From cd6430b0cc257df3a30eff071358c82d68d9c3b1 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Andr=C3=A9=20Bargull?= <andre.bargull@gmail.com>
Date: Fri, 26 Jan 2024 08:17:43 +0000
Subject: [PATCH] Bug 1842773 - Part 26: Update ArrayBuffer.prototype.slice for
 resizable buffers. r=sfink

The `ArrayBuffer.prototype.slice` update for resizable array buffers was
still missing.

Differential Revision: https://phabricator.services.mozilla.com/D183343
---
 js/src/builtin/TypedArray.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/js/src/builtin/TypedArray.js b/js/src/builtin/TypedArray.js
index 126cf81e1928..bdbc61a14c20 100644
--- a/js/src/builtin/TypedArray.js
+++ b/js/src/builtin/TypedArray.js
@@ -1885,7 +1885,14 @@ function ArrayBufferSlice(start, end) {
   }
 
   // Steps 20-22.
-  ArrayBufferCopyData(newBuffer, 0, O, first, newLen, isWrapped);
+  //
+  // Reacquire the length in case the buffer has been resized.
+  var currentLen = ArrayBufferByteLength(O);
+
+  if (first < currentLen) {
+    var count = std_Math_min(newLen, currentLen - first);
+    ArrayBufferCopyData(newBuffer, 0, O, first, count, isWrapped);
+  }
 
   // Step 23.
   return newBuffer;
-- 
2.11.4.GIT