WebIDL::ExceptionOr<SerializationRecord> structured_serialize(JS::VM& vm, JS::Value);
Expand Down
8 changes: 4 additions & 4 deletions ...-import/html/infrastructure/safe-passing-of-structured-data/window-postmessage.window.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@ Rerun

Found 150 tests

124 Pass
25 Fail
126 Pass
23 Fail
1 Optional Feature Unsupported
Details
Result Test Name MessagePass primitive undefined
Expand Down Expand Up @@ -149,11 +149,11 @@ Pass Length-tracking DataView
Pass Serializing OOB TypedArray throws
Pass Serializing OOB DataView throws
Fail ArrayBuffer
Fail MessagePort
Pass MessagePort
Fail A detached ArrayBuffer cannot be transferred
Pass A detached platform object cannot be transferred
Pass Transferring a non-transferable platform object fails
Fail An object whose interface is deleted from the global object must still be received
Pass An object whose interface is deleted from the global object must still be received
Optional Feature Unsupported A subclass instance will be received as its closest transferable superclass ReadableStream isn't transferable
Fail Resizable ArrayBuffer is transferable
Fail Length-tracking TypedArray is transferable
Expand Down
2 changes: 2 additions & 0 deletions Tests/LibWeb/Text/input/Worker/Worker-postMessage-transfer.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@
const message = encoder.encode("Hello, world");
const myBuf = message.buffer;

println('Buffer length before transfer: ' + myBuf.byteLength);
worker.postMessage(myBuf, [myBuf]);
println('Buffer length after transfer: ' + myBuf.byteLength);
});
</script>

0 comments on commit 5e6fb4f

Please sign in to comment.