v8/test/mjsunit/regress/regress-707410.js

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

var a = new Uint8Array(1024*1024);
%ArrayBufferDetach(a.buffer);
assertThrows(() => new Uint8Array(a));
[builtins] Use length field in TypedArrayConstructByArrayLike. The byte_length field of the TypedArray is not set to 0 on neutering, but JSArrayBufferView::byte_length() returns 0 if WasNeutered() is true. We should use the length property here instead. We can just short-circuit if the length is 0. Added checks to the memcpy path that assert length and neutered status are sane. Bug:chromium:707472,chromium:707595,chromium:707364,chromium:707410 Change-Id: Ia1dec53f175357673012cbbc5e2fc40207e03623 Reviewed-on: https://chromium-review.googlesource.com/465987 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#44336} 2017-04-03 12:20:01 +00:00			`// Copyright 2017 the V8 project authors. All rights reserved.`
			`// Use of this source code is governed by a BSD-style license that can be`
			`// found in the LICENSE file.`

			`// Flags: --allow-natives-syntax`

			`var a = new Uint8Array(1024*1024);`
[typedarrays] Use Detach instead of Neuter This is purely a renaming change. The ES spec uses the term 'detach' for the process of removing the backing store of a typed array, while V8 uses the historical term 'neuter'. Update our internal implementation, including method names and flag names, to match the spec. Note that some error messages still use the term 'neuter' since error messages are asserted by some embedder tests, like layout tests. R=bmeurer@chromium.org, yangguo@chromium.org, mstarzinger@chromium.org, mlippautz@chromium.org BUG=chromium:913887 Change-Id: I62f1c3ac9ae67ba01d612a5221afa3d92deae272 Reviewed-on: https://chromium-review.googlesource.com/c/1370036 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#58149} 2018-12-11 10:22:02 +00:00			`%ArrayBufferDetach(a.buffer);`
[typedarrays] Throw on construction of a detached typed array. Bug: chromium:840106 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I0090cdecaf9194f3ed2d716c6f5f698e33cbdf0d Reviewed-on: https://chromium-review.googlesource.com/1046827 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#53029} 2018-05-07 14:25:34 +00:00			`assertThrows(() => new Uint8Array(a));`