Reviewers: rossberg,
Message:
PTAL
Description:
Do not look up ArrayBuffer on global object in typed array constructor.
BUG=v8:2931
[email protected]
[email protected]
Please review this at https://codereview.chromium.org/27238009/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+7, -16 lines):
M src/typedarray.js
A + test/mjsunit/regress/regress-2931.js
Index: src/typedarray.js
diff --git a/src/typedarray.js b/src/typedarray.js
index
da12ccf32374dfd42c9d5331b5f69ab8fa0295a0..1e67bc30c6cd7d21023620acec95a9aa69bb0e42
100644
--- a/src/typedarray.js
+++ b/src/typedarray.js
@@ -30,7 +30,7 @@
// This file relies on the fact that the following declaration has been
made
// in runtime.js:
// var $Array = global.Array;
-
+var $ArrayBuffer = global.ArrayBuffer;
// --------------- Typed Arrays ---------------------
@@ -70,7 +70,7 @@ function CreateTypedArrayConstructor(name, elementSize,
arrayId, constructor) {
function ConstructByLength(obj, length) {
var l = ToPositiveInteger(length, "invalid_typed_array_length");
var byteLength = l * elementSize;
- var buffer = new global.ArrayBuffer(byteLength);
+ var buffer = new $ArrayBuffer(byteLength);
%TypedArrayInitialize(obj, arrayId, buffer, 0, byteLength);
}
Index: test/mjsunit/regress/regress-2931.js
diff --git a/test/mjsunit/regress/regress-294.js
b/test/mjsunit/regress/regress-2931.js
similarity index 88%
copy from test/mjsunit/regress/regress-294.js
copy to test/mjsunit/regress/regress-2931.js
index
285b447fb570a771a4aa6eb308ead47e3a62ced7..a2ea912682dacb545fc304462b7c2055ea2a9932
100644
--- a/test/mjsunit/regress/regress-294.js
+++ b/test/mjsunit/regress/regress-2931.js
@@ -25,19 +25,10 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Should not crash.
+// Typed array constructors should be immune from changes to
+// value of ArrayBuffer on global object.
// See http://code.google.com/p/v8/issues/detail?id=294
-function f() { return false; }
-
-function test(x) {
- var y = x;
- if (x == "kat") x = "kat";
- else {
- x = "hund";
- var z = f();
- if (!z) x = "kat";
- }
-}
-
-test("hund");
+this.ArrayBuffer = function() { throw Error('BAM'); };
+var u8 = new Uint8Array(100);
+assertSame(100, u8.byteLength);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
