Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-28 12:45:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 853576 - Check for negative indices supplied in scatter r=shu

Browse Source
This commit is contained in:
Nicholas D. Matsakis 2013-03-27 20:59:46 -04:00
parent 5f91c8a9a9
commit 4a830070da
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/builtin/ParallelArray.js
View File

@ -953,7 +953,7 @@ function ParallelArrayScatter(targets, defaultValue, conflictFunc, length, mode)
if ((t | 0) !== t)
ThrowError(JSMSG_PAR_ARRAY_SCATTER_BAD_TARGET, i);
if (t >= length)
if (t < 0 || t >= length)
ThrowError(JSMSG_PAR_ARRAY_SCATTER_BOUNDS);
}
}

6
js/src/jit-test/tests/parallelarray/bug853576.js Normal file
View File

@ -0,0 +1,6 @@
var len = 2;
function add1(x) { return x+1; }
var p = new ParallelArray(len, add1);
var idx = [0,0].concat(build(len-4, add1)).concat([len-3,len-3]);
var revidx = idx.reverse();
var r = p.scatter(revidx, 0, function (x,y) { return x+y; }, len-2, {});