OLD | NEW |
---|---|
1 // Copyright 2016 the V8 project authors. All rights reserved. | 1 // Copyright 2016 the V8 project authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "src/builtins/builtins-utils.h" | 5 #include "src/builtins/builtins-utils.h" |
6 #include "src/builtins/builtins.h" | 6 #include "src/builtins/builtins.h" |
7 #include "src/code-stub-assembler.h" | 7 #include "src/code-stub-assembler.h" |
8 | 8 |
9 namespace v8 { | 9 namespace v8 { |
10 namespace internal { | 10 namespace internal { |
(...skipping 149 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
160 Generate_TypedArrayPrototypeIterationMethod<IterationKind::kEntries>( | 160 Generate_TypedArrayPrototypeIterationMethod<IterationKind::kEntries>( |
161 state, "%TypedArray%.prototype.entries()"); | 161 state, "%TypedArray%.prototype.entries()"); |
162 } | 162 } |
163 | 163 |
164 void Builtins::Generate_TypedArrayPrototypeKeys( | 164 void Builtins::Generate_TypedArrayPrototypeKeys( |
165 compiler::CodeAssemblerState* state) { | 165 compiler::CodeAssemblerState* state) { |
166 Generate_TypedArrayPrototypeIterationMethod<IterationKind::kKeys>( | 166 Generate_TypedArrayPrototypeIterationMethod<IterationKind::kKeys>( |
167 state, "%TypedArray%.prototype.keys()"); | 167 state, "%TypedArray%.prototype.keys()"); |
168 } | 168 } |
169 | 169 |
170 namespace { | |
171 | |
172 MaybeHandle<JSTypedArray> ValidateTypedArray(Isolate* isolate, | |
173 Handle<Object> receiver, | |
174 const char* method_name) { | |
175 if (V8_UNLIKELY(!receiver->IsJSTypedArray())) { | |
176 const MessageTemplate::Template message = MessageTemplate::kNotTypedArray; | |
177 THROW_NEW_ERROR(isolate, NewTypeError(message), JSTypedArray); | |
178 } | |
179 | |
180 // TODO(caitp): throw if array.[[ViewedArrayBuffer]] is neutered. | |
adamk
2017/02/14 00:57:18
Looks like this one got forgotten?
caitp
2017/02/14 01:00:48
Oop, the (per v8:...) from the caller of ValidateT
| |
181 return Handle<JSTypedArray>::cast(receiver); | |
182 } | |
183 | |
184 int64_t CapRelativeIndex(Handle<Object> num, int64_t minimum, int64_t maximum) { | |
185 int64_t relative; | |
186 if (V8_LIKELY(num->IsSmi())) { | |
187 relative = Smi::cast(*num)->value(); | |
188 } else { | |
189 DCHECK(num->IsHeapNumber()); | |
190 double fp = HeapNumber::cast(*num)->value(); | |
191 if (V8_UNLIKELY(!std::isfinite(fp))) { | |
192 // +Infinity / -Infinity | |
193 DCHECK(!std::isnan(fp)); | |
194 return fp < 0 ? minimum : maximum; | |
195 } | |
196 relative = static_cast<int64_t>(fp); | |
197 } | |
198 return relative < 0 ? std::max<int64_t>(relative + maximum, minimum) | |
199 : std::min<int64_t>(relative, maximum); | |
200 } | |
201 | |
202 } // namespace | |
203 | |
204 BUILTIN(TypedArrayPrototypeCopyWithin) { | |
205 HandleScope scope(isolate); | |
206 | |
207 Handle<JSTypedArray> array; | |
208 const char* method = "%TypedArray%.prototype.copyWithin"; | |
209 ASSIGN_RETURN_FAILURE_ON_EXCEPTION( | |
210 isolate, array, ValidateTypedArray(isolate, args.receiver(), method)); | |
211 | |
212 // TODO(caitp): throw if array.[[ViewedArrayBuffer]] is neutered (per v8:4648) | |
213 if (V8_UNLIKELY(array->WasNeutered())) return *array; | |
214 | |
215 int64_t len = array->length_value(); | |
216 int64_t to = 0; | |
217 int64_t from = 0; | |
218 int64_t final = len; | |
219 | |
220 if (V8_LIKELY(args.length() > 1)) { | |
221 Handle<Object> num; | |
222 ASSIGN_RETURN_FAILURE_ON_EXCEPTION( | |
223 isolate, num, Object::ToInteger(isolate, args.at<Object>(1))); | |
224 to = CapRelativeIndex(num, 0, len); | |
225 | |
226 if (args.length() > 2) { | |
227 ASSIGN_RETURN_FAILURE_ON_EXCEPTION( | |
228 isolate, num, Object::ToInteger(isolate, args.at<Object>(2))); | |
229 from = CapRelativeIndex(num, 0, len); | |
230 | |
231 Handle<Object> end = args.atOrUndefined(isolate, 3); | |
232 if (!end->IsUndefined(isolate)) { | |
233 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, num, | |
234 Object::ToInteger(isolate, end)); | |
235 final = CapRelativeIndex(num, 0, len); | |
236 } | |
237 } | |
238 } | |
239 | |
240 int64_t count = std::min<int64_t>(final - from, len - to); | |
241 if (count <= 0) return *array; | |
242 | |
243 // TypedArray buffer may have been transferred/detached during parameter | |
244 // processing above. Return early in this case, to prevent potential UAF error | |
245 if (V8_UNLIKELY(array->WasNeutered())) return *array; | |
246 | |
247 Handle<FixedTypedArrayBase> elements( | |
248 FixedTypedArrayBase::cast(array->elements())); | |
249 size_t element_size = array->element_size(); | |
250 to = to * element_size; | |
251 from = from * element_size; | |
252 count = count * element_size; | |
253 | |
254 uint8_t* data = static_cast<uint8_t*>(elements->DataPtr()); | |
255 std::memmove(data + to, data + from, count); | |
256 | |
257 return *array; | |
258 } | |
259 | |
170 } // namespace internal | 260 } // namespace internal |
171 } // namespace v8 | 261 } // namespace v8 |
OLD | NEW |