Bug 57042 – Float32Array(ArrayBuffer, index, length) constructor working incorrectly.

• Component: WebGL
• Status: RESOLVED FIXED

[danceoffwithyourpantsoff]

new Float32Array(new ArrayBuffer(10), 0, 2)
RangeError: ArrayBuffer length minus the byteOffset is not a multiple of the element size.

Unless I am misunderstanding the spec, a Float32Array of length 2 should be 8 bytes, enough to fit, and everything should be aligned.

[Kenneth Russell]

Created attachment 102080 [details]
Patch

[James Robinson]

Comment on attachment 102080 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=102080&action=review

I think this is good, just have one question about signed-ness.

> Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h:65
> +        length = (buf->byteLength() - offset) / sizeof(ElementType);

What if offset is bigger than byteLength()?

[Kenneth Russell]

(In reply to comment #2)
> (From update of attachment 102080 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=102080&action=review
> 
> I think this is good, just have one question about signed-ness.
> 
> > Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h:65
> > +        length = (buf->byteLength() - offset) / sizeof(ElementType);
> 
> What if offset is bigger than byteLength()?

This will be caught by other checks in the C++ code. I'll expand the test case to explicitly check this.

[Kenneth Russell]

Committed r91803: <http://trac.webkit.org/changeset/91803>