script/engine/
init.rs

1/* This Source Code Form is subject to the terms of the Mozilla Public
2 * License, v. 2.0. If a copy of the MPL was not distributed with this
3 * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
4
5use js::jsapi::JSObject;
6use script_bindings::proxyhandler;
7use servo_config::pref;
8
9use crate::dom::bindings::codegen::RegisterBindings;
10use crate::dom::bindings::conversions::is_dom_proxy;
11use crate::dom::bindings::utils::is_platform_object_static;
12use crate::engine::handle::JSEngineSetup;
13
14#[cfg(unix)]
15#[expect(unsafe_code)]
16fn raise_file_handle_limit() {
17    // Chromium uses 8192 as the maximum number of file handles on macOS, Linux,
18    // chromeOS and Android. We do the same here for all Unix systems.
19    const MAX_FILE_LIMIT: libc::rlim_t = 8192;
20
21    // Bump up our number of file descriptors to save us from impending doom caused by an onslaught
22    // of iframes.
23    let mut rlimit = libc::rlimit {
24        rlim_cur: 0,
25        rlim_max: 0,
26    };
27
28    if unsafe { libc::getrlimit(libc::RLIMIT_NOFILE, &mut rlimit) } != 0 {
29        warn!("Failed to get file count limit");
30        return;
31    }
32
33    if rlimit.rlim_cur >= MAX_FILE_LIMIT {
34        return;
35    }
36
37    rlimit.rlim_cur = match rlimit.rlim_max {
38        libc::RLIM_INFINITY => MAX_FILE_LIMIT,
39        _ => rlimit.rlim_max.min(MAX_FILE_LIMIT),
40    };
41
42    if unsafe { libc::setrlimit(libc::RLIMIT_NOFILE, &rlimit) } != 0 {
43        warn!("Failed to set file count limit");
44    }
45}
46
47#[cfg(not(unix))]
48fn raise_file_handle_limit() {}
49
50#[expect(unsafe_code)]
51unsafe extern "C" fn is_dom_object(obj: *mut JSObject) -> bool {
52    !obj.is_null() && (is_platform_object_static(obj) || unsafe { is_dom_proxy(obj) })
53}
54
55/// Returns true if JIT is forbidden
56///
57/// Spidermonkey will crash if JIT is not allowed on a system, so we do a short detection
58/// if jit is allowed or not.
59///
60/// Note: This implementation should work fine on all Linux systems, perhaps even Unix systems,
61/// but for now we only enable it on OpenHarmony, since that is where it is most needed.
62#[cfg(target_env = "ohos")]
63#[expect(unsafe_code)]
64fn jit_forbidden() -> bool {
65    debug!("Testing if JIT is allowed.");
66
67    fn mem_is_writable(ptr: *mut core::ffi::c_void) -> std::io::Result<bool> {
68        debug!("Testing if ptr {ptr:?} is writable");
69        // Safety: This is cursed, but we can use read to determine if ptr
70        // can be written to. `read` is a syscall and will return an error code
71        // if ptr can't be written (instead of a segfault as with a regular access).
72        // We also take care to always close `fd`.
73        #[expect(unsafe_code)]
74        unsafe {
75            let fd = libc::open(c"/dev/zero".as_ptr(), libc::O_RDONLY);
76            if fd < 0 {
77                return Err(std::io::Error::last_os_error());
78            }
79            let writable = libc::read(fd, ptr, 1) > 0;
80            if !writable {
81                debug!(
82                    "addr is not writable. Error: {}",
83                    std::io::Error::last_os_error()
84                );
85            }
86            libc::close(fd);
87            Ok(writable)
88        }
89    }
90
91    // We need to allocate at least one page, so we query the page size on the system.
92    let map_size: libc::size_t = unsafe { libc::sysconf(libc::_SC_PAGESIZE) as libc::size_t };
93    let flags = libc::MAP_NORESERVE | libc::MAP_PRIVATE | libc::MAP_ANON;
94    // SAFETY: We mmap one anonymous page, with no special flags, so this has no safety
95    // implications.
96    let first_mmap = unsafe {
97        libc::mmap(
98            core::ptr::null_mut(),
99            map_size,
100            libc::PROT_NONE,
101            flags,
102            -1,
103            0,
104        )
105    };
106    assert_ne!(first_mmap, libc::MAP_FAILED, "mmap not allowed?");
107
108    let remap_flags =
109        libc::MAP_ANONYMOUS | libc::MAP_FIXED | libc::MAP_PRIVATE | libc::MAP_EXECUTABLE;
110    // remap the page with PROT_EXEC. If this fails, JIT is not possible.
111    let second_mmap = unsafe {
112        libc::mmap(
113            first_mmap,
114            map_size,
115            libc::PROT_READ | libc::PROT_EXEC,
116            remap_flags,
117            -1,
118            0,
119        )
120    };
121    let mut jit_forbidden = second_mmap == libc::MAP_FAILED;
122    if !jit_forbidden {
123        // Spidermonkey uses mprotect to make the memory writable.
124        // SAFETY: We obtained the memory in question via `mmap` and are not using the memory
125        // in any way.
126        let res =
127            unsafe { libc::mprotect(first_mmap, map_size, libc::PROT_READ | libc::PROT_WRITE) };
128        if res != 0 {
129            // `mprotect` failed (to add write permissions), so we presume it is because JIT is forbidden.
130            jit_forbidden = true;
131        } else {
132            // Additionally check if `mprotect` actually succeeded in adding `PROT_WRITE`.
133            // We observed before that `mprotect` silently ignores the write permission without
134            // returning an error.
135            let is_writable = mem_is_writable(first_mmap)
136                .inspect_err(|_e| {
137                    debug!("Failed to determine if JIT is allowed. Conservatively assuming it is forbidden.");
138                })
139                .unwrap_or(false); // writable == false -> JIT is forbidden.
140            jit_forbidden = !is_writable;
141        }
142    }
143    // Ignore the result, since there is nothing we could do if unmap failed for whatever reason.
144    // SAFETY: We unmap the `mmap`ed region completely again. There is no other `munmap` call in
145    // this function, and we do not have any early returns in this function.
146    let _ = unsafe { libc::munmap(first_mmap, map_size) };
147
148    jit_forbidden
149}
150
151#[cfg(not(target_env = "ohos"))]
152fn jit_forbidden() -> bool {
153    false
154}
155
156#[expect(unsafe_code)]
157#[servo_tracing::instrument(name = "script::init")]
158pub fn init() -> JSEngineSetup {
159    if pref!(js_disable_jit) || jit_forbidden() {
160        let reason = if pref!(js_disable_jit) {
161            "preference `js_disable_jit` is set to true"
162        } else {
163            "runtime test determined JIT is forbidden on this system"
164        };
165        warn!("Disabling JIT for Javascript, since {reason}. This may cause subpar performance");
166        // SAFETY: This function has no particular preconditions.
167        unsafe {
168            js::jsapi::DisableJitBackend();
169        }
170    }
171    proxyhandler::init();
172
173    // Create the global vtables used by the (generated) DOM
174    // bindings to implement JS proxies.
175    RegisterBindings::RegisterProxyHandlers::<crate::DomTypeHolder>();
176    RegisterBindings::InitAllStatics::<crate::DomTypeHolder>();
177
178    unsafe {
179        js::glue::InitializeMemoryReporter(Some(is_dom_object));
180    }
181
182    raise_file_handle_limit();
183
184    JSEngineSetup::default()
185}
script/engine/init.rs

script/engine/
init.rs
