Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-29 15:52:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1150858 - Unwrap the correct object in ArrayBuffer.transfer (r=sfink)

Browse Source 
--HG--
extra : rebase_source : 29cd797c9194ff80bf2686f64c9a63230f07c63a
This commit is contained in:
Luke Wagner 2015-04-03 08:33:19 -05:00
parent 3fb5c58fd6
commit eeb4b48b4d
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/src/jit-test/tests/basic/testArrayBufferTransfer.js
View File

@ -55,6 +55,12 @@ assertEq(buf1.byteLength, 0);
assertEq(buf2.byteLength, 9);
assertThrowsInstanceOf(()=>XF(buf1), TypeError);
// cross-compartment wrapper
var buf3 = newGlobal().eval("new ArrayBuffer(10)");
var buf4 = XF(buf3, 20);
assertEq(buf4.byteLength, 20);
assertThrowsInstanceOf(()=>XF(buf3), TypeError);
// test going to from various sizes
function test(N1, N2) {
var buf1 = new ArrayBuffer(N1);

4
js/src/vm/ArrayBufferObject.cpp
View File

@ -360,8 +360,8 @@ ArrayBufferObject::fun_transfer(JSContext* cx, unsigned argc, Value* vp)
if (oldBufferObj->is<ArrayBufferObject>()) {
oldBuffer = &oldBufferObj->as<ArrayBufferObject>();
} else {
JSObject* unwrapped = CheckedUnwrap(oldBuffer);
if (!unwrapped->is<ArrayBufferObject>()) {
JSObject* unwrapped = CheckedUnwrap(oldBufferObj);
if (!unwrapped || !unwrapped->is<ArrayBufferObject>()) {
JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
return false;
}