Bug 129746 – JSDataViewPrototype::getData() and setData() crash on platforms that don't allow unaligned accesses

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

In runtime/JSDataViewPrototype.cpp getData() and setData() us reinterpret_cast from uint8_t* to the various native data types needed to implement the various get*() and set*() DataView methods.  For platforms that don't allow aligned accesses, this will cause a crash.

[Michael Saboff]

Created attachment 225894 [details]
Patch

[Filip Pizlo]

Comment on attachment 225894 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=225894&action=review

R=me if you add some squigles.

> Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp:181
>      if (needToFlipBytesIfLittleEndian(littleEndian))
> -        value = flipBytes(value);
> -    
> -    *reinterpret_cast<typename Adaptor::Type*>(static_cast<uint8_t*>(dataView->vector()) + byteOffset) = value;
> -    
> +        for (unsigned i = dataSize; i--;)
> +            *dataPtr++ = u.rawBytes[i];
> +    else
> +        for (unsigned i = 0; i < dataSize; i++)
> +            *dataPtr++ = u.rawBytes[i];

You need some squigly braces {} here.

[Michael Saboff]

Committed r165121: <http://trac.webkit.org/changeset/165121>