wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 981650 -- Check the variable-size flag on the type descriptor, not the type representation r=sfink

Browse Source
This commit is contained in:
Nicholas D. Matsakis 2014-03-18 08:19:04 -04:00
parent 7dbffe4461
commit 0c85de4c93
2 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
js/src/builtin/TypedObject.js
View File

@ -453,9 +453,9 @@ function SetTypedObjectValue(descr, typedObj, offset, fromValue) {
new TypedObjectPointer(descr, typedObj, offset).set(fromValue);
}
// Assigns `fromValue` to the memory pointed at by `this`, adapting it
// to `typeRepr` as needed. This is the most general entry point and
// works for any type.
// Writes `fromValue` into the memory pointed at by `this`, adapting
// it to `typeRepr` as needed. This is the most general entry point
// and works for any type.
TypedObjectPointer.prototype.set = function(fromValue) {
assert(TypedObjectIsAttached(this.typedObj), "set() called with unattached typedObj");
@ -464,7 +464,7 @@ TypedObjectPointer.prototype.set = function(fromValue) {
// memcpy.
if (IsObject(fromValue) && ObjectIsTypedObject(fromValue)) {
var typeRepr = DESCR_TYPE_REPR(this.descr);
if (!typeRepr.variable && TYPEDOBJ_TYPE_REPR(fromValue) === typeRepr) {
if (!this.descr.variable && TYPEDOBJ_TYPE_REPR(fromValue) === typeRepr) {
if (!TypedObjectIsAttached(fromValue))
ThrowError(JSMSG_TYPEDOBJECT_HANDLE_UNATTACHED);

10
js/src/jit-test/tests/TypedObject/Bug981650.js Normal file
View File

@ -0,0 +1,10 @@
// Fuzz bug 981650: Test creating an unsized array type based on an instance of
// that same type.
if (typeof TypedObject === "undefined")
quit();
var T = TypedObject;
var AT = new T.ArrayType(T.int32);
var v = new AT(10);
new AT(v);