From 4868f0f66cef5ab47d1a50ae8db92b79710aadf6 Mon Sep 17 00:00:00 2001 From: Richard Gibson Date: Mon, 28 Jul 2025 18:46:12 -0400 Subject: [PATCH] [TypedArray.prototype.copyWithin] Cover overlapping source/destination ranges Ref https://github.com/tc39/ecma262/pull/3619 Ref https://github.com/tc39/ecma262/issues/3618 --- .../coerced-target-start-end-shrink.js | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/test/built-ins/TypedArray/prototype/copyWithin/coerced-target-start-end-shrink.js b/test/built-ins/TypedArray/prototype/copyWithin/coerced-target-start-end-shrink.js index c58cd1d353..1b88cc0ecd 100644 --- a/test/built-ins/TypedArray/prototype/copyWithin/coerced-target-start-end-shrink.js +++ b/test/built-ins/TypedArray/prototype/copyWithin/coerced-target-start-end-shrink.js @@ -65,3 +65,33 @@ for (let ctor of ctors) { assert.compareArray(ToNumbers(lengthTracking), [2, 1, 2], ctor.name + " truncated copy backward."); } + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = fillWithIndexes(new ctor(rab), 4); + // [0, 1, 2,] 3] + // <=--> dest + // <=-> src + const evil = () => { + rab.resize(3 * ctor.BYTES_PER_ELEMENT); + return 2; + }; + lengthTracking.copyWithin({ valueOf: evil }, 1); + assert.compareArray(ToNumbers(lengthTracking), [0, 1, 1], + ctor.name + " truncated overlapping copy forward."); +} + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = fillWithIndexes(new ctor(rab), 4); + // [0, 1, 2,] 3] + // <=--> src + // <=-> dest + const evil = () => { + rab.resize(3 * ctor.BYTES_PER_ELEMENT); + return 2; + }; + lengthTracking.copyWithin(1, { valueOf: evil }); + assert.compareArray(ToNumbers(lengthTracking), [0, 2, 2], + ctor.name + " truncated overlapping copy backward."); +}