Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-24 10:45:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1452571 - Baldr: fix IsBufferSource on DataView and prevent shell-only rooting bug (r=anba)

Browse Source
This commit is contained in:
Luke Wagner 2018-04-19 14:28:01 +02:00
parent f4056b78d5
commit b34afec0b2
2 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
js/src/shell/js.cpp
View File

@ -5810,13 +5810,6 @@ EnsureLatin1CharsLinearString(JSContext* cx, HandleValue value, JS::MutableHandl
static bool
ConsumeBufferSource(JSContext* cx, JS::HandleObject obj, JS::MimeType, JS::StreamConsumer* consumer)
{
SharedMem<uint8_t*> dataPointer;
size_t byteLength;
if (!IsBufferSource(obj, &dataPointer, &byteLength)) {
JS_ReportErrorASCII(cx, "shell streaming consumes a buffer source (buffer or view)");
return false;
}
{
RootedValue url(cx);
if (!JS_GetProperty(cx, obj, "url", &url))
@ -5841,6 +5834,13 @@ ConsumeBufferSource(JSContext* cx, JS::HandleObject obj, JS::MimeType, JS::Strea
: nullptr);
}
SharedMem<uint8_t*> dataPointer;
size_t byteLength;
if (!IsBufferSource(obj, &dataPointer, &byteLength)) {
JS_ReportErrorASCII(cx, "shell streaming consumes a buffer source (buffer or view)");
return false;
}
auto job = cx->make_unique<BufferStreamJob>(consumer);
if (!job || !job->bytes.resize(byteLength))
return false;

1
js/src/vm/TypedArrayObject.cpp
View File

@ -2140,6 +2140,7 @@ js::IsBufferSource(JSObject* object, SharedMem<uint8_t*>* dataPointer, size_t* b
DataViewObject& view = object->as<DataViewObject>();
*dataPointer = view.dataPointerEither().cast<uint8_t*>();
*byteLength = view.byteLength();
return true;
}
if (object->is<ArrayBufferObject>()) {