Fix Object.freeze on RAB-backed typed arrays (#856)

quickjs-ng · Jan 25, 2025 · f45e4f0 · f45e4f0
1 parent 51284bc
commit f45e4f0
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/quickjs.c b/quickjs.c
@@ -37126,6 +37126,8 @@ static JSValue js_object_seal(JSContext *ctx, JSValue this_val,
 {
     JSValue obj = argv[0];
     JSObject *p;
+    JSTypedArray *ta;
+    JSArrayBuffer *abuf;
     JSPropertyEnum *props;
     uint32_t len, i;
     int flags, desc_flags, res;
@@ -37146,6 +37148,13 @@ static JSValue js_object_seal(JSContext *ctx, JSValue this_val,
         return JS_ThrowTypeError(ctx, "proxy preventExtensions handler returned false");
     }
 
+    if (freeze_flag && is_typed_array(p->class_id)) {
+        ta = p->u.typed_array;
+        abuf = ta->buffer->u.array_buffer;
+        if (array_buffer_is_resizable(abuf) || typed_array_is_oob(p))
+            return JS_ThrowTypeError(ctx, "cannot freeze resizable typed array");
+    }
+
     flags = JS_GPN_STRING_MASK | JS_GPN_SYMBOL_MASK;
     if (JS_GetOwnPropertyNamesInternal(ctx, &props, &len, p, flags))
         return JS_EXCEPTION;

diff --git a/test262_errors.txt b/test262_errors.txt
@@ -30,8 +30,6 @@ test262/test/built-ins/Object/defineProperty/coerced-P-shrink.js:16: Test262Erro
 test262/test/built-ins/Object/defineProperty/coerced-P-shrink.js:16: strict mode: Test262Error: Expected a TypeError to be thrown but no exception was thrown at all
 test262/test/built-ins/Object/defineProperty/typedarray-backed-by-resizable-buffer.js:18: Test262Error: Expected a TypeError to be thrown but no exception was thrown at all
 test262/test/built-ins/Object/defineProperty/typedarray-backed-by-resizable-buffer.js:18: strict mode: Test262Error: Expected a TypeError to be thrown but no exception was thrown at all
-test262/test/built-ins/Object/freeze/typedarray-backed-by-resizable-buffer.js:14: Test262Error: Expected a TypeError to be thrown but no exception was thrown at all
-test262/test/built-ins/Object/freeze/typedarray-backed-by-resizable-buffer.js:14: strict mode: Test262Error: Expected a TypeError to be thrown but no exception was thrown at all
 test262/test/built-ins/RegExp/prototype/exec/regexp-builtin-exec-v-u-flag.js:45: Test262Error: Actual argument shouldn't be nullish. Unicode property escapes with v flag
 test262/test/built-ins/RegExp/prototype/exec/regexp-builtin-exec-v-u-flag.js:45: strict mode: Test262Error: Actual argument shouldn't be nullish. Unicode property escapes with v flag
 test262/test/built-ins/RegExp/unicodeSets/generated/rgi-emoji-16.0.js:16: Test262Error: `\p{RGI_Emoji}` should match 🇨🇶 (U+01F1E8 U+01F1F6)