author | Phil Ringnalda <philringnalda@gmail.com> |
Tue, 13 Sep 2016 19:08:44 -0700 | |
changeset 313746 | afd6ad990dd40ac22dc374bed51e333c25288243 |
parent 313745 | 32fb14de50feb0a1334c75a79ebab6fe7d9b3db5 |
child 313747 | 002b4c56b913fcce358c53ee69d70cc777ba5fa4 |
push id | 81701 |
push user | philringnalda@gmail.com |
push date | Wed, 14 Sep 2016 02:08:51 +0000 |
treeherder | mozilla-inbound@afd6ad990dd4 [default view] [failures only] |
perfherder | [talos] [build metrics] [platform microbench] (compared to previous push) |
bugs | 1296249 |
milestone | 51.0a1 |
backs out | e2bca303ae69caecec7d91396b8a04be9922e0fa |
first release with | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
last release without | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
js/src/jit-test/tests/basic/bug1296249.js | file | annotate | diff | comparison | revisions | |
js/src/jit/MacroAssembler.cpp | file | annotate | diff | comparison | revisions |
deleted file mode 100644 --- a/js/src/jit-test/tests/basic/bug1296249.js +++ /dev/null @@ -1,10 +0,0 @@ -function f(x) { - new Int32Array(x); -} -f(0); -try { - f(2147483647); -} catch(e) { - assertEq(e instanceof InternalError, true, - "expected InternalError, instead threw: " + e); -}
--- a/js/src/jit/MacroAssembler.cpp +++ b/js/src/jit/MacroAssembler.cpp @@ -1057,22 +1057,16 @@ AllocateObjectBufferWithInit(JSContext* return; \ break; JS_FOR_EACH_TYPED_ARRAY(CREATE_TYPED_ARRAY) #undef CREATE_TYPED_ARRAY default: MOZ_CRASH("Unsupported TypedArray type"); } - // Prevent an overflow caused by the JS_ROUNDUP since |allocateBuffer| - // converts |nbytes| of type size_t to uint32_t. The value for |nbytes| will - // truncate to zero when |new Int32Array(2147483647)| is used. - if (nbytes >= TypedArrayObject::SINGLETON_BYTE_LENGTH) - return; - nbytes = JS_ROUNDUP(nbytes, sizeof(Value)); Nursery& nursery = cx->runtime()->gc.nursery; void* buf = nursery.allocateBuffer(obj, nbytes); if (buf) { obj->initPrivate(buf); memset(buf, 0, nbytes); } }