AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Allow pathological zero-length typed arrays.

Browse Source 
R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/14857002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14520 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
dslomov@chromium.org 2013-05-02 13:51:03 +00:00
parent 343bf33918
commit 8b1f81fa24
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/typedarray.js
View File

@ -93,7 +93,7 @@ function CreateTypedArrayConstructor(name, elementSize, arrayId, constructor) {
"start offset", name, elementSize);
}
var bufferByteLength = %ArrayBufferGetByteLength(buffer);
if (offset >= bufferByteLength) {
if (offset > bufferByteLength) {
throw MakeRangeError("invalid_typed_array_offset");
}

16
test/mjsunit/harmony/typedarrays.js
View File

@ -191,7 +191,13 @@ function TestTypedArray(proto, elementSize, typicalElement) {
assertSame(typicalElement, a4[i]);
}
assertThrows(function () { new proto(ab, 256*elementSize); }, RangeError);
var aAtTheEnd = new proto(ab, 256*elementSize);
assertSame(elementSize, aAtTheEnd.BYTES_PER_ELEMENT);
assertSame(0, aAtTheEnd.length);
assertSame(0, aAtTheEnd.byteLength);
assertSame(256*elementSize, aAtTheEnd.byteOffset);
assertThrows(function () { new proto(ab, 257*elementSize); }, RangeError);
assertThrows(
function () { new proto(ab, 128*elementSize, 192); },
RangeError);
@ -229,6 +235,14 @@ function TestTypedArray(proto, elementSize, typicalElement) {
for (i = 0; i < 30; i++) {
assertSame(typicalElement, aFromArray[i]);
}
var abLen0 = new ArrayBuffer(0);
var aOverAbLen0 = new proto(abLen0);
assertSame(abLen0, aOverAbLen0.buffer);
assertSame(elementSize, aOverAbLen0.BYTES_PER_ELEMENT);
assertSame(0, aOverAbLen0.length);
assertSame(0, aOverAbLen0.byteLength);
assertSame(0, aOverAbLen0.byteOffset);
}
TestTypedArray(Uint8Array, 1, 0xFF);