Upload Kmake

deps/v8/test/mjsunit/regress/regress-crbug-1399799.js

@@ -0,0 +1,45 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const ab = new ArrayBuffer(3000);
+const ta = new Uint16Array(ab);
+
+function createOOBTA() {
+    const rab = new ArrayBuffer(3000, {"maxByteLength": 4000});
+    const ta = new Uint8Array(rab, 0, 3000);
+    rab.resize(0);
+    return ta;
+}
+
+Object.defineProperty(Uint16Array, Symbol.species,
+                      { configurable: true, enumerable: true,
+                        get: () => { return createOOBTA; }});
+assertThrows(() => { ta.slice(); }, TypeError);
+
+function createDetachedTA() {
+    const rab = new ArrayBuffer(3000, {"maxByteLength": 4000});
+    const ta = new Uint8Array(rab, 0, 3000);
+    %ArrayBufferDetach(rab);
+    return ta;
+}
+
+Object.defineProperty(Uint16Array, Symbol.species,
+                      { configurable: true, enumerable: true,
+                        get: () => { return createDetachedTA; }});
+assertThrows(() => { ta.slice(); }, TypeError);
+
+// But this works:
+function createLengthTrackingTA() {
+    const rab = new ArrayBuffer(3000, {"maxByteLength": 4000});
+    const ta = new Uint16Array(rab, 0);
+    return ta;
+}
+
+Object.defineProperty(Uint16Array, Symbol.species,
+    { configurable: true, enumerable: true,
+      get: () => { return createLengthTrackingTA; }});
+
+ta.slice();