Modern JavaScript includes the SharedArrayBuffer feature, which provides
access to true shared memory concurrency. SharedArrayBuffers are simple linear
buffers of bytes, and the JavaScript specification defines an axiomatic relaxed
memory model to describe their behaviour. While this model is heavily based on
the C/C++11 model, it diverges in some key areas. JavaScript chooses to give a
well-defined semantics to data-races, unlike the "undefined behaviour" of
C/C++11. Moreover, the JavaScript model is mixed-size. This means that its
accesses are not to discrete locations, but to (possibly overlapping) ranges of
bytes.
We show that the model, in violation of the design intention, does not
support a compilation scheme to ARMv8 which is used in practice. We propose a
correction, which also incorporates a previously proposed fix for a failure of
the model to provide Sequential Consistency of Data-Race-Free programs
(SC-DRF), an important correctness condition. We use model checking, in Alloy,
to generate small counter-examples for these deficiencies, and investigate our
correction. To accomplish this, we also develop a mixed-size extension to the
existing ARMv8 axiomatic model.
Guided by our Alloy experimentation, we mechanise (in Coq) the JavaScript
model (corrected and uncorrected), our ARMv8 model, and, for the corrected
JavaScript model, a "model-internal" SC-DRF proof and a compilation scheme
correctness proof to ARMv8. In addition, we investigate a non-mixed-size subset
of the corrected JavaScript model, and give proofs of compilation correctness
for this subset to x86-TSO, Power, RISC-V, ARMv7, and (again) ARMv8, via the
Intermediate Memory Model (IMM).
As a result of our work, the JavaScript standards body (ECMA TC39) will
include fixes for both issues in an upcoming edition of the specification.