859332bf76
Original commit message:
[builtins] disallow ArrayBuffer transfer with a detach key
This allows embedder to disallow `ArrayBuffer.prototype.transfer()` on
an arraybuffer that is not detachable. This also fix the check on
`ArrayBufferCopyAndDetach` step 8 of `ArrayBuffer.prototype.transfer`.
Refs: https://github.com/nodejs/node/issues/61362
Refs: https://tc39.es/ecma262/#sec-arraybuffercopyanddetach
Change-Id: I3c6e156a8fad007fd100218d8b16aed5c4e1db68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7454288
Commit-Queue: Chengzhong Wu <cwu631@bloomberg.net>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#104697}
Refs: c5ff7c4d6c
PR-URL: https://github.com/nodejs/node/pull/61372
Fixes: https://github.com/nodejs/node/issues/61362
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
22 lines
647 B
JavaScript
22 lines
647 B
JavaScript
// Copyright 2026 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
//
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function TestTransferSucceeds() {
|
|
const ab = new ArrayBuffer(100);
|
|
%ArrayBufferSetDetachKey(ab, undefined);
|
|
ab.transfer();
|
|
assertEquals(0, ab.byteLength); // Detached.
|
|
}
|
|
|
|
function TestTransferFails() {
|
|
const ab = new ArrayBuffer(100);
|
|
%ArrayBufferSetDetachKey(ab, Symbol());
|
|
assertThrows(() => { ab.transfer(); }, TypeError);
|
|
assertEquals(100, ab.byteLength); // Not detached.
|
|
}
|
|
|
|
TestTransferSucceeds();
|
|
TestTransferFails();
|