Skip to content

Commit

Permalink
Fix access to detached buffer when using WASM in bidi-trie
Browse files Browse the repository at this point in the history
Related issue:
- uBlockOrigin/uBlock-issues#764

WebAssembly.Memory.grow() preserves the buffer content when
we grow it, no need to manually copy it. Doing so was
causing an access to a no longer valid ArrayBuffer.
  • Loading branch information
gorhill committed Oct 26, 2019
1 parent 0373410 commit c71624d
Showing 1 changed file with 8 additions and 8 deletions.
16 changes: 8 additions & 8 deletions src/js/strie.js
Original file line number Diff line number Diff line change
Expand Up @@ -759,6 +759,14 @@ const roundToPageSize = v => (v + PAGE_SIZE-1) & ~(PAGE_SIZE-1);
let newBuf;
if ( this.wasmMemory === null ) {
newBuf = new Uint8Array(bufLen);
newBuf.set(this.buf8.subarray(0, this.buf32[TRIE1_SLOT]), 0);
newBuf.set(
this.buf8.subarray(
this.buf32[CHAR0_SLOT],
this.buf32[CHAR1_SLOT]
),
char0
);
} else {
const oldPageCount = this.buf8.length >>> 16;
const newPageCount = (bufLen + 0xFFFF) >>> 16;
Expand All @@ -767,14 +775,6 @@ const roundToPageSize = v => (v + PAGE_SIZE-1) & ~(PAGE_SIZE-1);
}
newBuf = new Uint8Array(this.wasmMemory.buffer);
}
newBuf.set(this.buf8.subarray(0, this.buf32[TRIE1_SLOT]), 0);
newBuf.set(
this.buf8.subarray(
this.buf32[CHAR0_SLOT],
this.buf32[CHAR1_SLOT]
),
char0
);
this.buf8 = newBuf;
this.buf32 = new Uint32Array(this.buf8.buffer);
this.buf32[CHAR0_SLOT] = char0;
Expand Down

0 comments on commit c71624d

Please sign in to comment.