New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weβll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[JSC] Update resizable ArrayBuffer based on spec update #6956
[JSC] Update resizable ArrayBuffer based on spec update #6956
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
r=me with a question
// https://tc39.es/proposal-resizablearraybuffer/#sec-isarraybufferviewoutofbounds | ||
if (UNLIKELY(isDetached())) | ||
return true; | ||
if (LIKELY(!isResizableNonShared())) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Seems like this is a SAB check in the spec textβdo we have some additional assumption at play?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There are three arrays,
- resizable
- growable
- normal
And only (1) can be OOB status. (2) is growing only, and (3) is valid or detached.
https://bugs.webkit.org/show_bug.cgi?id=248511 rdar://102793557 Reviewed by Ross Kirsling. * LayoutTests/js/dom/resizable-array-buffer-view-serialization-out-of-bounds-expected.txt: * LayoutTests/js/dom/resizable-array-buffer-view-serialization-out-of-bounds-explicit-length-expected.txt: * LayoutTests/js/dom/resizable-array-buffer-view-serialization-out-of-bounds-explicit-length.html: * LayoutTests/js/dom/resizable-array-buffer-view-serialization-out-of-bounds.html: * LayoutTests/js/dom/resizable-data-view-serialization-out-of-bounds-expected.txt: Added. * LayoutTests/js/dom/resizable-data-view-serialization-out-of-bounds-explicit-length-expected.txt: Added. * LayoutTests/js/dom/resizable-data-view-serialization-out-of-bounds-explicit-length.html: Copied from LayoutTests/js/dom/resizable-array-buffer-view-serialization-out-of-bounds-explicit-length.html. * LayoutTests/js/dom/resizable-data-view-serialization-out-of-bounds.html: Copied from LayoutTests/js/dom/resizable-array-buffer-view-serialization-out-of-bounds.html. * Source/JavaScriptCore/runtime/JSArrayBufferView.h: (JSC::JSArrayBufferView::isDetached const): (JSC::JSArrayBufferView::byteOffset const): (JSC::JSArrayBufferView::isOutOfBounds const): Add isOutOfBounds, function aligned to spec's IsArrayBufferViewOutOfBounds. Used in SerializedScriptValue. (JSC::JSArrayBufferView::isDetached): Deleted. * Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h: (JSC::isArrayBufferViewOutOfBounds): (JSC::isIntegerIndexedObjectOutOfBounds): * Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h: (JSC::genericTypedArrayViewProtoFuncSet): This is not actually changing the behavior, but more aligned to the latest spec's change. * Source/WebCore/bindings/js/SerializedScriptValue.cpp: (WebCore::CloneSerializer::dumpArrayBufferView): We reject OOB ArrayBuffer based on discussion in [1]. [1]: whatwg/html#8559 Canonical link: https://commits.webkit.org/257178@main
78558b5
to
ba8ba25
Compare
Committed 257178@main (ba8ba25): https://commits.webkit.org/257178@main Reviewed commits have been landed. Closing PR #6956 and removing active labels. |
ba8ba25
78558b5
π gtkπ§ͺ api-macπ§ͺ api-gtkπ§ͺ mac-wk1π§ͺ mac-wk2π§ͺ mac-AS-debug-wk2