Fixed TypedArraySpeciesCreate().

According to the spec, it is expected to verify that created
typed-array instance has appropriate length.

diff --git a/src/njs_typed_array.c b/src/njs_typed_array.c
index 0cd5f11b62abba34660acc02674416608e8420c4..73b79be58c38e9cf118a1911e612d2a788c7a15c 100644 (file)
--- a/src/njs_typed_array.c
+++ b/src/njs_typed_array.c
@@ -801,12 +801,21 @@ njs_typed_array_species_create(njs_vm_t *vm, njs_value_t *exemplar,
         return NJS_ERROR;
     }
 
-    if (!njs_is_typed_array(retval)) {
+    if (njs_slow_path(!njs_is_typed_array(retval))) {
         njs_type_error(vm, "Derived TypedArray constructor "
                        "returned not a typed array");
         return NJS_ERROR;
     }
 
+    if (njs_slow_path(nargs == 1 && njs_is_number(&args[0])
+                      && njs_typed_array_length(njs_typed_array(retval))
+                         < njs_number(&args[0])))
+    {
+        njs_type_error(vm, "Derived TypedArray constructor "
+                       "returned too short array");
+        return NJS_ERROR;
+    }
+
     return NJS_OK;
 }
 

diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index a03a16abcbba5f7352c169f8b05b178fa716192f..3d5fd1dee2805a2c5f82a0eaf41cfa067a588fec 100644 (file)
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -5820,6 +5820,13 @@ static njs_unit_test_t  njs_test[] =
               "           try {a.slice(0)} catch(e) {return e.name == 'TypeError'}})"),
       njs_str("true") },
 
+    { njs_str(NJS_TYPED_ARRAY_LIST
+              ".every(v=>{var a = new v(2); "
+              "           a.constructor = {}; "
+              "           a.constructor[Symbol.species] = function() { return new v()};"
+              "           try {a.filter(v=>true)} catch(e) {return e.name == 'TypeError'}})"),
+      njs_str("true") },
+
     { njs_str(NJS_TYPED_ARRAY_LIST
               ".every(v=>{var a = new v([1,2,3]); "
               "           var r = a.slice(1,3);"
@@ -5858,6 +5865,11 @@ static njs_unit_test_t  njs_test[] =
               "           return  a.buffer === r.buffer;})"),
       njs_str("true") },
 
+    { njs_str(NJS_TYPED_ARRAY_LIST
+              ".every(v=>{var a = new v([1,2,3]); "
+              "           return  a.subarray(3).length === 0;})"),
+      njs_str("true") },
+
     { njs_str(NJS_TYPED_ARRAY_LIST
               ".every(v=>{var a = new v([1,2,3,4]); a.copyWithin(2); "
               "           return a.toString() === '1,2,1,2'})"),