1231924 - TypedArray: assert INT32_MAX

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Lars T Hansen [:lth]]

See bug 1176214 comment 76 and nearby:

--- 8>< ----------------------------------------------
> > > ::: js/src/jsfriendapi.h
> > > @@ +1211,5 @@
> > >      if (bufSlot.isObject()) {
> > > +        if (IsArrayBuffer(&bufSlot.toObject())) {
> > > +            ArrayBufferObject& buf = AsArrayBuffer(MaybeForwarded(&bufSlot.toObject()));
> > > +            int32_t offset = obj->getReservedSlot(TypedArrayObject::BYTEOFFSET_SLOT).toInt32();
> > > +            MOZ_ASSERT(buf.dataPointer() != nullptr);
> >
> > Assert offset >= 0?
> 
> Looking at code elsewhere, the correct type here is uint32_t, so I went that
> way instead.

Fair enough, but we should assert <= INT32_MAX, then, to detect the negative-number case.  (Typed array offsets/lengths/etc. all are int32_t-limited, precisely because of their being shoved into Values in reserved slots.)
--- 8>< ----------------------------------------------

Comment 1

[Lars T Hansen [:lth]]

Attachment: add assertions on BYTEOFFSET_SLOT

Comment 2

[Guilherme Lima]

Landed with the wrong number yesterday.
https://hg.mozilla.org/mozilla-central/rev/fa65591762ba