-
kbr@google.com authored
[V8] ArrayBuffer code should not pass a negative length to SetIndexedPropertiesToExternalArrayData() https://bugs.webkit.org/show_bug.cgi?id=96703 Reviewed by Adam Barth. Check length arguments that may be passed to SetIndexedPropertiesToExternalArrayData. No tests because it is not guaranteed that buffers this large can actually be allocated. * bindings/v8/custom/V8ArrayBufferViewCustom.h: (WebCore::wrapArrayBufferView): (WebCore::constructWebGLArrayWithArrayBufferArgument): (WebCore::constructWebGLArray): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129424 268f45cc-cd09-0410-ab3c-d52691b4dbfc
a188079a