TypedArray: coerce length argument once on buffer construction

Previously, njs_typed_array_alloc() passed the length argument through
njs_value_to_index() twice, before and after the detached-buffer check,
and kept only the second result.  The argument's valueOf() was invoked
twice, which is observable.

The fix is to remove the second conversion.

diff --git a/src/njs_typed_array.c b/src/njs_typed_array.c
index ce320a39d5dce6da6b5692767e6a32a4930dcd34..d0b86d722140fe7a7daf7131eb06a338bbc3f046 100644 (file)
--- a/src/njs_typed_array.c
+++ b/src/njs_typed_array.c
@@ -75,11 +75,6 @@ njs_typed_array_alloc(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
         }
 
         if (njs_is_defined(njs_arg(args, nargs, 2))) {
-            ret = njs_value_to_index(vm, njs_argument(args, 2), &size);
-            if (njs_slow_path(ret != NJS_OK)) {
-                return NULL;
-            }
-
             size *= element_size;
 
             if (njs_slow_path((offset + size) > buffer->size)) {

diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 3528be7dfab83cb0207eea0d2737dbbb40596b69..70c3af7b7f2f8031fc2689c65270cee1e4de43f8 100644 (file)
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -6717,6 +6717,16 @@ static njs_unit_test_t  njs_test[] =
               ".map(v=>{var a = new ArrayBuffer(8); return (new v(a).length)})"),
       njs_str("8,8,8,4,4,2,2,2,1") },
 
+    { njs_str("var b = new ArrayBuffer(64); var n = 0;"
+              "var a = new Int8Array(b, 0, {valueOf() { return ++n == 1"
+              " ? 8 : 16 }}); [a.length, n]"),
+      njs_str("8,1") },
+
+    { njs_str("var b = new ArrayBuffer(64);"
+              "new Int8Array(b, 0, {valueOf() { $262.detachArrayBuffer(b);"
+              " return 8 }})"),
+      njs_str("TypeError: detached buffer") },
+
     { njs_str(NJS_TYPED_ARRAY_LIST
               ".map(v=>{var a = new v(1); a[0]--; return a[0]})"),
       njs_str("255,0,-1,65535,-1,4294967295,-1,-1,-1") },