Repository navigation
runtime: typed-array view constructor new TA(buffer, byteOffset, length) doesn't validate offset/length (#3662 / #4093 follow-up) #4103
Description
Follow-up to PR #4093 (typed-array constructor length validation).
The 3-argument typed-array view constructor new TA(buffer, byteOffset, length)
does not validate byteOffset / length against the backing ArrayBuffer, so
out-of-range / misaligned views silently succeed instead of throwing the spec
RangeError.
Repro
new Uint8Array(new ArrayBuffer(8), 7, 4); // Perry: no throw Node: RangeError (offset+len > buffer)
new Uint32Array(new ArrayBuffer(8), 3); // Perry: no throw Node: RangeError (offset % 4 != 0)
new Uint8Array(new ArrayBuffer(8), 16); // Perry: no throw Node: RangeError (offset > byteLength)(new TA(length) negative/out-of-range validation already works — PR #4093.
DataView(buffer, offset) already validates.)
Why it's deferred
Perry does not yet model real typed-array views — the byteOffset getter is
hardcoded to 0 and the multi-arg form lowers to Expr::New { class_name }
which drops the offset/length args at HIR. Proper validation needs the view to
actually honor byteOffset/length (the underlying feature), at which point the
bounds checks (offset % BYTES_PER_ELEMENT, offset + length*BPE <= byteLength)
fall out naturally.
Part of the #3662 cluster.
Activity
fix(runtime): dynamic instanceof Array/Object/Date + typed-array view…
proggeramlug commentedon Jun 2, 2026
Verified fixed on
main(d990b021e) by #4107 (which added thetypedarray_viewmodule + the codegen view-constructor arm). Byte-identical tonode --experimental-strip-types:#4107 referenced but didn't auto-close this. Closing as completed.
fix(typedarray): honor byteOffset/byteLength/buffer on ArrayBuffer vi…
fix(typedarray): honor byteOffset/byteLength/buffer on ArrayBuffer vi…
fix(typedarray): honor byteOffset/byteLength/buffer on ArrayBuffer vi…