From c71624d1dadf3befa38a6c118b494866c3cd32cb Mon Sep 17 00:00:00 2001 From: Raymond Hill Date: Sat, 26 Oct 2019 17:37:47 -0400 Subject: [PATCH] Fix access to detached buffer when using WASM in bidi-trie Related issue: - https://github.com/uBlockOrigin/uBlock-issues/issues/764 WebAssembly.Memory.grow() preserves the buffer content when we grow it, no need to manually copy it. Doing so was causing an access to a no longer valid ArrayBuffer. --- src/js/strie.js | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/js/strie.js b/src/js/strie.js index 599cfd390..9a0a8a668 100644 --- a/src/js/strie.js +++ b/src/js/strie.js @@ -759,6 +759,14 @@ const roundToPageSize = v => (v + PAGE_SIZE-1) & ~(PAGE_SIZE-1); let newBuf; if ( this.wasmMemory === null ) { newBuf = new Uint8Array(bufLen); + newBuf.set(this.buf8.subarray(0, this.buf32[TRIE1_SLOT]), 0); + newBuf.set( + this.buf8.subarray( + this.buf32[CHAR0_SLOT], + this.buf32[CHAR1_SLOT] + ), + char0 + ); } else { const oldPageCount = this.buf8.length >>> 16; const newPageCount = (bufLen + 0xFFFF) >>> 16; @@ -767,14 +775,6 @@ const roundToPageSize = v => (v + PAGE_SIZE-1) & ~(PAGE_SIZE-1); } newBuf = new Uint8Array(this.wasmMemory.buffer); } - newBuf.set(this.buf8.subarray(0, this.buf32[TRIE1_SLOT]), 0); - newBuf.set( - this.buf8.subarray( - this.buf32[CHAR0_SLOT], - this.buf32[CHAR1_SLOT] - ), - char0 - ); this.buf8 = newBuf; this.buf32 = new Uint32Array(this.buf8.buffer); this.buf32[CHAR0_SLOT] = char0;