AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[rab/gsab] Fix accessing raw byte length

Browse Source 
Bug: v8:11111,chromium:1347721
Change-Id: Idff4256f6720841ca4dee8f691babe7245277046
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3782812
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81995}
This commit is contained in:
Marja Hölttä 2022-07-27 11:23:21 +02:00 committed by V8 LUCI CQ
parent ccefc2e273
commit fb19bc369b
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/objects/elements.cc
View File

@ -3735,8 +3735,8 @@ class TypedElementsAccessor
uint8_t* source_data = static_cast<uint8_t*>(source.DataPtr());
uint8_t* dest_data = static_cast<uint8_t*>(destination.DataPtr());
size_t source_byte_length = source.byte_length();
size_t dest_byte_length = destination.byte_length();
size_t source_byte_length = source.GetByteLength();
size_t dest_byte_length = destination.GetByteLength();
bool source_shared = source.buffer().is_shared();
bool destination_shared = destination.buffer().is_shared();

13
test/mjsunit/regress/regress-crbug-1347721.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --harmony-rab-gsab
for (let i = 0; i < 10000; i++) {
const rab = new ArrayBuffer(1632, {"maxByteLength": 9943683});
const ta1 = new Uint32Array(rab);
const ta2 = new Float32Array(rab);
rab.resize(2004);
ta1["set"](ta2);
}