Bug 1290579 - Float32 RadixSort ignores typed array byte offsets
MozReview-Commit-ID: 3ZacUqh2QyV
--- a/js/src/builtin/Sorting.js
+++ b/js/src/builtin/Sorting.js
@@ -114,17 +114,23 @@ function RadixSort(array, len, buffer, n
// This happens if the array object is constructed under JIT
if (buffer === null) {
buffer = callFunction(std_TypedArray_buffer, array);
}
// Verify that the buffer is non-null
assert(buffer !== null, "Attached data buffer should be reified when array length is >= 128.");
- view = new Int32Array(buffer);
+ // Find the offset of the buffer based on whether array is typed or not
+ let offset = IsTypedArray(array)
+ ? TypedArrayByteOffset(array)
+ : callFunction(CallTypedArrayMethodIfWrapped, array, array,
+ "TypedArrayByteOffset");
+
+ view = new Int32Array(buffer, offset, len);
// Flip sign bit for positive numbers; flip all bits for negative
// numbers
for (let i = 0; i < len; i++) {
if (view[i] & signMask) {
// If sign-bit is set, but the entry was originally a NaN, then use
// a regular NaN and flip the sign bit
if ((view[i] & 0x7F800000) === 0x7F800000 && (view[i] & 0x007FFFFF) !== 0) {
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedArray/sort_byteoffset.js
@@ -0,0 +1,27 @@
+// Ensure that when sorting TypedArrays we don't
+// ignore byte offsets (bug 1290579).
+
+// The bug manifests itself only with Float arrays,
+// but checking everything here just for sanity.
+const constructors = [
+ Int8Array,
+ Uint8Array,
+ Uint8ClampedArray,
+ Int16Array,
+ Uint16Array,
+ Int32Array,
+ Uint32Array,
+ Float32Array,
+ Float64Array ];
+
+for (var ctor of constructors) {
+ var ab = new ArrayBuffer(1025 * ctor.BYTES_PER_ELEMENT);
+ var ta = new ctor(ab, ctor.BYTES_PER_ELEMENT, 1024);
+ var testArray = new ctor(ab, 0, 1);
+ testArray[0] = 1;
+ ta.sort();
+ assertEq(testArray[0], 1);
+}
+
+if (typeof reportCompare === "function")
+ reportCompare(true, true);
\ No newline at end of file