diff --git a/js/src/builtin/TypedArray.js b/js/src/builtin/TypedArray.js index 57f6d738ca..a8510faa71 100644 --- a/js/src/builtin/TypedArray.js +++ b/js/src/builtin/TypedArray.js @@ -2,8 +2,6 @@ * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ -#include "TypedObjectConstants.h" - function ViewedArrayBufferIfReified(tarray) { assert(IsTypedArray(tarray), "non-typed array asked for its buffer"); @@ -1781,7 +1779,7 @@ function ArrayBufferSlice(start, end) { ThrowTypeError(JSMSG_TYPED_ARRAY_DETACHED); // Steps 19-21. - ArrayBufferCopyData(new_, O, first | 0, newLen | 0, isWrapped); + ArrayBufferCopyData(new_, 0, O, first | 0, newLen | 0, isWrapped); // Step 22. return new_; @@ -1863,7 +1861,7 @@ function SharedArrayBufferSlice(start, end) { ThrowTypeError(JSMSG_SHORT_SHARED_ARRAY_BUFFER_RETURNED, newLen, actualLen); // Steps 16-18. - SharedArrayBufferCopyData(new_, O, first | 0, newLen | 0, isWrapped); + SharedArrayBufferCopyData(new_, 0, O, first | 0, newLen | 0, isWrapped); // Step 19. return new_; diff --git a/js/src/builtin/Utilities.js b/js/src/builtin/Utilities.js index 51c5a574fd..1cc15ed68e 100644 --- a/js/src/builtin/Utilities.js +++ b/js/src/builtin/Utilities.js @@ -23,6 +23,7 @@ */ #include "SelfHostingDefines.h" +#include "TypedObjectConstants.h" // Assertions and debug printing, defined here instead of in the header above // to make `assert` invisible to C++. diff --git a/js/src/vm/ArrayBufferObject.cpp b/js/src/vm/ArrayBufferObject.cpp index db1d7c798f..9e0bf3f4da 100644 --- a/js/src/vm/ArrayBufferObject.cpp +++ b/js/src/vm/ArrayBufferObject.cpp @@ -1255,15 +1255,16 @@ ArrayBufferObject::finalize(FreeOp* fop, JSObject* obj) } /* static */ void -ArrayBufferObject::copyData(Handle toBuffer, - Handle fromBuffer, - uint32_t fromIndex, uint32_t count) +ArrayBufferObject::copyData(Handle toBuffer, uint32_t toIndex, + Handle fromBuffer, uint32_t fromIndex, + uint32_t count) { MOZ_ASSERT(toBuffer->byteLength() >= count); + MOZ_ASSERT(toBuffer->byteLength() >= toIndex + count); MOZ_ASSERT(fromBuffer->byteLength() >= fromIndex); MOZ_ASSERT(fromBuffer->byteLength() >= fromIndex + count); - memcpy(toBuffer->dataPointer(), fromBuffer->dataPointer() + fromIndex, count); + memcpy(toBuffer->dataPointer() + toIndex, fromBuffer->dataPointer() + fromIndex, count); } /* static */ void diff --git a/js/src/vm/ArrayBufferObject.h b/js/src/vm/ArrayBufferObject.h index 4ff7962cfb..f4010c6c77 100644 --- a/js/src/vm/ArrayBufferObject.h +++ b/js/src/vm/ArrayBufferObject.h @@ -261,9 +261,9 @@ class ArrayBufferObject : public ArrayBufferObjectMaybeShared template static bool createTypedArrayFromBuffer(JSContext* cx, unsigned argc, Value* vp); - static void copyData(Handle toBuffer, - Handle fromBuffer, - uint32_t fromIndex, uint32_t count); + static void copyData(Handle toBuffer, uint32_t toIndex, + Handle fromBuffer, uint32_t fromIndex, + uint32_t count); static void trace(JSTracer* trc, JSObject* obj); static void objectMoved(JSObject* obj, const JSObject* old); diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp index e9c72d1bf1..e8e6ad937a 100644 --- a/js/src/vm/SelfHosting.cpp +++ b/js/src/vm/SelfHosting.cpp @@ -1098,9 +1098,9 @@ static bool