Changeset 195375 in webkit

Timestamp:

Jan 20, 2016, 1:49:09 PM (11 years ago)

Author:

keith_miller@apple.com

Message:

TypedArray's .buffer does not return the JSArrayBuffer that was passed to it on creation.
​https://bugs.webkit.org/show_bug.cgi?id=153281

Reviewed by Geoffrey Garen.

When creating an JSArrayBuffer we should make sure that the backing ArrayBuffer uses the
new JSArrayBuffer as its wrapper. This causes issues when we get the buffer of a Typed Array
created by passing a JSArrayBuffer as the backing ArrayBuffer does not have a reference to
the original JSArrayBuffer and a new object is created.

• runtime/JSArrayBuffer.cpp:

(JSC::JSArrayBuffer::finishCreation):

• tests/stress/typedarray-buffer-neutered.js: Added.

(arrays.typedArrays.map):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSArrayBuffer.cpp (modified) (1 diff)
• tests/stress/typedarray-buffer-neutered.js (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-01-20  Keith Miller  <keith_miller@apple.com>
+
+        TypedArray's .buffer does not return the JSArrayBuffer that was passed to it on creation.
+        https://bugs.webkit.org/show_bug.cgi?id=153281
+
+        Reviewed by Geoffrey Garen.
+
+        When creating an JSArrayBuffer we should make sure that the backing ArrayBuffer uses the
+        new JSArrayBuffer as its wrapper. This causes issues when we get the buffer of a Typed Array
+        created by passing a JSArrayBuffer as the backing ArrayBuffer does not have a reference to
+        the original JSArrayBuffer and a new object is created.
+
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::finishCreation):
+        * tests/stress/typedarray-buffer-neutered.js: Added.
+        (arrays.typedArrays.map):
+
 2016-01-20  Andreas Kling  <akling@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.cpp

@@ -45 +45 @@
     Base::finishCreation(vm);
     vm.heap.addReference(this, m_impl);
+    m_impl->m_wrapper = this;
 }