Reviewers: Dmitry Lomov (chromium),

Message:
PTAL.

Description:
Reorder checks in Runtime_TypedArrayInitialize*

All checks must be performed before any side effects, so we get atomic
transactions

BUG=chromium:374443
LOG=n

Please review this at https://codereview.chromium.org/298843003/

SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge

Affected files (+18, -18 lines):
  M src/runtime.cc


Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index c3610fbe3ffb6df22c959dd2384d79759cc3011c..457180b140dc6ab3fb2e4aa5b8e873078b658180 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -962,12 +962,6 @@ RUNTIME_FUNCTION(Runtime_TypedArrayInitialize) {
                  arrayId <= Runtime::ARRAY_ID_LAST);
RUNTIME_ASSERT(maybe_buffer->IsNull() || maybe_buffer->IsJSArrayBuffer());

-  ASSERT(holder->GetInternalFieldCount() ==
-      v8::ArrayBufferView::kInternalFieldCount);
-  for (int i = 0; i < v8::ArrayBufferView::kInternalFieldCount; i++) {
-    holder->SetInternalField(i, Smi::FromInt(0));
-  }
-
ExternalArrayType array_type = kExternalInt8Array; // Bogus initialization.
   size_t element_size = 1;  // Bogus initialization.
   ElementsKind external_elements_kind =
@@ -978,7 +972,6 @@ RUNTIME_FUNCTION(Runtime_TypedArrayInitialize) {
       &external_elements_kind,
       &fixed_elements_kind,
       &element_size);
-
   RUNTIME_ASSERT(holder->map()->elements_kind() == fixed_elements_kind);

   size_t byte_offset = 0;
@@ -986,9 +979,6 @@ RUNTIME_FUNCTION(Runtime_TypedArrayInitialize) {
RUNTIME_ASSERT(TryNumberToSize(isolate, *byte_offset_object, &byte_offset)); RUNTIME_ASSERT(TryNumberToSize(isolate, *byte_length_object, &byte_length));

-  holder->set_byte_offset(*byte_offset_object);
-  holder->set_byte_length(*byte_length_object);
-
   RUNTIME_ASSERT(byte_length % element_size == 0);
   size_t length = byte_length / element_size;

@@ -998,8 +988,6 @@ RUNTIME_FUNCTION(Runtime_TypedArrayInitialize) {
                                            HandleVector<Object>(NULL, 0)));
   }

- Handle<Object> length_obj = isolate->factory()->NewNumberFromSize(length);
-  holder->set_length(*length_obj);
   if (!maybe_buffer->IsNull()) {
     Handle<JSArrayBuffer> buffer(JSArrayBuffer::cast(*maybe_buffer));

@@ -1028,6 +1016,18 @@ RUNTIME_FUNCTION(Runtime_TypedArrayInitialize) {
             static_cast<int>(length), array_type);
     holder->set_elements(*elements);
   }
+
+  ASSERT(holder->GetInternalFieldCount() ==
+      v8::ArrayBufferView::kInternalFieldCount);
+  for (int i = 0; i < v8::ArrayBufferView::kInternalFieldCount; i++) {
+    holder->SetInternalField(i, Smi::FromInt(0));
+  }
+
+ Handle<Object> length_obj = isolate->factory()->NewNumberFromSize(length);
+  holder->set_length(*length_obj);
+  holder->set_byte_offset(*byte_offset_object);
+  holder->set_byte_length(*byte_length_object);
+
   return isolate->heap()->undefined_value();
 }

@@ -1048,12 +1048,6 @@ RUNTIME_FUNCTION(Runtime_TypedArrayInitializeFromArrayLike) {
   RUNTIME_ASSERT(arrayId >= Runtime::ARRAY_ID_FIRST &&
                  arrayId <= Runtime::ARRAY_ID_LAST);

-  ASSERT(holder->GetInternalFieldCount() ==
-      v8::ArrayBufferView::kInternalFieldCount);
-  for (int i = 0; i < v8::ArrayBufferView::kInternalFieldCount; i++) {
-    holder->SetInternalField(i, Smi::FromInt(0));
-  }
-
ExternalArrayType array_type = kExternalInt8Array; // Bogus initialization.
   size_t element_size = 1;  // Bogus initialization.
   ElementsKind external_elements_kind =
@@ -1083,6 +1077,12 @@ RUNTIME_FUNCTION(Runtime_TypedArrayInitializeFromArrayLike) {
   }
   size_t byte_length = length * element_size;

+  ASSERT(holder->GetInternalFieldCount() ==
+      v8::ArrayBufferView::kInternalFieldCount);
+  for (int i = 0; i < v8::ArrayBufferView::kInternalFieldCount; i++) {
+    holder->SetInternalField(i, Smi::FromInt(0));
+  }
+
   // NOTE: not initializing backing store.
   // We assume that the caller of this function will initialize holder
   // with the loop


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to