From d33cebae08d01f3fe88664c14211193d8fef7e28 Mon Sep 17 00:00:00 2001
From: Luke Wagner <luke@mozilla.com>
Date: Tue, 28 Nov 2017 22:58:21 -0600
Subject: [PATCH] Bug 1415291 - Baldr: factor out ToTableIndex() (r=bbouvier)

MozReview-Commit-ID: 9T8pJS5ajgT
---
 js/src/wasm/WasmJS.cpp | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
index a557319f5dc1..6955c7904d11 100644
--- a/js/src/wasm/WasmJS.cpp
+++ b/js/src/wasm/WasmJS.cpp
@@ -1729,6 +1729,20 @@ const JSPropertySpec WasmTableObject::properties[] =
     JS_PS_END
 };
 
+static bool
+ToTableIndex(JSContext* cx, HandleValue v, const Table& table, const char* noun, uint32_t* index)
+{
+    if (!EnforceRangeU32(cx, v, UINT32_MAX, "Table", noun, index))
+        return false;
+
+    if (*index >= table.length()) {
+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_UINT32, "Table", noun);
+        return false;
+    }
+
+    return true;
+}
+
 /* static */ bool
 WasmTableObject::getImpl(JSContext* cx, const CallArgs& args)
 {
@@ -1736,7 +1750,7 @@ WasmTableObject::getImpl(JSContext* cx, const CallArgs& args)
     const Table& table = tableObj->table();
 
     uint32_t index;
-    if (!EnforceRangeU32(cx, args.get(0), table.length() - 1, "Table", "get index", &index))
+    if (!ToTableIndex(cx, args.get(0), table, "get index", &index))
         return false;
 
     ExternalTableElem& elem = table.externalArray()[index];
@@ -1775,7 +1789,7 @@ WasmTableObject::setImpl(JSContext* cx, const CallArgs& args)
         return false;
 
     uint32_t index;
-    if (!EnforceRangeU32(cx, args.get(0), table.length() - 1, "Table", "set index", &index))
+    if (!ToTableIndex(cx, args.get(0), table, "set index", &index))
         return false;
 
     RootedFunction value(cx);