Bug 853576 - Check for negative indices supplied in scatter r=shu
authorNicholas D. Matsakis <nmatsakis@mozilla.com>
Wed, 27 Mar 2013 20:59:46 -0400
changeset 126550 8f1f83f4f183880d3e10d8e4ef513cc26d590f02
parent 126549 f0b16aba4df715fad56ca3267034d340d563e533
child 126551 f1394606c45136f05b2215c3ca0e5e75ce416974
push id24488
push userryanvm@gmail.com
push dateFri, 29 Mar 2013 00:54:52 +0000
treeherdermozilla-central@8aeabe064932 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersshu
bugs853576
milestone22.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 853576 - Check for negative indices supplied in scatter r=shu
js/src/builtin/ParallelArray.js
js/src/jit-test/tests/parallelarray/bug853576.js
--- a/js/src/builtin/ParallelArray.js
+++ b/js/src/builtin/ParallelArray.js
@@ -948,17 +948,17 @@ function ParallelArrayScatter(targets, d
 
     return NewParallelArray(ParallelArrayView, [length], buffer, 0);
   }
 
   function checkTarget(i, t) {
       if ((t | 0) !== t)
         ThrowError(JSMSG_PAR_ARRAY_SCATTER_BAD_TARGET, i);
 
-      if (t >= length)
+      if (t < 0 || t >= length)
         ThrowError(JSMSG_PAR_ARRAY_SCATTER_BOUNDS);
   }
 }
 
 /**
  * The familiar filter() operation applied across the outermost
  * dimension.
  */
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/parallelarray/bug853576.js
@@ -0,0 +1,8 @@
+// |jit-test| error: Error;
+
+var len = 2;
+function add1(x) { return x+1; }
+var p = new ParallelArray(len, add1);
+var idx = [0,0].concat(build(len-4, add1)).concat([len-3,len-3]);
+var revidx = idx.reverse();
+var r = p.scatter(revidx, 0, function (x,y) { return x+y; }, len-2, {});