tor-browser

commit 75ef3f79aae344c1d0398787cab666a6a73176c7
parent 5f2a12ba4044416246ea822621aa3605c28d448c
Author: Yury Delendik <ydelendik@mozilla.com>
Date:   Wed, 15 Oct 2025 20:02:23 +0000

Bug 1992130 - Fix arguments types for std::copy. r=rhunt

Differential Revision: https://phabricator.services.mozilla.com/D267284

Diffstat:
M
js/src/wasm/WasmGcObject.h
 | 
12
+++++++++---

1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/js/src/wasm/WasmGcObject.h b/js/src/wasm/WasmGcObject.h
@@ -160,6 +160,13 @@ class WasmArrayObject : public WasmGcObject,
     return offsetToPointer<uint8_t>(offsetOfInlineStorage());
   }
 
+  // Actual array data that follows DataHeader. The array data is a part of the
+  // `inlineStorage`.
+  template <typename T>
+  T* inlineArrayElements() {
+    return offsetToPointer<T>(offsetOfInlineArrayData());
+  }
+
   // AllocKind for object creation
   static inline gc::AllocKind allocKindForOOL();
   static inline gc::AllocKind allocKindForIL(uint32_t storageBytes);
@@ -507,9 +514,8 @@ class MOZ_RAII StableWasmArrayObjectElements {
         // elements.
         MOZ_CRASH();
       }
-      std::copy(array->inlineStorage(),
-                array->inlineStorage() + array->numElements_ * sizeof(T),
-                ownElements_->begin());
+      const T* src = array->inlineArrayElements<T>();
+      std::copy(src, src + array->numElements_, ownElements_->begin());
       elements_ = ownElements_->begin();
     } else {
       elements_ = reinterpret_cast<T*>(array->data_);