Bug 1290579 - Float32 RadixSort ignores typed array byte offsets draft
authorSumit Tiwari <sumi29@gmail.com>
Thu, 08 Sep 2016 19:15:23 -0400
changeset 413300 8fde43f7b511a80f436d1297462317435f51911d
parent 407851 57cd105cf829ab0891edd14a75c575c55a2a8a68
child 531201 8561ded8e51715a482a97d02ad392d8056c247cb
push id29402
push userbmo:sumi29@gmail.com
push dateWed, 14 Sep 2016 00:21:30 +0000
bugs1290579
milestone51.0a1
Bug 1290579 - Float32 RadixSort ignores typed array byte offsets MozReview-Commit-ID: 3ZacUqh2QyV
js/src/builtin/Sorting.js
js/src/tests/ecma_6/TypedArray/sort_byteoffset.js
--- a/js/src/builtin/Sorting.js
+++ b/js/src/builtin/Sorting.js
@@ -114,17 +114,23 @@ function RadixSort(array, len, buffer, n
         // This happens if the array object is constructed under JIT
         if (buffer === null) {
             buffer = callFunction(std_TypedArray_buffer, array);
         }
 
         // Verify that the buffer is non-null
         assert(buffer !== null, "Attached data buffer should be reified when array length is >= 128.");
 
-        view = new Int32Array(buffer);
+        // Find the offset of the buffer based on whether array is typed or not
+        let offset = IsTypedArray(array)
+                     ? TypedArrayByteOffset(array)
+                     : callFunction(CallTypedArrayMethodIfWrapped, array, array,
+                                    "TypedArrayByteOffset");
+
+        view = new Int32Array(buffer, offset, len);
 
         // Flip sign bit for positive numbers; flip all bits for negative
         // numbers
         for (let i = 0; i < len; i++) {
             if (view[i] & signMask) {
                 // If sign-bit is set, but the entry was originally a NaN, then use
                 // a regular NaN and flip the sign bit
                 if ((view[i] & 0x7F800000) === 0x7F800000 && (view[i] & 0x007FFFFF) !== 0) {
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedArray/sort_byteoffset.js
@@ -0,0 +1,27 @@
+// Ensure that when sorting TypedArrays we don't
+// ignore byte offsets (bug 1290579).
+
+// The bug manifests itself only with Float arrays,
+// but checking everything here just for sanity.
+const constructors = [
+    Int8Array,
+    Uint8Array,
+    Uint8ClampedArray,
+    Int16Array,
+    Uint16Array,
+    Int32Array,
+    Uint32Array,
+    Float32Array,
+    Float64Array ];
+
+for (var ctor of constructors) {
+    var ab = new ArrayBuffer(1025 * ctor.BYTES_PER_ELEMENT);
+    var ta = new ctor(ab, ctor.BYTES_PER_ELEMENT, 1024);
+    var testArray = new ctor(ab, 0, 1);
+    testArray[0] = 1;
+    ta.sort();
+    assertEq(testArray[0], 1);
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);
\ No newline at end of file