Bug 1087873: Fix signed/unsigned comparisons in Shuffle/Swizzle; r=till

This commit is contained in:
Benjamin Bouvier 2014-10-27 11:29:25 +01:00
parent b2034fd10d
commit 142aaa69e4

View File

@ -712,14 +712,14 @@ Swizzle(JSContext *cx, unsigned argc, Value *vp)
if (args.length() != (V::lanes + 1) || !IsVectorObject<V>(args[0]))
return ErrorBadArgs(cx);
int32_t lanes[V::lanes];
uint32_t lanes[V::lanes];
for (unsigned i = 0; i < V::lanes; i++) {
int32_t lane = -1;
if (!ToInt32(cx, args[i + 1], &lane))
return false;
if (lane < 0 || lane >= V::lanes)
if (lane < 0 || uint32_t(lane) >= V::lanes)
return ErrorBadArgs(cx);
lanes[i] = lane;
lanes[i] = uint32_t(lane);
}
Elem *val = TypedObjectMemory<Elem *>(args[0]);
@ -741,14 +741,14 @@ Shuffle(JSContext *cx, unsigned argc, Value *vp)
if (args.length() != (V::lanes + 2) || !IsVectorObject<V>(args[0]) || !IsVectorObject<V>(args[1]))
return ErrorBadArgs(cx);
int32_t lanes[V::lanes];
uint32_t lanes[V::lanes];
for (unsigned i = 0; i < V::lanes; i++) {
int32_t lane = -1;
if (!ToInt32(cx, args[i + 2], &lane))
return false;
if (lane < 0 || lane >= (2 * V::lanes))
if (lane < 0 || uint32_t(lane) >= (2 * V::lanes))
return ErrorBadArgs(cx);
lanes[i] = lane;
lanes[i] = uint32_t(lane);
}
Elem *lhs = TypedObjectMemory<Elem *>(args[0]);