24.1.1.5 CloneArrayBuffer( srcBuffer, srcByteOffset )
Steps 5, 8-9 and steps 6-7, 10 should be moved closer together, so it's easier to understand which step needs to be executed first (step 5 needs to appear before step 6 in case step 6 detaches the array buffer, otherwise the assertion in step 8 does not hold; Alternatively step 5 needs to appear after step 6 and step 13).
Suggested reorder:
---
5. Let bufferConstructor be Get(srcBuffer, "constructor").
6. ReturnIfAbrupt(bufferConstructor).
7. If bufferConstructor is undefined, then let bufferConstructor be %ArrayBuffer%.
8. Let targetBuffer be AllocateArrayBuffer(bufferConstructor).
9. NOTE: Side-effects of the above steps may have detached srcBuffer.
10. If IsDetachedBuffer(srcBuffer) is true, then throw a TypeError exception.
11. Let srcBlock be the value of srcBuffer’s [[ArrayBufferData]] internal slot.
12. Let srcLength be the value of srcBuffer’s [[ArrayBufferByteLength]] internal slot.
13. Assert: srcByteOffset ≤ srcLength.
14. Let cloneLength be srcLength – srcByteOffset.
15. Let status be SetArrayBufferData(targetBuffer, cloneLength).
16. ReturnIfAbrupt(status).
---
fixed in rev28 editor's draft
fixed in rev28