Skip to content

Prevent Object.preventExtensions when a TypedArray has a resizable ArrayBuffer #1695

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bnoordhuis merged 2 commits into from
Sep 13, 2026
Merged

Prevent Object.preventExtensions when a TypedArray has a resizable ArrayBuffer #1695

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
23aecdf
Disallow Object.preventExtensions for arrays with resizable ArrayBuffer
sr5434 Aug 25, 2026
03597ba
Update tests/bug1691.js
bnoordhuis Sep 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion quickjs.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9858,6 +9858,15 @@ int JS_PreventExtensions(JSContext *ctx, JSValueConst obj)
p = JS_VALUE_GET_OBJ(obj);
if (unlikely(p->class_id == JS_CLASS_PROXY))
return js_proxy_preventExtensions(ctx, obj);
if (is_typed_array(p->class_id)) {
JSTypedArray *ta = p->u.typed_array;
JSArrayBuffer *abuf = ta->buffer->u.array_buffer;
if (ta->track_rab ||
(array_buffer_is_resizable(abuf) && !abuf->shared))
Comment on lines +9864 to +9865

@bnoordhuis bnoordhuis Sep 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the spec say anything about the appropriate course of action when the arraybuffer is detached (abuf->detached)?

@sr5434 sr5434 Sep 13, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to this website, methods are supposed to throw a typed error when the buffer is detached. When I test the following snippet:

const ab = new ArrayBuffer(16, { maxByteLength: 16 });
const ta = new Int8Array(ab);
const newBuff = ab.transfer();
Object.preventExtensions(ta);

both Node.JS and QuickJS agree that the error is "TypeError: Cannot prevent extensions", so it seems that this works for the detached case as well.

{
return false;
}
}
p->extensible = false;
return true;
}
Expand Down Expand Up @@ -41752,7 +41761,7 @@ static JSValue js_object_preventExtensions(JSContext *ctx, JSValueConst this_val
return js_bool(ret);
} else {
if (!ret)
return JS_ThrowTypeError(ctx, "proxy preventExtensions handler returned false");
return JS_ThrowTypeError(ctx, "Cannot prevent extensions");
return js_dup(obj);
}
}
Expand Down
5 changes: 5 additions & 0 deletions tests/bug1691.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
import { assertThrows } from "./assert.js";

const ab = new ArrayBuffer(16, { maxByteLength: 16 });
const ta = new Int8Array(ab);
assertThrows(TypeError, function() { Object.preventExtensions(ta) });
Loading