Exploiting the Math.expm1 typing bug in V8

Re:Exploiting the Math.expm1 typing bug in V8 by pcwalton on Wednesday January 02, 2019 @11:51PM (#18812909)

I'm not sure how asm.js is relevant here. The issue is that function-level lazy compilation makes compilation too hot to allow for an mprotect call, no? Wouldn't a function-level lazy Web Assembly implementation have the same problem?

It seems to me that the solution is the same for both wasm and asm.js: make the unit of compilation larger than the function, so as to amortize the cost of mprotect.

[ Parent | on HN ]

Re:Exploiting the Math.expm1 typing bug in V8 by titzer on Thursday January 03, 2019 @12:24AM (#18813020)

You and I both know that the comments section of HN lacks sufficient space to discuss all the things we thought of / could think of :)

[ Parent | on HN ]

Re:Exploiting the Math.expm1 typing bug in V8 by titzer on Thursday January 03, 2019 @12:26AM (#18813029)

Also, I should have mentioned, but concurrent compilation of Wasm (for incremental tierup) essentially puts the final nail in the WX exclusion coffin. (but we deployed that long after the first reason, lazy compilation for asm.js). The only solution in the long run afaict is out-of-process compilation, which we will explore this year.

[ Parent | on HN ]