fix border checks for typedarray set

* fix border checks for typedarray set (see HtmlUnit/htmlunit-core-js#27) * move error msg to properties file * use messages for typedarray ctor * use messages for typedarray with method
mozilla · Dec 23, 2024 · 48182a1 · 48182a1
1 parent 42b64b6
commit 48182a1
Show file tree

Hide file tree

Showing 7 changed files with 409 additions and 12 deletions.
diff --git a/rhino/src/main/java/org/mozilla/javascript/typedarrays/NativeTypedArrayView.java b/rhino/src/main/java/org/mozilla/javascript/typedarrays/NativeTypedArrayView.java
@@ -555,17 +555,26 @@ protected static NativeTypedArrayView<?> js_constructor(
             }
 
             if ((byteOff < 0) || (byteOff > na.getLength())) {
-                throw ScriptRuntime.rangeError("offset out of range");
+                String msg = ScriptRuntime.getMessageById("msg.typed.array.bad.offset", byteOff);
+                throw ScriptRuntime.rangeError(msg);
             }
             if ((byteLen < 0) || ((byteOff + byteLen) > na.getLength())) {
-                throw ScriptRuntime.rangeError("length out of range");
+                String msg = ScriptRuntime.getMessageById("msg.typed.array.bad.length", byteLen);
+                throw ScriptRuntime.rangeError(msg);
             }
             if ((byteOff % bytesPerElement) != 0) {
-                throw ScriptRuntime.rangeError("offset must be a multiple of the byte size");
+                String msg =
+                        ScriptRuntime.getMessageById(
+                                "msg.typed.array.bad.offset.byte.size", byteOff, bytesPerElement);
+                throw ScriptRuntime.rangeError(msg);
             }
             if ((byteLen % bytesPerElement) != 0) {
-                throw ScriptRuntime.rangeError(
-                        "offset and buffer must be a multiple of the byte size");
+                String msg =
+                        ScriptRuntime.getMessageById(
+                                "msg.typed.array.bad.buffer.length.byte.size",
+                                byteLen,
+                                bytesPerElement);
+                throw ScriptRuntime.rangeError(msg);
             }
 
             return constructable.construct(na, byteOff, byteLen / bytesPerElement);
@@ -608,12 +617,14 @@ protected static NativeTypedArrayView<?> js_constructor(
     }
 
     private void setRange(NativeTypedArrayView<?> v, int off) {
-        if (off >= length) {
-            throw ScriptRuntime.rangeError("offset out of range");
+        if (off < 0 || off > length) {
+            String msg = ScriptRuntime.getMessageById("msg.typed.array.bad.offset", off);
+            throw ScriptRuntime.rangeError(msg);
         }
 
         if (v.length > (length - off)) {
-            throw ScriptRuntime.rangeError("source array too long");
+            String msg = ScriptRuntime.getMessageById("msg.typed.array.bad.source.array");
+            throw ScriptRuntime.rangeError(msg);
         }
 
         if (v.arrayBuffer == arrayBuffer) {
@@ -633,11 +644,13 @@ private void setRange(NativeTypedArrayView<?> v, int off) {
     }
 
     private void setRange(NativeArray a, int off) {
-        if (off > length) {
-            throw ScriptRuntime.rangeError("offset out of range");
+        if (off < 0 || off > length) {
+            String msg = ScriptRuntime.getMessageById("msg.typed.array.bad.offset", off);
+            throw ScriptRuntime.rangeError(msg);
         }
         if ((off + a.size()) > length) {
-            throw ScriptRuntime.rangeError("offset + length out of range");
+            String msg = ScriptRuntime.getMessageById("msg.typed.array.bad.source.array");
+            throw ScriptRuntime.rangeError(msg);
         }
 
         int pos = off;
@@ -1118,7 +1131,13 @@ private static Object js_with(
         Object argsValue = args.length > 1 ? ScriptRuntime.toNumber(args[1]) : 0.0;
 
         if (actualIndex < 0 || actualIndex >= self.length) {
-            throw ScriptRuntime.rangeError("index out of range");
+            String msg =
+                    ScriptRuntime.getMessageById(
+                            "msg.typed.array.index.out.of.bounds",
+                            relativeIndex,
+                            self.length * -1,
+                            self.length - 1);
+            throw ScriptRuntime.rangeError(msg);
         }
 
         NativeArrayBuffer newBuffer =

diff --git a/rhino/src/main/resources/org/mozilla/javascript/resources/Messages.properties b/rhino/src/main/resources/org/mozilla/javascript/resources/Messages.properties
@@ -997,6 +997,24 @@ msg.promise.any.toobig =\
 msg.typed.array.ctor.incompatible = \
   Method %TypedArray%.prototype.{0} called on incompatible receiver
 
+msg.typed.array.bad.offset = \
+  offset {0} out of range
+
+msg.typed.array.bad.length = \
+  length {0} out of range
+
+msg.typed.array.bad.offset.byte.size = \
+  offset {0} must be a multiple of the byte size {1}
+
+msg.typed.array.bad.buffer.length.byte.size = \
+  used buffer length {0} must be a multiple of the byte size {1}
+
+msg.typed.array.bad.source.array = \
+  source array is too long
+
+msg.typed.array.index.out.of.bounds =\
+    index {0} is out of bounds [{1}..{2}]
+
 # Error
 msg.iterable.expected =\
   Expected the first argument to be iterable

diff --git a/tests/src/test/java/org/mozilla/javascript/tests/harmony/TypedArraySetTest.java b/tests/src/test/java/org/mozilla/javascript/tests/harmony/TypedArraySetTest.java
@@ -0,0 +1,11 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.javascript.tests.harmony;
+
+import org.mozilla.javascript.drivers.RhinoTest;
+import org.mozilla.javascript.drivers.ScriptTestsBase;
+
+@RhinoTest("testsrc/jstests/harmony/typed-array-set.js")
+public class TypedArraySetTest extends ScriptTestsBase {}
diff --git a/tests/src/test/java/org/mozilla/javascript/tests/harmony/TypedArrayWithTest.java b/tests/src/test/java/org/mozilla/javascript/tests/harmony/TypedArrayWithTest.java
@@ -0,0 +1,11 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.javascript.tests.harmony;
+
+import org.mozilla.javascript.drivers.RhinoTest;
+import org.mozilla.javascript.drivers.ScriptTestsBase;
+
+@RhinoTest("testsrc/jstests/harmony/typed-array-with.js")
+public class TypedArrayWithTest extends ScriptTestsBase {}