1406182 - Own 'length' property affects TypedArray preview and inspection

Status: RESOLVED FIXED

(DevTools :: Console, defect)

Description

[Oriol Brufau [:Oriol]]

Enter this code to the console:
    Object.defineProperty(new Uint8Array([1,2,3]), 'length', {value: 0})
Result:
    ▶ Uint8Array []
Expected:
    ▶ Uint8Array [ 1, 2, 3 ]

Inspect the object.
Result:
    ▼ […]
      ▶ buffer: ArrayBuffer { byteLength: 3 }
        byteLength: 3
        byteOffset: 0
        length: 0
      ▶ __proto__: Uint8ArrayPrototype { … }
Expected:
    ▼ […]
        0: 1
        1: 2
        2: 3
      ▶ buffer: ArrayBuffer { byteLength: 3 }
        byteLength: 3
        byteOffset: 0
        length: 0
      ▶ __proto__: Uint8ArrayPrototype { … }

The safe way to know the length of a typed array seems something like

    Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'length').get.call(typedArray)

Comment 1

[Oriol Brufau [:Oriol]]

Attachment: Bug 1406182 - Obtain the length of typed arrays in a safe way.

Review commit: https://reviewboard.mozilla.org/r/187480/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/187480/

Comment 2

[Nicolas Chevobbe [:nchevobbe]]

Comment on attachment 8916259 [details]
Bug 1406182 - Obtain the length of typed arrays in a safe way.

https://reviewboard.mozilla.org/r/187480/#review192618

Only a couple of nit but this looks good, thanks Oriol !

::: devtools/server/actors/object.js:120
(Diff revision 1)
>      }
>  
>      // FF40+: Allow to know how many properties an object has to lazily display them
>      // when there is a bunch.
>      if (isTypedArray(g)) {
>        // Bug 1348761: getOwnPropertyNames is unnecessary slow on TypedArrays

nit: Could we move this comment in `getArrayLength` too so we don't try to use getOwnPropertyNames there ?

::: devtools/server/actors/object.js:2534
(Diff revision 1)
> +    let typedProto = Object.getPrototypeOf(Uint8Array.prototype);
> +    let getter = Object.getOwnPropertyDescriptor(typedProto, "length").get;
> +    return getter.call(object.unsafeDereference());
> +  }
> +
> +  throw new Error("Expected an array, got a " + object.class);

nit: can we throw earlier (at the top of the function) if `object` is not an array/typed array

Comment 3

[Oriol Brufau [:Oriol]]

Comment on attachment 8916259 [details]
Bug 1406182 - Obtain the length of typed arrays in a safe way.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/187480/diff/1-2/

Comment 4

[Oriol Brufau [:Oriol]]

Fixed nits.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d4641f9d27a0
Obtain the length of typed arrays in a safe way. r=nchevobbe

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/d4641f9d27a0

Comment 7

[Md Maruf Rahman]

I have reproduced this bug with Nightly 58.0a1 (2017-10-05) on Windows 10, 64 Bit!

This bug's fix is verified with latest Beta!

Build ID   :   20171218174357
User Agent :   Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0

Comment 8

[Tanvir Rahman]

I have reproduced this bug with Nightly 58.0a1 (2017-10-05) on Ubuntu 16.04

The bug's fix is now verified with latest Beta 58.0b12

Build ID 	20171218174357
User Agent 	Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0