v8/test/mjsunit/regress-6223.js
Camillo Bruni 186bfbb1b9 [runtime] Fix TypedArray slice when sharing the underlying buffer
According to the spec the copy step is defined iteratively and with
@@species we can create a TypedArray which shares the buffer with the
receiver which in turn prevents us from using memcpy.

Bug: v8:6223

Change-Id: If1bad085ea1d022bf3fb2cffc81645b2f7f56346
Reviewed-on: https://chromium-review.googlesource.com/471409
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44520}
2017-04-10 12:57:21 +00:00

21 lines
622 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var ab = new Int8Array(20).map((v, i) => i).buffer;
var ta = new Int8Array(ab, 0, 10);
var seen_length = -1;
ta.constructor = {
[Symbol.species]: function(len) {
seen_length = len;
return new Int8Array(ab, 1, len);
}
};
assertEquals(-1, seen_length);
assertArrayEquals([0,1,2,3,4,5,6,7,8,9], ta);
var tb = ta.slice();
assertEquals(10, seen_length);
assertArrayEquals([0,0,0,0,0,0,0,0,0,0], ta);
assertArrayEquals([0,0,0,0,0,0,0,0,0,0], tb);