Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(37)

Unified Diff: src/builtins/builtins-typedarray.cc

Issue 2793233003: Revert of [typedarrays] Check detached buffer at start of typed array methods (Closed)
Patch Set: Created 3 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | src/compiler/js-intrinsic-lowering.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/builtins/builtins-typedarray.cc
diff --git a/src/builtins/builtins-typedarray.cc b/src/builtins/builtins-typedarray.cc
index 6e75c62479b7d99d3d4a2faf8236366b99284990..8fa011db32877454721d4bdb4ddbbf8423ce237c 100644
--- a/src/builtins/builtins-typedarray.cc
+++ b/src/builtins/builtins-typedarray.cc
@@ -17,8 +17,7 @@
// ES6 section 22.2.3.1 get %TypedArray%.prototype.buffer
BUILTIN(TypedArrayPrototypeBuffer) {
HandleScope scope(isolate);
- CHECK_RECEIVER(JSTypedArray, typed_array,
- "get %TypedArray%.prototype.buffer");
+ CHECK_RECEIVER(JSTypedArray, typed_array, "get TypedArray.prototype.buffer");
return *typed_array->GetBuffer();
}
@@ -129,6 +128,8 @@
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
+ if (V8_UNLIKELY(array->WasNeutered())) return *array;
+
int64_t len = array->length_value();
int64_t to = 0;
int64_t from = 0;
@@ -191,6 +192,8 @@
const char* method = "%TypedArray%.prototype.fill";
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
+
+ if (V8_UNLIKELY(array->WasNeutered())) return *array;
int64_t len = array->length_value();
int64_t start = 0;
@@ -337,6 +340,8 @@
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
+ if (V8_UNLIKELY(array->WasNeutered())) return *array;
+
ElementsAccessor* elements = array->GetElementsAccessor();
elements->Reverse(*array);
return *array;
« no previous file with comments | « no previous file | src/compiler/js-intrinsic-lowering.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698