[njs] Fixed TypedArraySpeciesCreate().

[Dmitry Volyntsev]

details:   https://hg.nginx.org/njs/rev/95faab343e26
branches:  
changeset: 1516:95faab343e26
user:      Dmitry Volyntsev <xeioex at nginx.com>
date:      Thu Sep 03 13:30:16 2020 +0000
description:
Fixed TypedArraySpeciesCreate().

According to the spec, it is expected to verify that created
typed-array instance has appropriate length.

diffstat:

 src/njs_typed_array.c    |  11 ++++++++++-
 src/test/njs_unit_test.c |  12 ++++++++++++
 2 files changed, 22 insertions(+), 1 deletions(-)

diffs (55 lines):

diff -r 2bae88c33583 -r 95faab343e26 src/njs_typed_array.c
--- a/src/njs_typed_array.c	Thu Sep 03 13:30:15 2020 +0000
+++ b/src/njs_typed_array.c	Thu Sep 03 13:30:16 2020 +0000
@@ -801,12 +801,21 @@ njs_typed_array_species_create(njs_vm_t 
         return NJS_ERROR;
     }
 
-    if (!njs_is_typed_array(retval)) {
+    if (njs_slow_path(!njs_is_typed_array(retval))) {
         njs_type_error(vm, "Derived TypedArray constructor "
                        "returned not a typed array");
         return NJS_ERROR;
     }
 
+    if (njs_slow_path(nargs == 1 && njs_is_number(&args[0])
+                      && njs_typed_array_length(njs_typed_array(retval))
+                         < njs_number(&args[0])))
+    {
+        njs_type_error(vm, "Derived TypedArray constructor "
+                       "returned too short array");
+        return NJS_ERROR;
+    }
+
     return NJS_OK;
 }
 
diff -r 2bae88c33583 -r 95faab343e26 src/test/njs_unit_test.c
--- a/src/test/njs_unit_test.c	Thu Sep 03 13:30:15 2020 +0000
+++ b/src/test/njs_unit_test.c	Thu Sep 03 13:30:16 2020 +0000
@@ -5821,6 +5821,13 @@ static njs_unit_test_t  njs_test[] =
       njs_str("true") },
 
     { njs_str(NJS_TYPED_ARRAY_LIST
+              ".every(v=>{var a = new v(2); "
+              "           a.constructor = {}; "
+              "           a.constructor[Symbol.species] = function() { return new v()};"
+              "           try {a.filter(v=>true)} catch(e) {return e.name == 'TypeError'}})"),
+      njs_str("true") },
+
+    { njs_str(NJS_TYPED_ARRAY_LIST
               ".every(v=>{var a = new v([1,2,3]); "
               "           var r = a.slice(1,3);"
               "           return  a.buffer !== r.buffer;})"),
@@ -5859,6 +5866,11 @@ static njs_unit_test_t  njs_test[] =
       njs_str("true") },
 
     { njs_str(NJS_TYPED_ARRAY_LIST
+              ".every(v=>{var a = new v([1,2,3]); "
+              "           return  a.subarray(3).length === 0;})"),
+      njs_str("true") },
+
+    { njs_str(NJS_TYPED_ARRAY_LIST
               ".every(v=>{var a = new v([1,2,3,4]); a.copyWithin(2); "
               "           return a.toString() === '1,2,1,2'})"),
       njs_str("true") },