Fix TypedArray initialization with another TypedArray

Fixes #3836

JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]

Author: szilagyiadam

jerry-core/ecma/operations/ecma-arraybuffer-object.c

@@ -15,6 +15,7 @@
 
 #include "ecma-arraybuffer-object.h"
 #include "ecma-try-catch-macro.h"
+#include "ecma-typedarray-object.h"
 #include "ecma-objects.h"
 #include "ecma-builtins.h"
 #include "ecma-exceptions.h"
@@ -173,8 +174,6 @@ ecma_is_arraybuffer (ecma_value_t target) /**< the target value */
 ecma_length_t JERRY_ATTR_PURE
 ecma_arraybuffer_get_length (ecma_object_t *object_p) /**< pointer to the ArrayBuffer object */
 {
-  JERRY_ASSERT (ecma_object_class_is (object_p, LIT_MAGIC_STRING_ARRAY_BUFFER_UL));
-
   ecma_extended_object_t *ext_object_p = (ecma_extended_object_t *) object_p;
   return ext_object_p->u.class_prop.u.length;
 } /* ecma_arraybuffer_get_length */
@@ -187,8 +186,6 @@ ecma_arraybuffer_get_length (ecma_object_t *object_p) /**< pointer to the ArrayB
 inline lit_utf8_byte_t * JERRY_ATTR_PURE JERRY_ATTR_ALWAYS_INLINE
 ecma_arraybuffer_get_buffer (ecma_object_t *object_p) /**< pointer to the ArrayBuffer object */
 {
-  JERRY_ASSERT (ecma_object_class_is (object_p, LIT_MAGIC_STRING_ARRAY_BUFFER_UL));
-
   ecma_extended_object_t *ext_object_p = (ecma_extended_object_t *) object_p;
 
   if (ECMA_ARRAYBUFFER_HAS_EXTERNAL_MEMORY (ext_object_p))

jerry-core/ecma/operations/ecma-typedarray-object.c

@@ -534,15 +534,21 @@ ecma_typedarray_create_object_with_length (ecma_length_t array_length, /**< leng
 
     ecma_object_t *ctor_proto_p = ecma_get_object_from_value (ctor_proto);
 
-    ecma_value_t byte_length_val = ecma_make_uint32_value (byte_length);
-    ecma_value_t new_arraybuffer = ecma_op_function_construct (ctor_proto_p,
-                                                               ctor_proto_p,
-                                                               &byte_length_val,
-                                                               1);
+    ecma_object_t *data_p = ecma_op_get_prototype_from_constructor (ctor_proto_p,
+                                                                    ECMA_BUILTIN_ID_ARRAYBUFFER_PROTOTYPE);
+
     ecma_deref_object (ctor_proto_p);
-    ecma_free_value (byte_length_val);
 
-    new_arraybuffer_p = ecma_get_object_from_value (new_arraybuffer);
+    if (JERRY_UNLIKELY (data_p == NULL))
+    {
+      return ECMA_VALUE_ERROR;
+    }
+
+    new_arraybuffer_p = ecma_arraybuffer_new_object (byte_length);
+
+    ECMA_SET_NON_NULL_POINTER (new_arraybuffer_p->u2.prototype_cp, data_p);
+
+    ecma_deref_object (data_p);
   }
 
   ecma_object_t *object_p = ecma_create_object (proto_p,

tests/jerry/es2015/regression-test-issue-3836.js

@@ -0,0 +1,41 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+function validate_typedarray (typedarray, result) {
+  assert(typedarray.length === result.length);
+  for (var i=0;i<typedarray.length;i++) {
+    assert(typedarray[i] === result[i]);
+  }
+}
+
+var v1 = new Float64Array(6);
+v1.buffer.constructor = Uint8Array;
+var v2 = new Float64Array(v1);
+
+assert(v2.buffer.constructor === Uint8Array);
+validate_typedarray(v2, [0,0,0,0,0,0]);
+
+var v3 = new Uint32Array(6);
+v3.buffer.constructor = Float64Array;
+var v4 = new Uint8Array(v3);
+
+assert(v4.buffer.constructor === Float64Array);
+validate_typedarray(v4, [0,0,0,0,0,0]);
+
+var v5 = new Uint32Array(6);
+v5.buffer.constructor = Set;
+var v6 = new Uint8Array(v5);
+
+assert(v6.buffer.constructor === Set);
+validate_typedarray(v6, [0,0,0,0,0,0]);