Bug 1842773 - Part 18: Update TypedArray length, byteLength, and byteOffset accesses...
commit9c98ce0bbd6307d6dcf1eeb51fa6de17480180e7
authorAndré Bargull <andre.bargull@gmail.com>
Thu, 25 Jan 2024 15:49:49 +0000 (25 15:49 +0000)
committerAndré Bargull <andre.bargull@gmail.com>
Thu, 25 Jan 2024 15:49:49 +0000 (25 15:49 +0000)
treec3ff1ccea879813cc68778233e9bac4f5fae4be8
parent00a05bc0725f9493c006501ab7ce37fa940aa929
Bug 1842773 - Part 18: Update TypedArray length, byteLength, and byteOffset accesses. r=sfink

Update all accesses to handle possible out-of-bounds. In some cases the TypedArray
is guaranteed to be a `FixedLengthTypedArrayObject`, which ensures the accesses are
always in-bounds.

Differential Revision: https://phabricator.services.mozilla.com/D183334
16 files changed:
js/src/builtin/Array.cpp
js/src/builtin/Object.cpp
js/src/builtin/TypedArray.js
js/src/jit/CacheIR.cpp
js/src/jit/VMFunctions.cpp
js/src/shell/OSObject.cpp
js/src/vm/ArrayBufferViewObject.cpp
js/src/vm/Iteration.cpp
js/src/vm/JSObject.cpp
js/src/vm/NativeObject-inl.h
js/src/vm/NativeObject.cpp
js/src/vm/SelfHosting.cpp
js/src/vm/TypedArrayObject-inl.h
js/src/vm/TypedArrayObject.cpp
js/src/vm/TypedArrayObject.h
js/src/wasm/WasmJS.cpp