diff options
| author | Teng-Hui Zhu <ztenghui@google.com> | 2010-11-10 15:31:59 -0800 |
|---|---|---|
| committer | Teng-Hui Zhu <ztenghui@google.com> | 2010-11-17 13:35:59 -0800 |
| commit | 28040489d744e0c5d475a88663056c9040ed5320 (patch) | |
| tree | c463676791e4a63e452a95f0a12b2a8519730693 /WebCore/bindings/js/JSArrayBufferViewHelper.h | |
| parent | eff9be92c41913c92fb1d3b7983c071f3e718678 (diff) | |
| download | external_webkit-28040489d744e0c5d475a88663056c9040ed5320.zip external_webkit-28040489d744e0c5d475a88663056c9040ed5320.tar.gz external_webkit-28040489d744e0c5d475a88663056c9040ed5320.tar.bz2 | |
Merge WebKit at r71558: Initial merge by git.
Change-Id: Ib345578fa29df7e4bc72b4f00e4a6fddcb754c4c
Diffstat (limited to 'WebCore/bindings/js/JSArrayBufferViewHelper.h')
| -rw-r--r-- | WebCore/bindings/js/JSArrayBufferViewHelper.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/WebCore/bindings/js/JSArrayBufferViewHelper.h b/WebCore/bindings/js/JSArrayBufferViewHelper.h index 27a9a98..ba712c6 100644 --- a/WebCore/bindings/js/JSArrayBufferViewHelper.h +++ b/WebCore/bindings/js/JSArrayBufferViewHelper.h @@ -115,6 +115,8 @@ PassRefPtr<ArrayBufferView> constructArrayBufferView(JSC::ExecState* exec) RefPtr<ArrayBuffer> buffer = toArrayBuffer(exec->argument(0)); if (buffer) { unsigned offset = (exec->argumentCount() > 1) ? exec->argument(1).toUInt32(exec) : 0; + if ((buffer->byteLength() - offset) % sizeof(T)) + throwError(exec, createRangeError(exec, "ArrayBuffer length minus the byteOffset is not a multiple of the element size.")); unsigned int length = (buffer->byteLength() - offset) / sizeof(T); if (exec->argumentCount() > 2) length = exec->argument(2).toUInt32(exec); |