intrinsic_ArrayBufferCopyData(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); - MOZ_ASSERT(args.length() == 5); + MOZ_ASSERT(args.length() == 6); - bool isWrapped = args[4].toBoolean(); + bool isWrapped = args[5].toBoolean(); Rooted toBuffer(cx); if (!isWrapped) { toBuffer = &args[0].toObject().as(); @@ -1114,11 +1114,12 @@ intrinsic_ArrayBufferCopyData(JSContext* cx, unsigned argc, Value* vp) } toBuffer = toBufferObj.as(); } - Rooted fromBuffer(cx, &args[1].toObject().as()); - uint32_t fromIndex = uint32_t(args[2].toInt32()); - uint32_t count = uint32_t(args[3].toInt32()); + uint32_t toIndex = uint32_t(args[1].toInt32()); + Rooted fromBuffer(cx, &args[2].toObject().as()); + uint32_t fromIndex = uint32_t(args[3].toInt32()); + uint32_t count = uint32_t(args[4].toInt32()); - T::copyData(toBuffer, fromBuffer, fromIndex, count); + T::copyData(toBuffer, toIndex, fromBuffer, fromIndex, count); args.rval().setUndefined(); return true; @@ -2426,14 +2427,14 @@ static const JSFunctionSpec intrinsic_functions[] = { intrinsic_PossiblyWrappedArrayBufferByteLength, 1,0, IntrinsicPossiblyWrappedArrayBufferByteLength), JS_FN("ArrayBufferCopyData", - intrinsic_ArrayBufferCopyData, 5,0), + intrinsic_ArrayBufferCopyData, 6,0), JS_FN("SharedArrayBufferByteLength", intrinsic_ArrayBufferByteLength, 1,0), JS_FN("PossiblyWrappedSharedArrayBufferByteLength", intrinsic_PossiblyWrappedArrayBufferByteLength, 1,0), JS_FN("SharedArrayBufferCopyData", - intrinsic_ArrayBufferCopyData, 5,0), + intrinsic_ArrayBufferCopyData, 6,0), JS_FN("IsUint8TypedArray", intrinsic_IsUint8TypedArray, 1,0), JS_FN("IsInt8TypedArray", intrinsic_IsInt8TypedArray, 1,0), diff --git a/js/src/vm/SharedArrayObject.cpp b/js/src/vm/SharedArrayObject.cpp index 8e55001d13..44fe3b790d 100644 --- a/js/src/vm/SharedArrayObject.cpp +++ b/js/src/vm/SharedArrayObject.cpp @@ -331,15 +331,16 @@ SharedArrayBufferObject::addSizeOfExcludingThis(JSObject* obj, mozilla::MallocSi } /* static */ void -SharedArrayBufferObject::copyData(Handle toBuffer, - Handle fromBuffer, - uint32_t fromIndex, uint32_t count) +SharedArrayBufferObject::copyData(Handle toBuffer, uint32_t toIndex, + Handle fromBuffer, uint32_t fromIndex, + uint32_t count) { MOZ_ASSERT(toBuffer->byteLength() >= count); + MOZ_ASSERT(toBuffer->byteLength() >= toIndex + count); MOZ_ASSERT(fromBuffer->byteLength() >= fromIndex); MOZ_ASSERT(fromBuffer->byteLength() >= fromIndex + count); - jit::AtomicOperations::memcpySafeWhenRacy(toBuffer->dataPointerShared(), + jit::AtomicOperations::memcpySafeWhenRacy(toBuffer->dataPointerShared() + toIndex, fromBuffer->dataPointerShared() + fromIndex, count); } diff --git a/js/src/vm/SharedArrayObject.h b/js/src/vm/SharedArrayObject.h index 05db688184..19048336cb 100644 --- a/js/src/vm/SharedArrayObject.h +++ b/js/src/vm/SharedArrayObject.h @@ -146,9 +146,9 @@ class SharedArrayBufferObject : public ArrayBufferObjectMaybeShared static void addSizeOfExcludingThis(JSObject* obj, mozilla::MallocSizeOf mallocSizeOf, JS::ClassInfo* info); - static void copyData(Handle toBuffer, - Handle fromBuffer, - uint32_t fromIndex, uint32_t count); + static void copyData(Handle toBuffer, uint32_t toIndex, + Handle fromBuffer, uint32_t fromIndex, + uint32_t count); SharedArrayRawBuffer* rawBufferObject() const;