Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-09 03:15:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1082649 - Check for neutered typed objects before accessing their byte offset, r=nmatsakis.

Browse Source
This commit is contained in:
Brian Hackett 2014-10-28 18:56:27 -07:00
parent eac7e8e4cb
commit a0c5f54031
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/src/builtin/TypedObject.js
View File

@ -556,6 +556,9 @@ function StorageOfTypedObject(obj) {
return null;
if (ObjectIsTransparentTypedObject(obj)) {
if (!TypedObjectIsAttached(obj))
ThrowError(JSMSG_TYPEDOBJECT_HANDLE_UNATTACHED);
var descr = TypedObjectTypeDescr(obj);
var byteLength;
if (DESCR_KIND(descr) == JS_TYPEREPR_UNSIZED_ARRAY_KIND)
@ -1144,6 +1147,9 @@ function MapTypedParImplDepth1(inArray, inArrayType, outArrayType, func) {
assert(IsObject(inArray) && ObjectIsTypedObject(inArray),
"DoMapTypedParDepth1: invalid inArray");
if (!TypedObjectIsAttached(inArray))
ThrowError(JSMSG_TYPEDOBJECT_HANDLE_UNATTACHED);
// Determine the grain types of the input and output.
const inGrainType = inArrayType.elementType;
const outGrainType = outArrayType.elementType;

16
js/src/jit-test/tests/TypedObject/bug1082649.js Normal file
View File

@ -0,0 +1,16 @@
if (typeof TypedObject === "undefined")
quit();
var {StructType, uint32, storage} = TypedObject;
var S = new StructType({f: uint32, g: uint32});
function main(variant) {
var s = new S({f: 22, g: 44});
neuter(storage(s).buffer, variant);
print(storage(s).byteOffset);
}
try {
main("same-data");
assertEq(true, false);
} catch (e) {
assertEq(e instanceof TypeError, true);
}