1289392 - Detachment check in TypedArray.prototype.sort doesn't work for typed arrays with inline storage or cross-compartment

Status: RESOLVED FIXED

(Core :: JavaScript: Standard Library, defect)

Description

[André Bargull [:anba]]

Test case 1:
---
var detached = false;
var ta = new Int32Array(3);
ta.sort(function(a,b) {
    print("COMPARE");
    if (!detached) {
        detached = true;
        detachArrayBuffer(ta.buffer, "same-data");
    }
    return a - b;
});
---

Expected: Throws TypeError
Actual: No TypeError

Note: See comment in SetFromNonTypedArray (builtin/TypedArray.js) about inline storage.



Test case 2:
---
var ta = new Int32Array(30);

newGlobal().Int32Array.prototype.sort.call(ta, function(a,b) {
    print("COMPARE");
    return a - b;
});
---

Expected: No TypeError
Actual: Throws TypeError

Note: The detachment check uses the wrong `this` when calling CallTypedArrayMethodIfWrapped for "IsDetachedBuffer".

Comment 1

[André Bargull [:anba]]

Attachment: bug1289392.patch

Comment 2

[André Bargull [:anba]]

Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=86cf94147997f0676e8a12b2416eadd8dcc32676

Comment 3

[Till Schneidereit [:till]]

Comment on attachment 8802260 [details] [diff] [review]
bug1289392.patch

Review of attachment 8802260 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good to me, thank you for fixing this.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/75faf4827dcf
Check for detached ArrayBuffers with inline or cross-compartment in TypedArray.prototype.sort. r=evilpie

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/75faf4827dcf