diff options
| author | Brian Smith <brian@dbsoft.org> | 2023-07-28 19:54:06 -0500 |
|---|---|---|
| committer | Brian Smith <brian@dbsoft.org> | 2023-07-28 19:54:06 -0500 |
| commit | 3dc659b86d3f1082387440f579468f1d86b048e8 (patch) | |
| tree | bfd31a2f1f05054b3853cb78c942b9b574b74b59 | |
| parent | 83daf83360b964c37a803ef997aea15ac8d435e3 (diff) | |
| download | uxp-3dc659b86d3f1082387440f579468f1d86b048e8.tar.gz | |
Issue #2026 - Part 4 - Fill in missing dense elements case and fix a comment.
https://bugzilla.mozilla.org/show_bug.cgi?id=1456569
Skipped this during the initial implementation, not sure when or if this code path
is used, but I figure it should be there just in case.
Also fix debug builgs by removing an no longer valid MOZ_ASSERT.
| -rw-r--r-- | js/src/jit/shared/Assembler-shared.h | 1 | ||||
| -rw-r--r-- | js/src/vm/NativeObject.cpp | 9 |
2 files changed, 9 insertions, 1 deletions
diff --git a/js/src/jit/shared/Assembler-shared.h b/js/src/jit/shared/Assembler-shared.h index 6d623293cd..f18cbb9e1d 100644 --- a/js/src/jit/shared/Assembler-shared.h +++ b/js/src/jit/shared/Assembler-shared.h @@ -725,7 +725,6 @@ class MemoryAccessDesc trapOffset_(trapOffset) { MOZ_ASSERT(Scalar::isSimdType(type) == (numSimdElems > 0)); - MOZ_ASSERT(numSimdElems <= jit::ScalarTypeToLength(type)); MOZ_ASSERT(mozilla::IsPowerOfTwo(align)); MOZ_ASSERT_IF(isSimd(), hasTrap()); MOZ_ASSERT_IF(isAtomic(), hasTrap()); diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp index d21f88b15e..cde86fb829 100644 --- a/js/src/vm/NativeObject.cpp +++ b/js/src/vm/NativeObject.cpp @@ -2392,6 +2392,15 @@ SetExistingProperty(JSContext* cx, HandleNativeObject obj, HandleId id, HandleVa Rooted<TypedArrayObject*> tobj(cx, &pobj->as<TypedArrayObject>()); return SetTypedArrayElement(cx, tobj, index, v, result); } + + if (WouldDefinePastNonwritableLength(pobj, index)) + return result.fail(JSMSG_CANT_DEFINE_PAST_ARRAY_LENGTH); + + if (!pobj->maybeCopyElementsForWrite(cx)) + return false; + + pobj->setDenseElementWithType(cx, index, v); + return result.succeed(); } // Steps 5.b-f. |