v8/test/mjsunit/regress/regress-707410.js

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

var a = new Uint8Array(1024*1024);
%ArrayBufferNeuter(a.buffer);
assertThrows(() => new Uint8Array(a));
[builtins] Use length field in TypedArrayConstructByArrayLike. The byte_length field of the TypedArray is not set to 0 on neutering, but JSArrayBufferView::byte_length() returns 0 if WasNeutered() is true. We should use the length property here instead. We can just short-circuit if the length is 0. Added checks to the memcpy path that assert length and neutered status are sane. Bug:chromium:707472,chromium:707595,chromium:707364,chromium:707410 Change-Id: Ia1dec53f175357673012cbbc5e2fc40207e03623 Reviewed-on: https://chromium-review.googlesource.com/465987 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#44336} 2017-04-03 12:20:01 +00:00			`// Copyright 2017 the V8 project authors. All rights reserved.`
			`// Use of this source code is governed by a BSD-style license that can be`
			`// found in the LICENSE file.`

			`// Flags: --allow-natives-syntax`

			`var a = new Uint8Array(1024*1024);`
			`%ArrayBufferNeuter(a.buffer);`
[typedarrays] Throw on construction of a detached typed array. Bug: chromium:840106 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I0090cdecaf9194f3ed2d716c6f5f698e33cbdf0d Reviewed-on: https://chromium-review.googlesource.com/1046827 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#53029} 2018-05-07 14:25:34 +00:00			`assertThrows(() => new Uint8Array(a));`