Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-27 12:50:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1303714 - Always Unwrap ArrayBuffer in TypedArray constructor. r=bholley

Browse Source
This commit is contained in:
Tom Schuster 2016-10-03 21:19:09 +02:00
parent 4c034fe691
commit 4e49d5103f
2 changed files with 44 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

85
js/src/vm/TypedArrayObject.cpp
View File

@ -765,15 +765,6 @@ class TypedArrayObjectTemplate : public TypedArrayObject
fromBufferWithProto(JSContext* cx, HandleObject bufobj, uint32_t byteOffset, int32_t lengthInt,
HandleObject proto)
{
ESClass cls;
if (!GetBuiltinClass(cx, bufobj, &cls))
return nullptr;
if (cls != ESClass::ArrayBuffer && cls != ESClass::SharedArrayBuffer) {
JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
return nullptr;
}
MOZ_ASSERT(IsArrayBuffer(bufobj) || IsSharedArrayBuffer(bufobj) || bufobj->is<ProxyObject>());
if (bufobj->is<ProxyObject>()) {
/*
* Normally, NonGenericMethodGuard handles the case of transparent
@ -791,44 +782,48 @@ class TypedArrayObjectTemplate : public TypedArrayObject
JS_ReportErrorASCII(cx, "Permission denied to access object");
return nullptr;
}
if (IsArrayBuffer(wrapped) || IsSharedArrayBuffer(wrapped)) {
/*
* And for even more fun, the new view's prototype should be
* set to the origin compartment's prototype object, not the
* target's (specifically, the actual view in the target
* compartment will use as its prototype a wrapper around the
* origin compartment's view.prototype object).
*
* Rather than hack some crazy solution together, implement
* this all using a private helper function, created when
* ArrayBufferObject was initialized and cached in the global.
* This reuses all the existing cross-compartment crazy so we
* don't have to do anything *uniquely* crazy here.
*/
RootedObject protoRoot(cx, proto);
if (!protoRoot) {
if (!GetBuiltinPrototype(cx, JSCLASS_CACHED_PROTO_KEY(instanceClass()), &protoRoot))
return nullptr;
}
FixedInvokeArgs<3> args(cx);
args[0].setNumber(byteOffset);
args[1].setInt32(lengthInt);
args[2].setObject(*protoRoot);
RootedValue fval(cx);
if (!getOrCreateCreateArrayFromBufferFunction(cx, &fval))
return nullptr;
RootedValue thisv(cx, ObjectValue(*bufobj));
RootedValue rval(cx);
if (!js::Call(cx, fval, thisv, args, &rval))
return nullptr;
return &rval.toObject();
if (!IsArrayBuffer(wrapped) && !IsSharedArrayBuffer(wrapped)) {
JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
return nullptr; // must be arrayBuffer
}
/*
* And for even more fun, the new view's prototype should be
* set to the origin compartment's prototype object, not the
* target's (specifically, the actual view in the target
* compartment will use as its prototype a wrapper around the
* origin compartment's view.prototype object).
*
* Rather than hack some crazy solution together, implement
* this all using a private helper function, created when
* ArrayBufferObject was initialized and cached in the global.
* This reuses all the existing cross-compartment crazy so we
* don't have to do anything *uniquely* crazy here.
*/
RootedObject protoRoot(cx, proto);
if (!protoRoot) {
if (!GetBuiltinPrototype(cx, JSCLASS_CACHED_PROTO_KEY(instanceClass()), &protoRoot))
return nullptr;
}
FixedInvokeArgs<3> args(cx);
args[0].setNumber(byteOffset);
args[1].setInt32(lengthInt);
args[2].setObject(*protoRoot);
RootedValue fval(cx);
if (!getOrCreateCreateArrayFromBufferFunction(cx, &fval))
return nullptr;
RootedValue thisv(cx, ObjectValue(*bufobj));
RootedValue rval(cx);
if (!js::Call(cx, fval, thisv, args, &rval))
return nullptr;
return &rval.toObject();
}
if (!IsArrayBuffer(bufobj) && !IsSharedArrayBuffer(bufobj)) {

4
js/xpconnect/tests/chrome/test_xrayToJS.xul
View File

@ -753,6 +753,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=933681
is(t.length, 10, "Length accessor works over Xrays")
is(t.byteLength, t.length * window[c].prototype.BYTES_PER_ELEMENT, "byteLength accessor works over Xrays")
// Can create TypedArray from content ArrayBuffer
var buffer = new iwin.ArrayBuffer(8);
eval(`new ${c}(buffer);`);
var xray = new iwin[c](0);
var xrayTypedArrayProto = Object.getPrototypeOf(Object.getPrototypeOf(xray));
testProtoCallables(inheritedCallables, new iwin[c](0), xrayTypedArrayProto, typedArrayProto);