[MERGE chakra-core#919] Memset: Native arrays typecheck and missing item check

Cellule · Cellule · commit b9991bd24fc4 · 2016-05-04T15:32:17.000-07:00
Merge pull request chakra-core#919 from Cellule:memset/float_type Memset with native float arrays needs to check the type of the source because we can do `nativearray[i] = var` and bailout after the fact if the source was not a float (ie: changes the type of array). Since memset will not change the type of the array, it needs to check before hand that the source is actually a float or int and bailout if not. Additionally, I added a check for `IsMissingItem` for native int and float arrays.
diff --git a/lib/Runtime/Language/JavascriptOperators.cpp b/lib/Runtime/Language/JavascriptOperators.cpp
@@ -4685,11 +4685,29 @@ namespace Js
                 }
                 else if (instanceType == TypeIds_NativeIntArray)
                 {
-                    returnValue = JavascriptArray::FromVar(instance)->DirectSetItemAtRange<int32>(start, length, JavascriptConversion::ToInt32(value, scriptContext));
+                    // Only accept tagged int. Also covers case for MissingItem
+                    if (!TaggedInt::Is(value))
+                    {
+                        return false;
+                    }
+                    int32 intValue = JavascriptConversion::ToInt32(value, scriptContext);
+                    returnValue = JavascriptArray::FromVar(instance)->DirectSetItemAtRange<int32>(start, length, intValue);
                 }
                 else
                 {
-                    returnValue = JavascriptArray::FromVar(instance)->DirectSetItemAtRange<double>(start, length, JavascriptConversion::ToNumber(value, scriptContext));
+                    // For native float arrays, the jit doesn't check the type of the source so we have to do it here
+                    if (!JavascriptNumber::Is(value) && !TaggedNumber::Is(value))
+                    {
+                        return false;
+                    }
+
+                    double doubleValue = JavascriptConversion::ToNumber(value, scriptContext);
+                    // Special case for missing item
+                    if (SparseArraySegment<double>::IsMissingItem(&doubleValue))
+                    {
+                        return false;
+                    }
+                    returnValue = JavascriptArray::FromVar(instance)->DirectSetItemAtRange<double>(start, length, doubleValue);
                 }
                 returnValue &= vt == VirtualTableInfoBase::GetVirtualTable(instance);
             }

Original file line number	Diff line number	Diff line change
`@@ -4685,11 +4685,29 @@ namespace Js`
`4685`	`4685`	`}`
`4686`	`4686`	`else if (instanceType == TypeIds_NativeIntArray)`
`4687`	`4687`	`{`
`4688`		`- returnValue = JavascriptArray::FromVar(instance)->DirectSetItemAtRange<int32>(start, length, JavascriptConversion::ToInt32(value, scriptContext));`
	`4688`	`+ // Only accept tagged int. Also covers case for MissingItem`
	`4689`	`+ if (!TaggedInt::Is(value))`
	`4690`	`+ {`
	`4691`	`+ return false;`
	`4692`	`+ }`
	`4693`	`+ int32 intValue = JavascriptConversion::ToInt32(value, scriptContext);`
	`4694`	`+ returnValue = JavascriptArray::FromVar(instance)->DirectSetItemAtRange<int32>(start, length, intValue);`
`4689`	`4695`	`}`
`4690`	`4696`	`else`
`4691`	`4697`	`{`
`4692`		`- returnValue = JavascriptArray::FromVar(instance)->DirectSetItemAtRange<double>(start, length, JavascriptConversion::ToNumber(value, scriptContext));`
	`4698`	`+ // For native float arrays, the jit doesn't check the type of the source so we have to do it here`
	`4699`	`+ if (!JavascriptNumber::Is(value) && !TaggedNumber::Is(value))`
	`4700`	`+ {`
	`4701`	`+ return false;`
	`4702`	`+ }`
	`4703`	`+`
	`4704`	`+ double doubleValue = JavascriptConversion::ToNumber(value, scriptContext);`
	`4705`	`+ // Special case for missing item`
	`4706`	`+ if (SparseArraySegment<double>::IsMissingItem(&doubleValue))`
	`4707`	`+ {`
	`4708`	`+ return false;`
	`4709`	`+ }`
	`4710`	`+ returnValue = JavascriptArray::FromVar(instance)->DirectSetItemAtRange<double>(start, length, doubleValue);`
`4693`	`4711`	`}`
`4694`	`4712`	`returnValue &= vt == VirtualTableInfoBase::GetVirtualTable(instance);`
`4695`	`4713`	`}`