custom-proto-access-detaches-buffer.js (1204B)
1 // Copyright (C) 2018 Mozilla Corporation. All rights reserved. 2 // This code is governed by the BSD license found in the LICENSE file. 3 4 /*--- 5 author: Jeff Walden <jwalden+code@mit.edu> 6 esid: sec-dataview-buffer-byteoffset-bytelength 7 description: > 8 The `DataView` constructor shouldn't be able to return a `DataView` instance 9 backed by a detached `ArrayBuffer` when `OrdinaryCreateFromConstructor` 10 returns an instance so backed. 11 info: | 12 `OrdinaryCreateFromConstructor` has the potential to invoke user-defined code 13 that may detach the `ArrayBuffer` intended to underlie the fresh instance. 14 Verify that a final is-detached check is performed before the new instance is 15 returned. 16 includes: [detachArrayBuffer.js] 17 features: [Reflect.construct] 18 ---*/ 19 20 var buffer = new ArrayBuffer(8); 21 22 var called = false; 23 var byteOffset = { valueOf() { called = true; return 0; } }; 24 25 var newTarget = function() {}.bind(null); 26 Object.defineProperty(newTarget, "prototype", { 27 get() { 28 $DETACHBUFFER(buffer); 29 return DataView.prototype; 30 } 31 }); 32 33 assert.throws(TypeError, function() { 34 Reflect.construct(DataView, [buffer, byteOffset], newTarget); 35 }); 36 assert.sameValue(called, true); 37 38 reportCompare(0, 0);