Closed
Bug 1229828
Opened 9 years ago
Closed 9 years ago
ArrayBufferObject::sameBuffer() is wrong for several cases
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla46
Tracking | Status | |
---|---|---|
firefox46 | --- | fixed |
People
(Reporter: lth, Assigned: lth)
References
Details
Attachments
(1 file)
(deleted),
patch
|
Waldo
:
review+
|
Details | Diff | Splinter Review |
From bug 1176214 comment 61:
> static bool sameBuffer(Handle<TypedArrayObject*> a, Handle<TypedArrayObject*> b) {
> + return a->bufferObject() == b->bufferObject();
Bah. I just realized this code's wrong right now -- for two typed arrays using inline storage, it'll say they have the same buffer. Please file a followup to fix this? Looks like this only matters for optimization, tho, so technically it's not a safety concern.
Assignee | ||
Comment 1•9 years ago
|
||
It's actually also wrong for shared memory, because in that case comparing the objects is not sufficient, one needs to compare their underlying storage addresses.
Blocks: 1225039
Summary: ArrayBufferObject::sameBuffer() is wrong for typed arrays with inline storage → ArrayBufferObject::sameBuffer() is wrong for several cases
Assignee | ||
Comment 2•9 years ago
|
||
Attachment #8698895 -
Flags: review?(jwalden+bmo)
Assignee | ||
Updated•9 years ago
|
Assignee: nobody → lhansen
Status: NEW → ASSIGNED
Comment 3•9 years ago
|
||
Comment on attachment 8698895 [details] [diff] [review]
make sameBuffer more discriminating
Review of attachment 8698895 [details] [diff] [review]:
-----------------------------------------------------------------
::: js/src/vm/TypedArrayObject.h
@@ +72,5 @@
> + // Inline buffers.
> + if (!a->hasBuffer() || !b->hasBuffer())
> + return a.get() == b.get();
> + // Shared buffers.
> + if (a->isSharedMemory() && b->isSharedMemory()) {
Add a blank line between each individual possibility handled. The comments, I think, are somewhat overkill, but okay. Maybe it'd make sense for !hasBuffer() to be usesInlineStorage() or something, tho I can't remember if there's another sense to that method's uses that we'd want to split out.
Attachment #8698895 -
Flags: review?(jwalden+bmo) → review+
Assignee | ||
Comment 4•9 years ago
|
||
This patch (with changes) was pushed, but the bug # in the commit message was incorrectly set to 1229829, not the correct 1229828.
https://hg.mozilla.org/integration/mozilla-inbound/rev/4ec207bba727
https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=4ec207bba727
Comment 5•9 years ago
|
||
(In reply to Lars T Hansen [:lth] from comment #4)
> This patch (with changes) was pushed, but the bug # in the commit message
> was incorrectly set to 1229829, not the correct 1229828.
>
> https://hg.mozilla.org/integration/mozilla-inbound/rev/4ec207bba727
> https://treeherder.mozilla.org/#/jobs?repo=mozilla-
> inbound&revision=4ec207bba727
This has now been merged, I've reopened bug 1229829.
https://hg.mozilla.org/mozilla-central/rev/4ec207bba727
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
status-firefox46:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla46
You need to log in
before you can comment on or make changes to this bug.
Description
•