Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(49)

Unified Diff: src/builtins/builtins-typedarray.cc

Issue 2778623003: [typedarrays] Check detached buffer at start of typed array methods (Closed)
Patch Set: pass test262 for subarray Created 3 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | src/compiler/js-intrinsic-lowering.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/builtins/builtins-typedarray.cc
diff --git a/src/builtins/builtins-typedarray.cc b/src/builtins/builtins-typedarray.cc
index 8fa011db32877454721d4bdb4ddbbf8423ce237c..6e75c62479b7d99d3d4a2faf8236366b99284990 100644
--- a/src/builtins/builtins-typedarray.cc
+++ b/src/builtins/builtins-typedarray.cc
@@ -17,7 +17,8 @@ namespace internal {
// ES6 section 22.2.3.1 get %TypedArray%.prototype.buffer
BUILTIN(TypedArrayPrototypeBuffer) {
HandleScope scope(isolate);
- CHECK_RECEIVER(JSTypedArray, typed_array, "get TypedArray.prototype.buffer");
+ CHECK_RECEIVER(JSTypedArray, typed_array,
+ "get %TypedArray%.prototype.buffer");
return *typed_array->GetBuffer();
}
@@ -128,8 +129,6 @@ BUILTIN(TypedArrayPrototypeCopyWithin) {
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
- if (V8_UNLIKELY(array->WasNeutered())) return *array;
-
int64_t len = array->length_value();
int64_t to = 0;
int64_t from = 0;
@@ -193,8 +192,6 @@ BUILTIN(TypedArrayPrototypeFill) {
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
- if (V8_UNLIKELY(array->WasNeutered())) return *array;
-
int64_t len = array->length_value();
int64_t start = 0;
int64_t end = len;
@@ -340,8 +337,6 @@ BUILTIN(TypedArrayPrototypeReverse) {
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
- if (V8_UNLIKELY(array->WasNeutered())) return *array;
-
ElementsAccessor* elements = array->GetElementsAccessor();
elements->Reverse(*array);
return *array;
« no previous file with comments | « no previous file | src/compiler/js-intrinsic-lowering.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698