Closed
Bug 1689308
Opened 4 years ago
Closed 4 years ago
More typed array changes for large buffers
Categories
(Core :: JavaScript Engine, task, P3)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
87 Branch
| Tracking | Status | |
|---|---|---|
| firefox87 | --- | fixed |
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(2 files)
There are some minor changes left.
|
Assignee | |
Comment 2•4 years ago
|
||
- In
AllocateAndInitTypedArrayBuffer, useTypedArrayObject::maxByteLength()instead ofINT32_MAX. - Remove uses of
CheckedUint32(size_t)where other assertions imply no overflow is possible. - JIT code only optimize the int32 case so assert
length < INT32_MAXin a few places.
|
|
Assignee | |
Comment 3•4 years ago
|
||
Until this point the maximum typed array length was one less than the actual
limit. This fixes bug 1592547.
Depends on D103296
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/9e7af65f547b part 1 - Support allocating large typed arrays in JIT fast paths. r=anba https://hg.mozilla.org/integration/autoland/rev/5b99d9a7ad8d part 2 - Fix typed array length limit to match ArrayBuffer limit. r=anba
|
||
Comment 5•4 years ago
|
||
| bugherder | ||
https://hg.mozilla.org/mozilla-central/rev/9e7af65f547b
https://hg.mozilla.org/mozilla-central/rev/5b99d9a7ad8d
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
status-firefox87:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 87 Branch
You need to log in
before you can comment on or make changes to this bug.
Description
•