Backed out changeset 6dc60397b3a1 (bug 976530)

js/src/builtin/TypeRepresentation.cpp

@@ -309,9 +309,9 @@ StructTypeRepresentation::init(JSContext *cx,
 
     // We compute alignment into the field `align_` directly in the
     // loop below, but not `size_` because we have to very careful
-    // about overflow. For now, we always use an int32_t for
+    // about overflow. For now, we always use a uint32_t for
     // consistency across build environments.
-    int32_t totalSize = 0;
+    uint32_t totalSize = 0;
 
     // These will be adjusted in the loop below:
     alignment_ = 1;
@@ -324,7 +324,7 @@ StructTypeRepresentation::init(JSContext *cx,
         if (fieldTypeRepr->opaque())
             opaque_ = true;
 
-        int32_t alignedSize = alignTo(totalSize, fieldTypeRepr->alignment());
+        uint32_t alignedSize = alignTo(totalSize, fieldTypeRepr->alignment());
         if (alignedSize < totalSize) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
                                  JSMSG_TYPEDOBJECT_TOO_BIG);
@@ -335,7 +335,7 @@ StructTypeRepresentation::init(JSContext *cx,
                                       fieldTypeRepr, alignedSize);
         alignment_ = js::Max(alignment_, fieldTypeRepr->alignment());
 
-        int32_t incrementedSize = alignedSize + fieldTypeRepr->size();
+        uint32_t incrementedSize = alignedSize + fieldTypeRepr->size();
         if (incrementedSize < alignedSize) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
                                  JSMSG_TYPEDOBJECT_TOO_BIG);
@@ -345,7 +345,7 @@ StructTypeRepresentation::init(JSContext *cx,
         totalSize = incrementedSize;
     }
 
-    int32_t alignedSize = alignTo(totalSize, alignment_);
+    uint32_t alignedSize = alignTo(totalSize, alignment_);
     if (alignedSize < totalSize) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
                              JSMSG_TYPEDOBJECT_TOO_BIG);

js/src/jit-test/tests/TypedObject/bug976530.js

@@ -1,10 +0,0 @@
-// |jit-test| error:Error
-
-// Test that we don't permit structs whose fields exceed 32 bits. Public domain.
-
-if (!this.hasOwnProperty("TypedObject"))
-  throw new Error();
-
-var Vec3u16Type = TypedObject.uint16.array((1073741823));
-var PairVec3u16Type = new TypedObject.StructType({ fst: Vec3u16Type, snd: Vec3u16Type });
-new PairVec3u16Type();

js/src/vm/ArrayBufferObject.cpp

@@ -303,7 +303,6 @@ static ObjectElements *
 AllocateArrayBufferContents(JSContext *maybecx, uint32_t nbytes, void *oldptr = nullptr)
 {
     uint32_t size = nbytes + sizeof(ObjectElements);
-    JS_ASSERT(size > nbytes); // be wary of rollover
     ObjectElements *newheader;
 
     // if oldptr is given, then we need to do a realloc