mirrors/serenity
1
0
Fork 0
mirror of https://github.com/SerenityOS/serenity.git synced 2025-01-24 10:22:05 -05:00
Code Issues Projects Releases Packages Wiki Activity

LibJS: Don't crash when calling byte_length for a detached ArrayBuffer

Browse source
This commit is contained in:
PrestonLTaylor 2023-06-30 19:44:22 +01:00 • committed by Jelle Raaijmakers
parent a036346e24
commit 286bf307d2
2 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
Userland/Libraries/LibJS/Runtime/ArrayBuffer.h
View file

@ -32,7 +32,13 @@ public:
virtual ~ArrayBuffer() override = default;
size_t byte_length() const { return buffer_impl().size(); }
size_t byte_length() const
{
if (is_detached())
return 0;
return buffer_impl().size();
}
// [[ArrayBufferData]]
ByteBuffer& buffer() { return buffer_impl(); }

8
Userland/Libraries/LibJS/Runtime/ArrayBufferPrototype.cpp
View file

@ -138,15 +138,11 @@ JS_DEFINE_NATIVE_FUNCTION(ArrayBufferPrototype::byte_length_getter)
// 3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
// FIXME: Check for shared buffer
// NOTE: These steps are done in byte_length()
// 4. If IsDetachedBuffer(O) is true, return +0𝔽.
if (array_buffer_object->is_detached())
return Value(0);
// 5. Let length be O.[[ArrayBufferByteLength]].
auto length = array_buffer_object->byte_length();
// 6. Return 𝔽(length).
return Value(length);
return Value(array_buffer_object->byte_length());
}
// 25.1.5.4 get ArrayBuffer.prototype.detached, https://tc39.es/proposal-arraybuffer-transfer/#sec-get-arraybuffer.prototype.detached