OLD | NEW |
1 // Copyright 2012 the V8 project authors. All rights reserved. | 1 // Copyright 2012 the V8 project authors. All rights reserved. |
2 // Redistribution and use in source and binary forms, with or without | 2 // Redistribution and use in source and binary forms, with or without |
3 // modification, are permitted provided that the following conditions are | 3 // modification, are permitted provided that the following conditions are |
4 // met: | 4 // met: |
5 // | 5 // |
6 // * Redistributions of source code must retain the above copyright | 6 // * Redistributions of source code must retain the above copyright |
7 // notice, this list of conditions and the following disclaimer. | 7 // notice, this list of conditions and the following disclaimer. |
8 // * Redistributions in binary form must reproduce the above | 8 // * Redistributions in binary form must reproduce the above |
9 // copyright notice, this list of conditions and the following | 9 // copyright notice, this list of conditions and the following |
10 // disclaimer in the documentation and/or other materials provided | 10 // disclaimer in the documentation and/or other materials provided |
(...skipping 930 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
941 for (int i = 0; i < v8::ArrayBufferView::kInternalFieldCount; i++) { | 941 for (int i = 0; i < v8::ArrayBufferView::kInternalFieldCount; i++) { |
942 holder->SetInternalField(i, Smi::FromInt(0)); | 942 holder->SetInternalField(i, Smi::FromInt(0)); |
943 } | 943 } |
944 | 944 |
945 ExternalArrayType array_type = kExternalByteArray; // Bogus initialization. | 945 ExternalArrayType array_type = kExternalByteArray; // Bogus initialization. |
946 size_t element_size = 1; // Bogus initialization. | 946 size_t element_size = 1; // Bogus initialization. |
947 ArrayIdToTypeAndSize(arrayId, &array_type, &element_size); | 947 ArrayIdToTypeAndSize(arrayId, &array_type, &element_size); |
948 | 948 |
949 Handle<JSArrayBuffer> buffer = isolate->factory()->NewJSArrayBuffer(); | 949 Handle<JSArrayBuffer> buffer = isolate->factory()->NewJSArrayBuffer(); |
950 size_t length = NumberToSize(isolate, *length_obj); | 950 size_t length = NumberToSize(isolate, *length_obj); |
951 size_t byte_length = length * element_size; | 951 if (length > (kMaxInt / element_size)) { |
952 if (byte_length < length) { // Overflow | |
953 return isolate->Throw(*isolate->factory()-> | 952 return isolate->Throw(*isolate->factory()-> |
954 NewRangeError("invalid_array_buffer_length", | 953 NewRangeError("invalid_array_buffer_length", |
955 HandleVector<Object>(NULL, 0))); | 954 HandleVector<Object>(NULL, 0))); |
956 } | 955 } |
| 956 size_t byte_length = length * element_size; |
957 | 957 |
958 // We assume that the caller of this function will initialize holder | 958 // We assume that the caller of this function will initialize holder |
959 // with the loop | 959 // with the loop |
960 // for(i = 0; i < length; i++) { holder[i] = source[i]; } | 960 // for(i = 0; i < length; i++) { holder[i] = source[i]; } |
961 // If source is a typed array, this loop will always run to completion, | 961 // If source is a typed array, this loop will always run to completion, |
962 // so we are sure that the backing store will be initialized. | 962 // so we are sure that the backing store will be initialized. |
963 // Otherwise, we do not know (the indexing operation might throw). | 963 // Otherwise, we do not know (the indexing operation might throw). |
964 // Hence we require zero initialization unless our source is a typed array. | 964 // Hence we require zero initialization unless our source is a typed array. |
965 bool should_zero_initialize = !source->IsJSTypedArray(); | 965 bool should_zero_initialize = !source->IsJSTypedArray(); |
966 | 966 |
(...skipping 13524 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
14491 // Handle last resort GC and make sure to allow future allocations | 14491 // Handle last resort GC and make sure to allow future allocations |
14492 // to grow the heap without causing GCs (if possible). | 14492 // to grow the heap without causing GCs (if possible). |
14493 isolate->counters()->gc_last_resort_from_js()->Increment(); | 14493 isolate->counters()->gc_last_resort_from_js()->Increment(); |
14494 isolate->heap()->CollectAllGarbage(Heap::kNoGCFlags, | 14494 isolate->heap()->CollectAllGarbage(Heap::kNoGCFlags, |
14495 "Runtime::PerformGC"); | 14495 "Runtime::PerformGC"); |
14496 } | 14496 } |
14497 } | 14497 } |
14498 | 14498 |
14499 | 14499 |
14500 } } // namespace v8::internal | 14500 } } // namespace v8::internal |
OLD | NEW |