From: Dmitry Volyntsev <xeioex@nginx.com>
Date: Thu, 3 Sep 2020 13:30:16 +0000 (+0000)
Subject: Fixed TypedArraySpeciesCreate().
X-Git-Tag: 0.4.4~15
X-Git-Url: http://www.kaiwu.me/postgresql/commit/?a=commitdiff_plain;h=92d52ad84b73b011147f1e9de48b84a98f807db4;p=njs.git

Fixed TypedArraySpeciesCreate().

According to the spec, it is expected to verify that created
typed-array instance has appropriate length.
---

diff --git a/src/njs_typed_array.c b/src/njs_typed_array.c
index 0cd5f11b..73b79be5 100644
--- a/src/njs_typed_array.c
+++ b/src/njs_typed_array.c
@@ -801,12 +801,21 @@ njs_typed_array_species_create(njs_vm_t *vm, njs_value_t *exemplar,
         return NJS_ERROR;
     }
 
-    if (!njs_is_typed_array(retval)) {
+    if (njs_slow_path(!njs_is_typed_array(retval))) {
         njs_type_error(vm, "Derived TypedArray constructor "
                        "returned not a typed array");
         return NJS_ERROR;
     }
 
+    if (njs_slow_path(nargs == 1 && njs_is_number(&args[0])
+                      && njs_typed_array_length(njs_typed_array(retval))
+                         < njs_number(&args[0])))
+    {
+        njs_type_error(vm, "Derived TypedArray constructor "
+                       "returned too short array");
+        return NJS_ERROR;
+    }
+
     return NJS_OK;
 }
 
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index a03a16ab..3d5fd1de 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -5820,6 +5820,13 @@ static njs_unit_test_t  njs_test[] =
               "           try {a.slice(0)} catch(e) {return e.name == 'TypeError'}})"),
       njs_str("true") },
 
+    { njs_str(NJS_TYPED_ARRAY_LIST
+              ".every(v=>{var a = new v(2); "
+              "           a.constructor = {}; "
+              "           a.constructor[Symbol.species] = function() { return new v()};"
+              "           try {a.filter(v=>true)} catch(e) {return e.name == 'TypeError'}})"),
+      njs_str("true") },
+
     { njs_str(NJS_TYPED_ARRAY_LIST
               ".every(v=>{var a = new v([1,2,3]); "
               "           var r = a.slice(1,3);"
@@ -5858,6 +5865,11 @@ static njs_unit_test_t  njs_test[] =
               "           return  a.buffer === r.buffer;})"),
       njs_str("true") },
 
+    { njs_str(NJS_TYPED_ARRAY_LIST
+              ".every(v=>{var a = new v([1,2,3]); "
+              "           return  a.subarray(3).length === 0;})"),
+      njs_str("true") },
+
     { njs_str(NJS_TYPED_ARRAY_LIST
               ".every(v=>{var a = new v([1,2,3,4]); a.copyWithin(2); "
               "           return a.toString() === '1,2,1,2'})"),