Normative: Recompute count in TA.p.slice #3255
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This is a bug fix and so is normative, but does not need consensus since it is obviously a bug. |
bakkot
approved these changes
Jan 11, 2024
syg
added
spec bug
ready to merge
ljharb
added
the
normative change
Closes tc39#3248. The current algorithm has a bug that can result in OOB reads in the source TA, because _count_ is not correctly recomputed when the source TA is resized during evaluation of the species constructor. (It is currently bounded by _len_, which is recomputed, but this is incorrect because the bounds of the copy loop is not on the length, but instead on how many bytes need to be copied.)
ljharb
force-pushed
the
fix-ta-p-slice
branch
from
5a211e1 to
22de374
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #3248.
The current algorithm has a bug that can result in OOB reads in the source TA, because count is not correctly recomputed when the source TA is resized during evaluation of the species constructor.
(It is currently bounded by len, which is recomputed, but this is incorrect because the bounds of the copy loop is not on the length, but instead on how many bytes need to be copied.)