Bug 1704042 part 4 - Use GetLengthProperty overload returning uint64_t for TypedArray fromObject. r=lth

Depends on D111383

Differential Revision: https://phabricator.services.mozilla.com/D111384

js/src/jit-test/tests/large-arraybuffers/typed-array.js

@@ -1,5 +1,6 @@
-var gb = 1 * 1024 * 1024 * 1024;
+load(libdir + "asserts.js");
 
+var gb = 1 * 1024 * 1024 * 1024;
 var ta = new Uint8Array(4 * gb + 10);
 
 function testSetFromTyped() {
@@ -193,3 +194,8 @@ function testArrayBufferSlice() {
     assertEq(ta2.toString(), "100,101,102");
 }
 testArrayBufferSlice();
+
+function testFromObjectTooLargeLength() {
+    assertThrowsInstanceOf(() => new Uint8Array({length: 9 * gb}), RangeError);
+}
+testFromObjectTooLargeLength();

js/src/vm/ObjectOperations-inl.h

@@ -155,6 +155,24 @@ inline bool GetElement(JSContext* cx, JS::Handle<JSObject*> obj,
   return GetElement(cx, obj, receiverValue, index, vp);
 }
 
+inline bool GetElementLargeIndex(JSContext* cx, JS::Handle<JSObject*> obj,
+                                 JS::Handle<JSObject*> receiver, uint64_t index,
+                                 JS::MutableHandle<JS::Value> vp) {
+  MOZ_ASSERT(index < uint64_t(DOUBLE_INTEGRAL_PRECISION_LIMIT));
+
+  if (MOZ_LIKELY(index <= UINT32_MAX)) {
+    return GetElement(cx, obj, receiver, uint32_t(index), vp);
+  }
+
+  RootedValue tmp(cx, DoubleValue(index));
+  RootedId id(cx);
+  if (!PrimitiveValueToId<CanGC>(cx, tmp, &id)) {
+    return false;
+  }
+
+  return GetProperty(cx, obj, obj, id, vp);
+}
+
 inline bool GetPropertyNoGC(JSContext* cx, JSObject* obj,
                             const JS::Value& receiver, jsid id, JS::Value* vp) {
   if (obj->getOpsGetProperty()) {

js/src/vm/TypedArrayObject-inl.h

@@ -444,8 +444,14 @@ class ElementSpecific {
     // Convert and copy any remaining elements generically.
     RootedValue v(cx);
     for (; i < len; i++) {
-      if (!GetElement(cx, source, source, i, &v)) {
+      if constexpr (sizeof(i) == sizeof(uint32_t)) {
-        return false;
+        if (!GetElement(cx, source, source, uint32_t(i), &v)) {
+          return false;
+        }
+      } else {
+        if (!GetElementLargeIndex(cx, source, source, i, &v)) {
+          return false;
+        }
       }
 
       T n;

js/src/vm/TypedArrayObject.cpp

@@ -1370,7 +1370,7 @@ template <typename T>
   }
 
   // Step 9.
-  uint32_t len;
+  uint64_t len;
   if (!GetLengthProperty(cx, arrayLike, &len)) {
     return nullptr;
   }
@@ -1381,6 +1381,8 @@ template <typename T>
     return nullptr;
   }
 
+  MOZ_ASSERT(len <= maxByteLength() / BYTES_PER_ELEMENT);
+
   Rooted<TypedArrayObject*> obj(
       cx, makeInstance(cx, buffer, BufferSize(0), BufferSize(len), proto));
   if (!obj) {