You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This also applies to things like SpeciesCreate resizing the buffer (in TypedArray.prototype functions which use it), or the "array-like" getter resizing the buffer in SetTypedArrayFromArrayLike.
In most TypedArray.prototype funcs, it's possible that the underlying ArrayBuffer gets resized when we're converting the parameters.
E.g., for TypedArray.prototype.fill:
Further, some TypedArray.prototype funcs take a callback as a parameter and that callback might resize the AB.
v8 has tests for these cases here:
https://source.chromium.org/chromium/chromium/src/ /main:v8/test/mjsunit/typedarray-resizablearraybuffer.js;l=1?ss=chromium
(Search for "ParameterConversionResizes" and "GrowMidIteration" / "ShrinkMidIteration".)
Getting this right is security critical, so would be great to have test262 tests.
cc @jugglinmike
The text was updated successfully, but these errors were encountered: