Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Typedarray.slice fastpath when the content type is matching #4898

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

rerobika
Copy link
Member

@rerobika rerobika commented Dec 9, 2021

This patch fixes #4888.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik robert.fancsik@h-lab.eu

@rerobika rerobika added the bug Undesired behaviour label Dec 9, 2021
This patch fixes jerryscript-project#4888.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik robert.fancsik@h-lab.eu
{
memcpy (dst_buffer_p, src_buffer_p, count << info_p->shift);
}
else if (count >= new_typedarray_info.offset)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if count is less than the target offset? I don't think this condition is correct.

var buf = new ArrayBuffer(10);
var a1 = new Int8Array(buf, 0, 5);
a1.fill(1);
a1.constructor = {
    [Symbol.species]: function (len) {
        return new Int8Array(buf, 5, 5);
    }
};
var a2 = a1.slice(2,4);
res = new Int8Array(buf, 0, 10);

Also, I don't think checking the offset is the right way, we need to check whether the two typedarrays use the same arraybuffer instead, and only then fall back to copying element-by-element.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Undesired behaviour
Projects
None yet
2 participants