Index: src/runtime/runtime-typedarray.cc |
diff --git a/src/runtime/runtime-typedarray.cc b/src/runtime/runtime-typedarray.cc |
index dfc1bab8d3dc4501fc1b35cd6d0b9a405333bf36..d173d76fb704ac538a7df373bc0f58352a5c3536 100644 |
--- a/src/runtime/runtime-typedarray.cc |
+++ b/src/runtime/runtime-typedarray.cc |
@@ -42,16 +42,18 @@ bool Runtime::SetupArrayBufferAllocatingData(Isolate* isolate, |
Handle<JSArrayBuffer> array_buffer, |
size_t allocated_length, |
bool initialize) { |
+ v8::ArrayBuffer::Allocator* allocator = |
+ array_buffer->is_shared() ? isolate->shared_array_buffer_allocator() |
+ : isolate->array_buffer_allocator(); |
+ CHECK(allocator != NULL); |
void* data; |
- CHECK(isolate->array_buffer_allocator() != NULL); |
// Prevent creating array buffers when serializing. |
DCHECK(!isolate->serializer_enabled()); |
if (allocated_length != 0) { |
if (initialize) { |
- data = isolate->array_buffer_allocator()->Allocate(allocated_length); |
+ data = allocator->Allocate(allocated_length); |
} else { |
- data = isolate->array_buffer_allocator()->AllocateUninitialized( |
- allocated_length); |
+ data = allocator->AllocateUninitialized(allocated_length); |
} |
if (data == NULL) return false; |
} else { |
@@ -138,6 +140,8 @@ RUNTIME_FUNCTION(Runtime_ArrayBufferNeuter) { |
CHECK(Smi::FromInt(0) == array_buffer->byte_length()); |
return isolate->heap()->undefined_value(); |
} |
+ // Shared array buffers should never be neutered. |
+ DCHECK(!array_buffer->is_shared()); |
DCHECK(!array_buffer->is_external()); |
void* backing_store = array_buffer->backing_store(); |
size_t byte_length = NumberToSize(isolate, array_buffer->byte_length()); |
@@ -407,6 +411,12 @@ RUNTIME_FUNCTION(Runtime_TypedArraySetFastCases) { |
Handle<JSTypedArray> target(JSTypedArray::cast(*target_obj)); |
Handle<JSTypedArray> source(JSTypedArray::cast(*source_obj)); |
+ |
+ if (target->is_shared() != source->is_shared()) { |
+ THROW_NEW_ERROR_RETURN_FAILURE( |
+ isolate, NewTypeError(MessageTemplate::kInvalidArgument)); |
+ } |
+ |
size_t offset = 0; |
RUNTIME_ASSERT(TryNumberToSize(isolate, *offset_obj, &offset)); |
size_t target_length = NumberToSize(isolate, target->length()); |