From b7e487bdf1f245ab7c2d5c28f6259fc227a78f8d Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Fri, 28 Jul 2023 19:54:06 -0500 Subject: [PATCH] Issue #2026 - Part 4 - Fill in missing dense elements case and fix a comment. https://bugzilla.mozilla.org/show_bug.cgi?id=1456569 Skipped this during the initial implementation, not sure when or if this code path is used, but I figure it should be there just in case. Also fix debug builgs by removing an no longer valid MOZ_ASSERT. --- js/src/jit/shared/Assembler-shared.h | 1 - js/src/vm/NativeObject.cpp | 9 +++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/js/src/jit/shared/Assembler-shared.h b/js/src/jit/shared/Assembler-shared.h index 6d623293cd..f18cbb9e1d 100644 --- a/js/src/jit/shared/Assembler-shared.h +++ b/js/src/jit/shared/Assembler-shared.h @@ -725,7 +725,6 @@ class MemoryAccessDesc trapOffset_(trapOffset) { MOZ_ASSERT(Scalar::isSimdType(type) == (numSimdElems > 0)); - MOZ_ASSERT(numSimdElems <= jit::ScalarTypeToLength(type)); MOZ_ASSERT(mozilla::IsPowerOfTwo(align)); MOZ_ASSERT_IF(isSimd(), hasTrap()); MOZ_ASSERT_IF(isAtomic(), hasTrap()); diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp index d21f88b15e..cde86fb829 100644 --- a/js/src/vm/NativeObject.cpp +++ b/js/src/vm/NativeObject.cpp @@ -2392,6 +2392,15 @@ SetExistingProperty(JSContext* cx, HandleNativeObject obj, HandleId id, HandleVa Rooted tobj(cx, &pobj->as()); return SetTypedArrayElement(cx, tobj, index, v, result); } + + if (WouldDefinePastNonwritableLength(pobj, index)) + return result.fail(JSMSG_CANT_DEFINE_PAST_ARRAY_LENGTH); + + if (!pobj->maybeCopyElementsForWrite(cx)) + return false; + + pobj->setDenseElementWithType(cx, index, v); + return result.succeed(); } // Steps 5.b-f.