wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

b=571014; assertion when accessing ArrayBuffer props; r=brendan

Browse Source
This commit is contained in:
Vladimir Vukicevic 2010-06-09 19:05:00 -07:00
parent 050bac772e
commit 601bca059e
3 changed files with 31 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
js/src/jstypedarray.cpp
View File

@ -77,7 +77,8 @@ using namespace js;
ArrayBuffer *
ArrayBuffer::fromJSObject(JSObject *obj)
{
JS_ASSERT(obj->getClass() == &ArrayBuffer::jsclass);
while (!js_IsArrayBuffer(obj))
obj = obj->getProto();
return reinterpret_cast<ArrayBuffer*>(obj->getPrivate());
}
@ -207,6 +208,8 @@ ArrayBuffer::~ArrayBuffer()
TypedArray *
TypedArray::fromJSObject(JSObject *obj)
{
while (!js_IsTypedArray(obj))
obj = obj->getProto();
return reinterpret_cast<TypedArray*>(obj->getPrivate());
}
@ -823,6 +826,9 @@ class TypedArrayTemplate
argv = JS_ARGV(cx, vp);
obj = JS_THIS_OBJECT(cx, vp);
if (!JS_InstanceOf(cx, obj, ThisTypeArray::fastClass(), vp+2))
return false;
ThisTypeArray *tarray = ThisTypeArray::fromJSObject(obj);
if (!tarray)
return true;

3
js/src/tests/js1_8_5/regress/jstests.list
View File

@ -22,4 +22,5 @@ script regress-563221.js
script regress-566549.js
script regress-566914.js
script regress-567152.js
script regress-569306.js
script regress-569306.js
script regress-571014.js

22
js/src/tests/js1_8_5/regress/regress-571014.js Normal file
View File

@ -0,0 +1,22 @@
var F, o;
F = function () {};
F.prototype = new ArrayBuffer(1);
o = new F();
assertEq(o.byteLength, 1); // should be no assertion here
o = {};
o.__proto__ = new Int32Array(1);
assertEq(o.buffer.byteLength, 4); // should be no assertion here
F = function () {};
F.prototype = new Int32Array(1);
o = new F();
try {
o.slice(0, 1);
reportFailure("Expected an exception!");
} catch (ex) {
}
reportCompare("ok", "ok", "bug 571014");