1592547 - TypedArray's length limited to one less element than the maximum valid limit

Status: RESOLVED DUPLICATE of bug 1689308

(Core :: JavaScript Engine, defect, P3)

Description

[André Bargull [:anba]]

TypedArray's length is limited to one less element than the actual maximum valid limit (which is UINT32_MAX - BYTES_PER_ELEMENT). If there's a technical reason for this, we should document it more clearly. If there's no technical reason, we should use the actual maximum limit.

Example:

js> var ab = new ArrayBuffer(0x7fff_ffff)
js> var ta = new Int8Array(ab)
typein:2:10 RangeError: attempting to construct out-of-bounds TypedArray on ArrayBuffer
Stack:
  @typein:2:10
js> var ta = new Int8Array(ab.slice(1))
js>

js> var ab = new ArrayBuffer(0x7fff_fff8) 
js> var ta = new Float64Array(ab)
typein:2:10 RangeError: attempting to construct out-of-bounds TypedArray on ArrayBuffer
Stack:
  @typein:2:10
js> var ta = new Float64Array(ab.slice(8))
js>

Comment 1

[Jason Orendorff [:jorendorff]]

I see a bunch of stuff like this but I don't see any code that actually uses INT32_MAX for any special purpose related to TypedArray length or byteLength.

I think we can just change this.

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: Bug 1592547 - Fix TypedArray length limit. r?jandem

Comment 3

[Jan de Mooij [:jandem]]

I'm fixing this in bug 1689308 (I started writing the patch, then found this bug).