Skip to content

Commit e3a8e8b

Browse files
brycebarilrvagg
authored andcommitted
buffer: Prevent Buffer constructor deopt
The Buffer constructor will generally get inlined, but any call to the Buffer constructor for a string without encoding will cause an eager deoptimization of any function that inlined the Buffer constructor. This is due to a an out-of-bounds read on `arguments[1]`. This change prevents that deopt. PR-URL: #4158 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Trevor Norris <[email protected]> Reviewed-By: Minwoo Jung <[email protected]>
1 parent 9e9346f commit e3a8e8b

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

lib/buffer.js

+2-2
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ function alignPool() {
4040
}
4141

4242

43-
function Buffer(arg) {
43+
function Buffer(arg, encoding) {
4444
// Common case.
4545
if (typeof arg === 'number') {
4646
// If less than zero, or NaN.
@@ -51,7 +51,7 @@ function Buffer(arg) {
5151

5252
// Slightly less common case.
5353
if (typeof arg === 'string') {
54-
return fromString(arg, arguments[1]);
54+
return fromString(arg, encoding);
5555
}
5656

5757
// Unusual.

0 commit comments

Comments
 (0)