From: basavaraj-sm05 <basavaraj@digiscrypt.com>
Date: Wed, 9 Sep 2026 06:56:41 +0000 (+0530)
Subject: TypedArray: coerce length argument once on buffer construction
X-Git-Tag: 1.0.2~45
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=fd8441bc71c566616176ace18caed62b8ac65cfa;p=njs.git

TypedArray: coerce length argument once on buffer construction

Previously, njs_typed_array_alloc() passed the length argument through
njs_value_to_index() twice, before and after the detached-buffer check,
and kept only the second result.  The argument's valueOf() was invoked
twice, which is observable.

The fix is to remove the second conversion.
---

diff --git a/src/njs_typed_array.c b/src/njs_typed_array.c
index ce320a39..d0b86d72 100644
--- a/src/njs_typed_array.c
+++ b/src/njs_typed_array.c
@@ -75,11 +75,6 @@ njs_typed_array_alloc(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
         }
 
         if (njs_is_defined(njs_arg(args, nargs, 2))) {
-            ret = njs_value_to_index(vm, njs_argument(args, 2), &size);
-            if (njs_slow_path(ret != NJS_OK)) {
-                return NULL;
-            }
-
             size *= element_size;
 
             if (njs_slow_path((offset + size) > buffer->size)) {
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 3528be7d..70c3af7b 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -6717,6 +6717,16 @@ static njs_unit_test_t  njs_test[] =
               ".map(v=>{var a = new ArrayBuffer(8); return (new v(a).length)})"),
       njs_str("8,8,8,4,4,2,2,2,1") },
 
+    { njs_str("var b = new ArrayBuffer(64); var n = 0;"
+              "var a = new Int8Array(b, 0, {valueOf() { return ++n == 1"
+              " ? 8 : 16 }}); [a.length, n]"),
+      njs_str("8,1") },
+
+    { njs_str("var b = new ArrayBuffer(64);"
+              "new Int8Array(b, 0, {valueOf() { $262.detachArrayBuffer(b);"
+              " return 8 }})"),
+      njs_str("TypeError: detached buffer") },
+
     { njs_str(NJS_TYPED_ARRAY_LIST
               ".map(v=>{var a = new v(1); a[0]--; return a[0]})"),
       njs_str("255,0,-1,65535,-1,4294967295,-1,-1,-1") },