From 2e9f665bda041ad2e9ee70ecabbaf96a18a7a2ec Mon Sep 17 00:00:00 2001 From: Idan Horowitz Date: Thu, 17 Jun 2021 18:27:48 +0300 Subject: [PATCH] LibJS: Throw on detached viewed ArrayBuffer when validating TypedArrays --- Userland/Libraries/LibJS/Runtime/TypedArrayPrototype.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Userland/Libraries/LibJS/Runtime/TypedArrayPrototype.cpp b/Userland/Libraries/LibJS/Runtime/TypedArrayPrototype.cpp index f5e559697a..e438a069db 100644 --- a/Userland/Libraries/LibJS/Runtime/TypedArrayPrototype.cpp +++ b/Userland/Libraries/LibJS/Runtime/TypedArrayPrototype.cpp @@ -53,7 +53,12 @@ static TypedArrayBase* typed_array_from(VM& vm, GlobalObject& global_object) vm.throw_exception(global_object, ErrorType::NotA, "TypedArray"); return nullptr; } - return static_cast(this_object); + auto* typed_array = static_cast(this_object); + if (typed_array->viewed_array_buffer()->is_detached()) { + vm.throw_exception(global_object, ErrorType::DetachedArrayBuffer); + return nullptr; + } + return typed_array; } static Function* callback_from_args(GlobalObject& global_object, const String& name)