Bug 1312480, r=jandem

js/src/jit/MacroAssembler.cpp

@@ -1043,9 +1043,9 @@ AllocateObjectBufferWithInit(JSContext* cx, TypedArrayObject* obj, int32_t count
     // Negative numbers will bail out to the slow path, which in turn will raise
     // an invalid argument exception.
     if (count <= 0) {
+        obj->setFixedSlot(TypedArrayObject::LENGTH_SLOT, Int32Value(0));
         if (count == 0)
             obj->setInlineElements();
-        obj->setFixedSlot(TypedArrayObject::LENGTH_SLOT, Int32Value(0));
         return;
     }
 
@@ -1097,6 +1097,12 @@ MacroAssembler::initTypedArraySlots(Register obj, Register temp, Register length
     if (lengthKind == TypedArrayLength::Fixed && dataOffset + nbytes <= JSObject::MAX_BYTE_SIZE) {
         MOZ_ASSERT(dataOffset + nbytes <= templateObj->tenuredSizeOfThis());
 
+        if (length == 0) {
+            // Store nullptr inside the data slot offset when size is 0.
+            storePtr(ImmPtr(nullptr), Address(obj, dataSlotOffset));
+            return;
+        }
+
         // Store data elements inside the remaining JSObject slots.
         computeEffectiveAddress(Address(obj, dataOffset), temp);
         storePtr(temp, Address(obj, dataSlotOffset));

js/src/vm/TypedArrayObject.cpp

@@ -240,14 +240,21 @@ JS_FOR_EACH_TYPED_ARRAY(OBJECT_MOVED_TYPED_ARRAY)
 bool
 TypedArrayObject::hasInlineElements() const
 {
-    return elements() == this->fixedData(TypedArrayObject::FIXED_DATA_START) &&
-        byteLength() <= TypedArrayObject::INLINE_BUFFER_LIMIT;
+    if (byteLength() > TypedArrayObject::INLINE_BUFFER_LIMIT)
+        return false;
+
+    return (!hasBuffer() && length() == 0) ||
+           elements() == this->fixedData(TypedArrayObject::FIXED_DATA_START);
 }
 
 void
 TypedArrayObject::setInlineElements()
 {
     char* dataSlot = reinterpret_cast<char*>(this) + this->dataOffset();
+    if (length() == 0) {
+        *reinterpret_cast<void**>(dataSlot) = nullptr;
+        return;
+    }
     *reinterpret_cast<void**>(dataSlot) = this->fixedData(TypedArrayObject::FIXED_DATA_START);
 }
 
@@ -506,9 +513,13 @@ class TypedArrayObjectTemplate : public TypedArrayObject
                 }
             }
         } else {
-            void* data = obj->fixedData(FIXED_DATA_START);
-            obj->initPrivate(data);
-            memset(data, 0, len * sizeof(NativeType));
+            if (len == 0) {
+                obj->initPrivate(nullptr);
+            } else {
+                void* data = obj->fixedData(FIXED_DATA_START);
+                obj->initPrivate(data);
+                memset(data, 0, len * sizeof(NativeType));
+            }
         }
 
         obj->setFixedSlot(TypedArrayObject::LENGTH_SLOT, Int32Value(len));
@@ -621,9 +632,13 @@ class TypedArrayObjectTemplate : public TypedArrayObject
             MOZ_ASSERT(offset + nbytes <= GetGCKindBytes(allocKind));
 #endif
 
-            void* data = tarray->fixedData(FIXED_DATA_START);
-            tarray->initPrivate(data);
-            memset(data, 0, nbytes);
+            if (len == 0) {
+                tarray->initPrivate(nullptr);
+            } else {
+                void* data = tarray->fixedData(FIXED_DATA_START);
+                tarray->initPrivate(data);
+                memset(data, 0, nbytes);
+            }
         }
     }
 

js/src/vm/TypedArrayObject.h

@@ -164,8 +164,12 @@ class TypedArrayObject : public NativeObject
 
     bool hasInlineElements() const;
     void setInlineElements();
+
+    /* returns nullptr if length is zero or if this is a template object. */
     uint8_t* elements() const {
-        return *(uint8_t **)((((char *)this) + this->dataOffset()));
+        uint8_t* output = *(uint8_t **)((((char *)this) + this->dataOffset()));
+        MOZ_ASSERT_IF(length() == 0 && !hasBuffer(), output == nullptr);
+        return output;
     }
 
     Value getElement(uint32_t index);