899760 - Handlify ToInt32 & friends and add operator const T& to MutableHandle

Status: RESOLVED DUPLICATE of bug 899976

(Core :: JavaScript Engine, defect)

Description

[Steve Fink [:sfink] [:s:]]

We have lots of places where args[] flows into ToInt32 or similar, which still takes a const Value&, which gives us a ton of unsafe references.

Comment 1

[Steve Fink [:sfink] [:s:]]

Attachment: Handlify ToUint32 and friends

The one tricky bit, that I probably ought to r? Waldo on but I think you can see from code inspection now, is that the weirdness about <typedarray>::create being called with a degenerate vp (with no argv[-2] or argv[-1]) is gone. Waldo killed it.

Comment 2

[Terrence Cole [:terrence]]

Comment on attachment 783342 [details] [diff] [review]
Handlify ToUint32 and friends

Review of attachment 783342 [details] [diff] [review]:
-----------------------------------------------------------------

r=me

::: js/src/vm/TypedArrayObject.cpp
@@ +191,2 @@
>      int32_t nbytes = 0;
> +    if (argc > 0 && !ToInt32(cx, args[0], &nbytes))

s/argc/args.length()/

Comment 4

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Comment on attachment 783342 [details] [diff] [review]
Handlify ToUint32 and friends

Review of attachment 783342 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/AsmJS.cpp
@@ +5794,2 @@
>  
>      return true;

Why does this return int32_t?