worker: use engine-provided deleter for SharedArrayBuffers

Store the full information we have on a given `SharedArrayBuffer`,
and use the deleter provided by the JS engine to free the memory
when that is needed.
This fixes memory lifetime management for WASM buffers that are
passed through a `MessageChannel` (e.g. between threads).
PR-URL: #25307
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>

Author: addaleax

src/sharedarraybuffer_metadata.cc

@@ -89,8 +89,7 @@ SharedArrayBufferMetadata::ForSharedArrayBuffer(
  }
 
  SharedArrayBuffer::Contents contents = source->Externalize();
- SharedArrayBufferMetadataReference r(newSharedArrayBufferMetadata(
- contents.Data(), contents.ByteLength()));
+ SharedArrayBufferMetadataReference r(newSharedArrayBufferMetadata(contents));
 if (r->AssignToSharedArrayBuffer(env, context, source).IsNothing())
 returnnullptr;
 return r;
@@ -111,17 +110,22 @@ Maybe<bool> SharedArrayBufferMetadata::AssignToSharedArrayBuffer(
  obj);
 }
 
-SharedArrayBufferMetadata::SharedArrayBufferMetadata(void* data, size_t size)
- : data(data), size(size) { }
+SharedArrayBufferMetadata::SharedArrayBufferMetadata(
+const SharedArrayBuffer::Contents& contents)
+ : contents_(contents) { }
 
 SharedArrayBufferMetadata::~SharedArrayBufferMetadata() {
-free(data);
+ contents_.Deleter()(contents_.Data(),
+ contents_.ByteLength(),
+ contents_.DeleterData());
 }
 
 MaybeLocal<SharedArrayBuffer> SharedArrayBufferMetadata::GetSharedArrayBuffer(
  Environment* env, Local<Context> context) {
  Local<SharedArrayBuffer> obj =
-SharedArrayBuffer::New(env->isolate(), data, size);
+SharedArrayBuffer::New(env->isolate(),
+ contents_.Data(),
+ contents_.ByteLength());
 
 if (AssignToSharedArrayBuffer(env, context, obj).IsNothing())
 return MaybeLocal<SharedArrayBuffer>();

src/sharedarraybuffer_metadata.h

@@ -46,16 +46,15 @@ class SharedArrayBufferMetadata
 SharedArrayBufferMetadata(const SharedArrayBufferMetadata&) = delete;
 
 private:
-explicitSharedArrayBufferMetadata(void* data, size_t size);
+explicitSharedArrayBufferMetadata(const v8::SharedArrayBuffer::Contents&);
 
 // Attach a lifetime tracker object with a reference count to `target`.
  v8::Maybe<bool> AssignToSharedArrayBuffer(
  Environment* env,
  v8::Local<v8::Context> context,
  v8::Local<v8::SharedArrayBuffer> target);
 
-void* data = nullptr;
-size_t size = 0;
+ v8::SharedArrayBuffer::Contents contents_;
 };
 
 } // namespace worker

test/fixtures/wasm-threads-shared-memory.wasm

@@ -0,0 +1,4 @@
+(module
+ (memory$mem12 shared)
+ (export"memory" (memory$mem))
+)

test/fixtures/wasm-threads-shared-memory.wat

@@ -0,0 +1,46 @@
+// Flags: --experimental-worker --experimental-wasm-threads
+'use strict';
+constcommon=require('../common');
+constassert=require('assert');
+const{ MessageChannel, Worker }=require('worker_threads');
+
+// Test that SharedArrayBuffer instances created from WASM are transferrable
+// through MessageChannels (without crashing).
+
+constfixtures=require('../common/fixtures');
+constwasmSource=fixtures.readSync('wasm-threads-shared-memory.wasm');
+constwasmModule=newWebAssembly.Module(wasmSource);
+constinstance=newWebAssembly.Instance(wasmModule);
+
+const{ buffer }=instance.exports.memory;
+assert(bufferinstanceofSharedArrayBuffer);
+
+{
+const{ port1, port2 }=newMessageChannel();
+port1.postMessage(buffer);
+port2.once('message',common.mustCall((buffer2)=>{
+// Make sure serialized + deserialized buffer refer to the same memory.
+constexpected='Hello, world!';
+constbytes=Buffer.from(buffer).write(expected);
+constdeserialized=Buffer.from(buffer2).toString('utf8',0,bytes);
+assert.deepStrictEqual(deserialized,expected);
+}));
+}
+
+{
+// Make sure we can free WASM memory originating from a thread that already
+// stopped when we exit.
+constworker=newWorker(`
+ const { parentPort } = require('worker_threads');
+ const wasmSource = new Uint8Array([${wasmSource.join(',')}]);
+ const wasmModule = new WebAssembly.Module(wasmSource);
+ const instance = new WebAssembly.Instance(wasmModule);
+ parentPort.postMessage(instance.exports.memory);
+ `,{eval: true});
+worker.once('message',common.mustCall(({ buffer })=>{
+assert(bufferinstanceofSharedArrayBuffer);
+worker.buf=buffer;// Basically just keep the reference to buffer alive.
+}));
+worker.once('exit',common.mustCall());
+worker.postMessage({ wasmModule });
+}