mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Bug 867329 - Make JS_NewUint8Array and friends accept any uint32_t as length and throw if the length is too big -- not assert when it's too big. r=sfink
This commit is contained in:
parent
d349e7c9e0
commit
08885153f0
@ -59,6 +59,11 @@ template<JSObject *Create(JSContext *, uint32_t),
|
||||
bool
|
||||
TestPlainTypedArray(JSContext *cx)
|
||||
{
|
||||
{
|
||||
RootedObject notArray(cx, Create(cx, UINT32_MAX));
|
||||
CHECK(!notArray);
|
||||
}
|
||||
|
||||
RootedObject array(cx, Create(cx, 7));
|
||||
CHECK(JS_IsTypedArrayObject(array));
|
||||
RootedObject proto(cx);
|
||||
|
@ -2201,7 +2201,7 @@ class TypedArrayTemplate
|
||||
}
|
||||
|
||||
static JSObject *
|
||||
fromLength(JSContext *cx, int32_t nelements)
|
||||
fromLength(JSContext *cx, uint32_t nelements)
|
||||
{
|
||||
RootedObject buffer(cx, createBufferWithSizeAndCount(cx, nelements));
|
||||
if (!buffer)
|
||||
@ -3371,7 +3371,6 @@ const JSFunctionSpec _typedArray::jsfuncs[] = { \
|
||||
#define IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Name,NativeType) \
|
||||
JS_FRIEND_API(JSObject *) JS_New ## Name ## Array(JSContext *cx, uint32_t nelements) \
|
||||
{ \
|
||||
MOZ_ASSERT(nelements <= INT32_MAX); \
|
||||
return TypedArrayTemplate<NativeType>::fromLength(cx, nelements); \
|
||||
} \
|
||||
JS_FRIEND_API(JSObject *) JS_New ## Name ## ArrayFromArray(JSContext *cx, JSObject *other_)\
|
||||
|
Loading…
Reference in New Issue
Block a user