Skip to content

Commit 19bb19d

Browse files
committed
Fix bug in Dart_GetTypeOfExternalTypedData.
This API function would return true for typed data view objects, even if the view has a non-external data object underneath. It is used e.g. by Builtin_LoadSource. This function copies the data object for internal typed-data objects. When it wrongly be identifies a view as external, it consequently results in crash/undefined behavior because GC may interfere with this internal data pointer. BUG= [email protected], [email protected] Review URL: https://codereview.chromium.org//1182123002.
1 parent 35e0da2 commit 19bb19d

File tree

1 file changed

+12
-2
lines changed

1 file changed

+12
-2
lines changed

runtime/vm/dart_api_impl.cc

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3241,10 +3241,20 @@ DART_EXPORT Dart_TypedData_Type Dart_GetTypeOfExternalTypedData(
32413241
Dart_Handle object) {
32423242
TRACE_API_CALL(CURRENT_FUNC);
32433243
intptr_t class_id = Api::ClassId(object);
3244-
if (RawObject::IsExternalTypedDataClassId(class_id) ||
3245-
RawObject::IsTypedDataViewClassId(class_id)) {
3244+
if (RawObject::IsExternalTypedDataClassId(class_id)) {
32463245
return GetType(class_id);
32473246
}
3247+
if (RawObject::IsTypedDataViewClassId(class_id)) {
3248+
// Check if data object of the view is external.
3249+
Isolate* isolate = Isolate::Current();
3250+
const Instance& view_obj = Api::UnwrapInstanceHandle(isolate, object);
3251+
ASSERT(!view_obj.IsNull());
3252+
const Instance& data_obj =
3253+
Instance::Handle(isolate, TypedDataView::Data(view_obj));
3254+
if (ExternalTypedData::IsExternalTypedData(data_obj)) {
3255+
return GetType(class_id);
3256+
}
3257+
}
32483258
return Dart_TypedData_kInvalid;
32493259
}
32503260

0 commit comments

Comments
 (0)