TypedArray.prototype.slice should use the byteLength of passed array for memmove
authorkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 11 May 2016 02:04:19 +0000 (02:04 +0000)
committerkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 11 May 2016 02:04:19 +0000 (02:04 +0000)
commitcfccfb5b8028885f6619236c1753309a185f86a8
tree2b7aa0b362ad21910fc13edff4ad8455dfc0cb85
parent0482cdd2aef7785bdbd0a736597c84321724edac
TypedArray.prototype.slice should use the byteLength of passed array for memmove
https://bugs.webkit.org/show_bug.cgi?id=157551
<rdar://problem/26179914>

Reviewed by Michael Saboff.

The TypedArray.prototype.slice function would use the byteLength of the passed array
to determine the amount of data to copy. It should have been using the passed length
times the size of each element. This fixes a crash on JavaPoly.com

* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::set):
* tests/stress/typedarray-slice.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h
Source/JavaScriptCore/tests/stress/typedarray-slice.js