Bug 1298773 - Make ArrayBufferInputStream copy its input buffer. r=jonco a=abillings

netwerk/base/ArrayBufferInputStream.cpp

@@ -13,7 +13,6 @@ NS_IMPL_ISUPPORTS(ArrayBufferInputStream, nsIArrayBufferInputStream, nsIInputStr
 
 ArrayBufferInputStream::ArrayBufferInputStream()
 : mBufferLength(0)
-, mOffset(0)
 , mPos(0)
 , mClosed(false)
 {
@@ -33,11 +32,16 @@ ArrayBufferInputStream::SetData(JS::Handle<JS::Value> aBuffer,
     return NS_ERROR_FAILURE;
   }
 
-  mArrayBuffer.emplace(aCx, arrayBuffer);
-
   uint32_t buflen = JS_GetArrayBufferByteLength(arrayBuffer);
-  mOffset = std::min(buflen, aByteOffset);
-  mBufferLength = std::min(buflen - mOffset, aLength);
+  uint32_t offset = std::min(buflen, aByteOffset);
+  mBufferLength = std::min(buflen - offset, aLength);
+
+  mArrayBuffer = mozilla::MakeUnique<char[]>(mBufferLength);
+
+  JS::AutoCheckCannotGC nogc;
+  bool isShared;
+  char* src = (char*) JS_GetArrayBufferData(arrayBuffer, &isShared, nogc) + offset;
+  memcpy(&mArrayBuffer[0], src, mBufferLength);
   return NS_OK;
 }
 
@@ -55,8 +59,7 @@ ArrayBufferInputStream::Available(uint64_t* aCount)
     return NS_BASE_STREAM_CLOSED;
   }
   if (mArrayBuffer) {
-    uint32_t buflen = JS_GetArrayBufferByteLength(mArrayBuffer->get());
-    *aCount = buflen ? buflen - mPos : 0;
+    *aCount = mBufferLength ? mBufferLength - mPos : 0;
   } else {
     *aCount = 0;
   }
@@ -86,34 +89,14 @@ ArrayBufferInputStream::ReadSegments(nsWriteSegmentFun writer, void *closure,
   while (mPos < mBufferLength) {
     uint32_t remaining = mBufferLength - mPos;
     MOZ_ASSERT(mArrayBuffer);
-    uint32_t byteLength = JS_GetArrayBufferByteLength(mArrayBuffer->get());
-    if (byteLength == 0) {
-      mClosed = true;
-      return NS_BASE_STREAM_CLOSED;
-    }
 
-    // If you change the size of this buffer, please also remember to
-    // update test_arraybufferinputstream.html.
-    char buffer[8192];
-    uint32_t count = std::min(std::min(aCount, remaining), uint32_t(mozilla::ArrayLength(buffer)));
+    uint32_t count = std::min(aCount, remaining);
     if (count == 0) {
       break;
     }
 
-    // It is just barely possible that writer() will detach the ArrayBuffer's
-    // data, setting its length to zero. Or move the data to a different memory
-    // area. (This would only happen in a subclass that passed something other
-    // than NS_CopySegmentToBuffer as 'writer'). So copy the data out into a
-    // holding area before passing it to writer().
-    {
-      JS::AutoCheckCannotGC nogc;
-      bool isShared;
-      char* src = (char*) JS_GetArrayBufferData(mArrayBuffer->get(), &isShared, nogc) + mOffset + mPos;
-      MOZ_ASSERT(!isShared);    // Because ArrayBuffer
-      memcpy(buffer, src, count);
-    }
     uint32_t written;
-    nsresult rv = writer(this, closure, buffer, *result, count, &written);
+    nsresult rv = writer(this, closure, &mArrayBuffer[0] + mPos, *result, count, &written);
     if (NS_FAILED(rv)) {
       // InputStreams do not propagate errors to caller.
       return NS_OK;

netwerk/base/ArrayBufferInputStream.h

@@ -9,6 +9,7 @@
 #include "nsIArrayBufferInputStream.h"
 #include "js/Value.h"
 #include "mozilla/Maybe.h"
+#include "mozilla/UniquePtr.h"
 
 #define NS_ARRAYBUFFERINPUTSTREAM_CONTRACTID "@mozilla.org/io/arraybuffer-input-stream;1"
 #define NS_ARRAYBUFFERINPUTSTREAM_CID                \
@@ -28,10 +29,9 @@ public:
 
 private:
   virtual ~ArrayBufferInputStream() {}
-  mozilla::Maybe<JS::PersistentRooted<JSObject*> > mArrayBuffer;
-  uint32_t mBufferLength; // length of slice
-  uint32_t mOffset; // permanent offset from start of actual buffer
-  uint32_t mPos; // offset from start of slice
+  mozilla::UniquePtr<char[]> mArrayBuffer;
+  uint32_t mBufferLength;
+  uint32_t mPos;
   bool mClosed;
 };
 

netwerk/test/mochitests/test_arraybufferinputstream.html

@@ -19,6 +19,7 @@ function test()
   var ab = new ArrayBuffer(4000);
   var ta = new Uint8Array(ab);
   ta[0] = 'a'.charCodeAt(0);
+  ta[1] = 'b'.charCodeAt(0);
 
   const Cc = SpecialPowers.Cc, Ci = SpecialPowers.Ci, Cr = SpecialPowers.Cr;
   var abis = Cc["@mozilla.org/io/arraybuffer-input-stream;1"]
@@ -41,13 +42,11 @@ function test()
 
   try
   {
-    sis.read(1);
-    ok(false, "reading from stream shouldn't have worked");
+    is(sis.read(1), "b", "should read 'b' after detaching buffer");
   }
   catch (e)
   {
-    ok(e.result === Cr.NS_BASE_STREAM_CLOSED,
-       "detaching underneath an input stream should close it");
+    ok(false, "reading from stream should have worked");
   }
 
   // A regression test for bug 1265076.  Previously, overflowing