!4516 Bugfix on JSStableArray::FastCopyFromArrayToTypedArray

Merge pull request !4516 from chenjingxiang/fast_copy_array_to_typed_array
This commit is contained in:
openharmony_ci 2023-08-02 02:33:22 +00:00 committed by Gitee
commit 827770770a
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
3 changed files with 11 additions and 1 deletions

View File

@ -639,7 +639,7 @@ JSTaggedValue JSStableArray::FastCopyFromArrayToTypedArray(JSThread *thread, JSH
uint32_t targetLength = targetArray->GetArrayLength();
uint32_t targetByteOffset = targetArray->GetByteOffset();
uint32_t targetElementSize = TypedArrayHelper::GetSizeFromType(targetType);
if (srcLength + targetOffset > targetLength) {
if (srcLength + static_cast<uint64_t>(targetOffset) > targetLength) {
THROW_RANGE_ERROR_AND_RETURN(thread, "The sum of length and targetOffset is greater than targetLength.",
JSTaggedValue::Exception());
}

View File

@ -28,3 +28,4 @@ test successful !!!
test successful !!!
false
test successful !!!
test successful !!!

View File

@ -205,4 +205,13 @@ try {
const a9 = new Float64Array(a8);
} catch (e) {
print("test successful !!!");
}
try {
const a10 = [1, 2];
const a11 = new Uint8Array(a10);
const a12 = new Uint32Array(a11);
a12.set(a10, 0x1ffffffff);
} catch (e) {
print("test successful !!!");
}