Closed Bug 1229828 Opened 9 years ago Closed 9 years ago

ArrayBufferObject::sameBuffer() is wrong for several cases

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla46
Tracking Status
firefox46 --- fixed

People

(Reporter: lth, Assigned: lth)

References

Details

Attachments

(1 file)

From bug 1176214 comment 61: > static bool sameBuffer(Handle<TypedArrayObject*> a, Handle<TypedArrayObject*> b) { > + return a->bufferObject() == b->bufferObject(); Bah. I just realized this code's wrong right now -- for two typed arrays using inline storage, it'll say they have the same buffer. Please file a followup to fix this? Looks like this only matters for optimization, tho, so technically it's not a safety concern.
It's actually also wrong for shared memory, because in that case comparing the objects is not sufficient, one needs to compare their underlying storage addresses.
Blocks: 1225039
Summary: ArrayBufferObject::sameBuffer() is wrong for typed arrays with inline storage → ArrayBufferObject::sameBuffer() is wrong for several cases
Attachment #8698895 - Flags: review?(jwalden+bmo)
Assignee: nobody → lhansen
Status: NEW → ASSIGNED
Comment on attachment 8698895 [details] [diff] [review] make sameBuffer more discriminating Review of attachment 8698895 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/vm/TypedArrayObject.h @@ +72,5 @@ > + // Inline buffers. > + if (!a->hasBuffer() || !b->hasBuffer()) > + return a.get() == b.get(); > + // Shared buffers. > + if (a->isSharedMemory() && b->isSharedMemory()) { Add a blank line between each individual possibility handled. The comments, I think, are somewhat overkill, but okay. Maybe it'd make sense for !hasBuffer() to be usesInlineStorage() or something, tho I can't remember if there's another sense to that method's uses that we'd want to split out.
Attachment #8698895 - Flags: review?(jwalden+bmo) → review+
This patch (with changes) was pushed, but the bug # in the commit message was incorrectly set to 1229829, not the correct 1229828. https://hg.mozilla.org/integration/mozilla-inbound/rev/4ec207bba727 https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=4ec207bba727
(In reply to Lars T Hansen [:lth] from comment #4) > This patch (with changes) was pushed, but the bug # in the commit message > was incorrectly set to 1229829, not the correct 1229828. > > https://hg.mozilla.org/integration/mozilla-inbound/rev/4ec207bba727 > https://treeherder.mozilla.org/#/jobs?repo=mozilla- > inbound&revision=4ec207bba727 This has now been merged, I've reopened bug 1229829. https://hg.mozilla.org/mozilla-central/rev/4ec207bba727
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla46
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: