Apply numeric casts correctly in typed arrays and related code.

src/typedarray.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 31 matching lines @@
 FUNCTION(4, Int16Array, 2)
 FUNCTION(5, Uint32Array, 4)
 FUNCTION(6, Int32Array, 4)
 FUNCTION(7, Float32Array, 4)
 FUNCTION(8, Float64Array, 8)
 FUNCTION(9, Uint8ClampedArray, 1)
 endmacro
 
 macro TYPED_ARRAY_CONSTRUCTOR(ARRAY_ID, NAME, ELEMENT_SIZE)
   function NAMEConstructByArrayBuffer(obj, buffer, byteOffset, length) {
+    if (!IS_UNDEFINED(byteOffset)) {
+        byteOffset =
+            ToPositiveInteger(byteOffset,  "invalid_typed_array_length");
+    }
+    if (!IS_UNDEFINED(length)) {
+        length = ToPositiveInteger(length, "invalid_typed_array_length");
+    }
+
     var bufferByteLength = %ArrayBufferGetByteLength(buffer);
     var offset;
     if (IS_UNDEFINED(byteOffset)) {
       offset = 0;
     } else {
-      offset = ToPositiveInteger(byteOffset, "invalid_typed_array_length");
+      offset = byteOffset;
 
       if (offset % ELEMENT_SIZE !== 0) {
         throw MakeRangeError("invalid_typed_array_alignment",
             ["start offset", "NAME", ELEMENT_SIZE]);
       }
       if (offset > bufferByteLength) {
         throw MakeRangeError("invalid_typed_array_offset");
       }
     }
 
     var newByteLength;
     var newLength;
     if (IS_UNDEFINED(length)) {
       if (bufferByteLength % ELEMENT_SIZE !== 0) {
         throw MakeRangeError("invalid_typed_array_alignment",
           ["byte length", "NAME", ELEMENT_SIZE]);
       }
       newByteLength = bufferByteLength - offset;
       newLength = newByteLength / ELEMENT_SIZE;
     } else {
-      var newLength = ToPositiveInteger(length, "invalid_typed_array_length");
+      var newLength = length;
       newByteLength = newLength * ELEMENT_SIZE;
     }
     if ((offset + newByteLength > bufferByteLength)
         || (newLength > %MaxSmi())) {
       throw MakeRangeError("invalid_typed_array_length");
     }
     %TypedArrayInitialize(obj, ARRAY_ID, buffer, offset, newByteLength);
   }
 
   function NAMEConstructByLength(obj, length) {
     var l = IS_UNDEFINED(length) ?
       0 : ToPositiveInteger(length, "invalid_typed_array_length");
     if (l > %MaxSmi()) {
       throw MakeRangeError("invalid_typed_array_length");
     }
     var byteLength = l * ELEMENT_SIZE;
     var buffer = new $ArrayBuffer(byteLength);
     %TypedArrayInitialize(obj, ARRAY_ID, buffer, 0, byteLength);
   }
 
   function NAMEConstructByArrayLike(obj, arrayLike) {
     var length = arrayLike.length;
     var l = ToPositiveInteger(length, "invalid_typed_array_length");
+
     if (l > %MaxSmi()) {
       throw MakeRangeError("invalid_typed_array_length");
     }
     if(!%TypedArrayInitializeFromArrayLike(obj, ARRAY_ID, arrayLike, l)) {
       for (var i = 0; i < l; i++) {
         // It is crucial that we let any execptions from arrayLike[i]
         // propagate outside the function.
         obj[i] = arrayLike[i];
       }
     }
@@ skipping 29 matching lines @@
 function TypedArrayGetByteOffset() {
   return %TypedArrayGetByteOffset(this);
 }
 
 function TypedArrayGetLength() {
   return %TypedArrayGetLength(this);
 }
 
 function CreateSubArray(elementSize, constructor) {
   return function(begin, end) {
+    var beginInt = TO_INTEGER(begin);
+    if (!IS_UNDEFINED(end)) {
+      end = TO_INTEGER(end);
+    }
+
     var srcLength = %TypedArrayGetLength(this);
-    var beginInt = TO_INTEGER(begin);
     if (beginInt < 0) {
       beginInt = MathMax(0, srcLength + beginInt);
     } else {
       beginInt = MathMin(srcLength, beginInt);
     }
 
-    var endInt = IS_UNDEFINED(end) ? srcLength : TO_INTEGER(end);
+    var endInt = IS_UNDEFINED(end) ? srcLength : end;
     if (endInt < 0) {
       endInt = MathMax(0, srcLength + endInt);
     } else {
       endInt = MathMin(endInt, srcLength);
     }
     if (endInt < beginInt) {
       endInt = beginInt;
     }
     var newLength = endInt - beginInt;
     var beginByteOffset =
@@ skipping 140 matching lines @@
 
 // --------------------------- DataView -----------------------------
 
 var $DataView = global.DataView;
 
 function DataViewConstructor(buffer, byteOffset, byteLength) { // length = 3
   if (%_IsConstructCall()) {
     if (!IS_ARRAYBUFFER(buffer)) {
       throw MakeTypeError('data_view_not_array_buffer', []);
     }
+    if (!IS_UNDEFINED(byteOffset)) {
+        byteOffset = ToPositiveInteger(byteOffset, 'invalid_data_view_offset');
+    }
+    if (!IS_UNDEFINED(byteLength)) {
+        byteLength = TO_INTEGER(byteLength);
+    }
+
     var bufferByteLength = %ArrayBufferGetByteLength(buffer);
-    var offset = IS_UNDEFINED(byteOffset) ?
-      0 : ToPositiveInteger(byteOffset, 'invalid_data_view_offset');
+
+    var offset = IS_UNDEFINED(byteOffset) ?  0 : byteOffset;
     if (offset > bufferByteLength) {
       throw MakeRangeError('invalid_data_view_offset');
     }
-    var length = IS_UNDEFINED(byteLength) ?
-      bufferByteLength - offset : TO_INTEGER(byteLength);
+
+    var length = IS_UNDEFINED(byteLength)
+        ? bufferByteLength - offset
+        : byteLength;
     if (length < 0 || offset + length > bufferByteLength) {
       throw new MakeRangeError('invalid_data_view_length');
     }
     %DataViewInitialize(this, buffer, offset, length);
   } else {
     throw MakeTypeError('constructor_not_function', ["DataView"]);
   }
 }
 
 function DataViewGetBuffer() {
@@ skipping 39 matching lines @@
 macro DATA_VIEW_GETTER_SETTER(TYPENAME)
 function DataViewGetTYPENAME(offset, little_endian) {
   if (!IS_DATAVIEW(this)) {
     throw MakeTypeError('incompatible_method_receiver',
                         ['DataView.getTYPENAME', this]);
   }
   if (%_ArgumentsLength() < 1) {
     throw MakeTypeError('invalid_argument');
   }
   return %DataViewGetTYPENAME(this,
                           ToPositiveDataViewOffset(offset),

[Jakob Kummerow, 2014/03/17 17:29:05]

Is this safe?

[Dmitry Lomov (no reviews), 2014/03/18 10:22:32]

Looks safe to me.

                           !!little_endian);
 }
 
 function DataViewSetTYPENAME(offset, value, little_endian) {
   if (!IS_DATAVIEW(this)) {
     throw MakeTypeError('incompatible_method_receiver',
                         ['DataView.setTYPENAME', this]);
   }
   if (%_ArgumentsLength() < 2) {
     throw MakeTypeError('invalid_argument');
@@ skipping 42 matching lines @@
 
       "getFloat32", DataViewGetFloat32,
       "setFloat32", DataViewSetFloat32,
 
       "getFloat64", DataViewGetFloat64,
       "setFloat64", DataViewSetFloat64
   ));
 }
 
 SetupDataView();