Add type checks to typed array property getters.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/14650014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14538 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/messages.js

@@ -103,6 +103,7 @@ var kMessages = {
   proto_poison_pill:             ["Generic use of __proto__ accessor not allowed"],
   parameterless_typed_array_constr:
                                  ["%0"," constructor should have at least one argument."],
+  not_typed_array:               ["this is not a typed array."],
   // RangeError
   invalid_array_length:          ["Invalid array length"],
   invalid_array_buffer_length:   ["Invalid array buffer length"],

src/runtime.cc

@@ -872,8 +872,12 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_TypedArrayInitialize) {
   RUNTIME_FUNCTION(MaybeObject*, Runtime_TypedArrayGet##getter) {             \
     HandleScope scope(isolate);                                               \
     ASSERT(args.length() == 1);                                               \
-    CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, holder, 0);          \
-    return holder->accessor();                                    \
+    CONVERT_ARG_HANDLE_CHECKED(Object, holder, 0);                            \
+    if (!holder->IsJSTypedArray())                                            \
+      return isolate->Throw(*isolate->factory()->NewTypeError(                \
+          "not_typed_array", HandleVector<Object>(NULL, 0)));                 \
+    Handle<JSTypedArray> typed_array(JSTypedArray::cast(*holder));            \
+    return typed_array->accessor();                                           \
   }
 
 TYPED_ARRAY_GETTER(Buffer, buffer)

test/mjsunit/harmony/typedarrays.js

@@ -323,6 +323,7 @@ function TestTypedArrayOutOfRange(constructor, value, result) {
 
 TestTypedArrayOutOfRange(Uint8Array, 0x1FA, 0xFA);
 TestTypedArrayOutOfRange(Uint8Array, -1, 0xFF);
+
 TestTypedArrayOutOfRange(Int8Array, 0x1FA, 0x7A - 0x80);
 
 TestTypedArrayOutOfRange(Uint16Array, 0x1FFFA, 0xFFFA);
@@ -331,11 +332,44 @@ TestTypedArrayOutOfRange(Int16Array, 0x1FFFA, 0x7FFA - 0x8000);
 
 TestTypedArrayOutOfRange(Uint32Array, 0x1FFFFFFFA, 0xFFFFFFFA);
 TestTypedArrayOutOfRange(Uint32Array, -1, 0xFFFFFFFF);
-TestTypedArrayOutOfRange(Int16Array, 0x1FFFFFFFA, 0x7FFFFFFA - 0x80000000);
+TestTypedArrayOutOfRange(Int32Array, 0x1FFFFFFFA, 0x7FFFFFFA - 0x80000000);
 
 TestTypedArrayOutOfRange(Uint8ClampedArray, 0x1FA, 0xFF);
 TestTypedArrayOutOfRange(Uint8ClampedArray, -1, 0);
 
+var typedArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray,
+  Float32Array,
+  Float64Array];
+
+function TestPropertyTypeChecks(constructor) {
+  var a = new constructor();
+  function CheckProperty(name) {
+    var d = Object.getOwnPropertyDescriptor(constructor.prototype, name);
+    var o = {}
+    assertThrows(function() {d.get.call(o);}, TypeError);
+    d.get.call(a); // shouldn't throw
+    for (var i = 0 ; i < typedArrayConstructors.length; i++) {
+      d.get.call(new typedArrayConstructors[i](10));
+    }
+  }
+
+  CheckProperty("buffer");
+  CheckProperty("byteOffset");
+  CheckProperty("byteLength");
+  CheckProperty("length");
+}
+
+for(i = 0; i < typedArrayConstructors.lenght; i++) {
+  TestPropertyTypeChecks(typedArrayConstructors[i]);
+}
+
 
 // General tests for properties
 
@@ -352,14 +386,9 @@ function TestEnumerable(func, obj) {
     assertArrayEquals([], props(obj));
 }
 TestEnumerable(ArrayBuffer, new ArrayBuffer());
-TestEnumerable(Uint8Array);
-TestEnumerable(Int8Array);
-TestEnumerable(Uint16Array);
-TestEnumerable(Int16Array);
-TestEnumerable(Uint32Array);
-TestEnumerable(Int32Array);
-TestEnumerable(Float32Array);
-TestEnumerable(Uint8ClampedArray);
+for(i = 0; i < typedArrayConstructors.lenght; i++) {
+  TestEnumerable(typedArrayConstructors[i]);
+}
 
 // Test arbitrary properties on ArrayBuffer
 function TestArbitrary(m) {
@@ -373,6 +402,11 @@ function TestArbitrary(m) {
   }
 }
 TestArbitrary(new ArrayBuffer(256));
+for(i = 0; i < typedArrayConstructors.lenght; i++) {
+  TestArbitary(new typedArrayConstructors[i](10));
+}
+
+
 
 // Test direct constructor call
 assertTrue(ArrayBuffer() instanceof ArrayBuffer);