archives

« Bugzilla Issues Index

#2415 — 24.1.2.1 ArrayBuffer(...): Missing constructor reentrancy checks


24.1.2.1 ArrayBuffer(length), step 3 is not side-effect free, so an additional check is needed to ensure the ArrayBuffer object is still uninitialised when SetArrayBufferData() is called.

Test case:
---
let buf = ArrayBuffer[Symbol.create]();
ArrayBuffer.call(buf, {valueOf(){ ArrayBuffer.call(buf, 0); return 1 }})
---


fixed in rev23 editor's draft


fixed in rev23 draft