From 8744a9b02a273c38a8493240c2cdd5c934df197c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Bargull?= <andre.bargull@gmail.com>
Date: Mon, 12 May 2025 15:58:01 +0200
Subject: [PATCH] Add coverage for species constructor returning typed array
 with same backing buffer

JSC doesn't handle this case correctly.
---
 ...ciesctor-return-same-buffer-with-offset.js | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 test/built-ins/TypedArray/prototype/slice/speciesctor-return-same-buffer-with-offset.js

diff --git a/test/built-ins/TypedArray/prototype/slice/speciesctor-return-same-buffer-with-offset.js b/test/built-ins/TypedArray/prototype/slice/speciesctor-return-same-buffer-with-offset.js
new file mode 100644
index 0000000000..6a91d5c4e3
--- /dev/null
+++ b/test/built-ins/TypedArray/prototype/slice/speciesctor-return-same-buffer-with-offset.js
@@ -0,0 +1,45 @@
+// Copyright (C) 2025 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.slice
+description: >
+  When species constructs a typed array using the same buffer but with a
+  different byte offset, slice output reflects element-by-element copying into
+  that buffer.
+info: |
+  %TypedArray%.prototype.slice ( start, end )
+
+  ...
+  14. If countBytes > 0, then
+    g. If srcType is targetType, then
+      ix. Repeat, while targetByteIndex < endByteIndex,
+        1. Let value be GetValueFromBuffer(srcBuffer, srcByteIndex, uint8, true, unordered).
+        2. Perform SetValueInBuffer(targetBuffer, targetByteIndex, uint8, value, true, unordered).
+        ...
+features: [TypedArray]
+includes: [testTypedArray.js, compareArray.js]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var ta = new TA([
+    10,
+    20,
+    30,
+    40,
+    50,
+    60,
+  ]);
+
+  ta.constructor = {
+    [Symbol.species]: function() {
+      return new TA(ta.buffer, 2 * TA.BYTES_PER_ELEMENT);
+    }
+  };
+
+  var result = ta.slice(1, 4);
+
+  assert.compareArray(result, [
+    20, 20, 20, 60,
+  ]);
+});