Changeset 211106 in webkit

Timestamp:

Jan 24, 2017, 1:22:59 PM (10 years ago)

Author:

matthew_hanson@apple.com

Message:

Merge r211065. rdar://problem/29784295

Location:

branches/safari-603-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/js/shared-array-buffer-webgl-expected.txt (added)
• LayoutTests/js/shared-array-buffer-webgl.html (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h (modified) (1 diff)

branches/safari-603-branch/LayoutTests/ChangeLog

@@ +1 @@
+2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211065. rdar://problem/29784295
+
+    2017-01-23  Filip Pizlo  <fpizlo@apple.com>
+
+            SharedArrayBuffer plus WebGL should not equal CRASH
+            https://bugs.webkit.org/show_bug.cgi?id=167329
+
+            Reviewed by Saam Barati.
+
+            This test used to crash and now it doesn't. It throws some exception.
+
+            * js/shared-array-buffer-webgl-expected.txt: Added.
+            * js/shared-array-buffer-webgl.html: Added.
+
 2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-603-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211065. rdar://problem/29784295
+
+    2017-01-23  Filip Pizlo  <fpizlo@apple.com>
+
+            SharedArrayBuffer plus WebGL should not equal CRASH
+            https://bugs.webkit.org/show_bug.cgi?id=167329
+
+            Reviewed by Saam Barati.
+
+            DOM unwrapping methods should return null rather than crashing. The code expects an
+            unshared buffer, so we should return null when it's shared. The caller can then decide
+            if they like null or not.
+
+            * runtime/JSArrayBufferViewInlines.h:
+            (JSC::JSArrayBufferView::toWrapped):
+
 2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-603-branch/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h

@@ -92 +92 @@
 inline RefPtr<ArrayBufferView> JSArrayBufferView::toWrapped(JSValue value)
 {
-    if (JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(value))
-        return view->unsharedImpl();
+    if (JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(value)) {
+        if (!view->isShared())
+            return view->unsharedImpl();
+    }
     return nullptr;
 }