From 0157b3ffacb67cbedad73e5c712bedcd9860ef4d Mon Sep 17 00:00:00 2001
From: Leonardo Balter <leonardo.balter@gmail.com>
Date: Fri, 11 Mar 2016 11:27:39 -0500
Subject: [PATCH] Throw RangeError on negative length values

WRT TypedArrays, ArrayBuffer, and DataView constructors
---
 spec.html | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/spec.html b/spec.html
index f2109628d4a..50b0309c5d9 100644
--- a/spec.html
+++ b/spec.html
@@ -31587,7 +31587,9 @@ <h1>_TypedArray_ ( _length_ )</h1>
           1. Assert: Type(_length_) is not Object.
           1. If NewTarget is *undefined*, throw a *TypeError* exception.
           1. If _length_ is *undefined*, throw a *TypeError* exception.
-          1. Let _elementLength_ be ? ToLength(_length_).
+          1. Let _integerLength_ be ToInteger(_length_).
+          1. If _integerLength_ &lt; 0, throw a *RangeError* exception.
+          1. Let _elementLength_ be ? ToLength(_integerLength_).
           1. Let _constructorName_ be the String value of the Constructor Name value specified in <emu-xref href="#table-49"></emu-xref> for this <var>TypedArray</var> constructor.
           1. Return ? AllocateTypedArray(_constructorName_, NewTarget, <code>"%<var>TypedArray</var>Prototype%"</code>, _elementLength_).
         </emu-alg>
@@ -31722,7 +31724,9 @@ <h1>_TypedArray_ ( _buffer_ [ , _byteOffset_ [ , _length_ ] ] )</h1>
             1. Let _newByteLength_ be _bufferByteLength_ - _offset_.
             1. If _newByteLength_ &lt; 0, throw a *RangeError* exception.
           1. Else,
-            1. Let _newLength_ be ? ToLength(_length_).
+            1. Let _integerLength_ be ToInteger(_length_).
+            1. If _integerLength_ &lt; 0, throw a *RangeError* exception.
+            1. Let _newLength_ be ? ToLength(_integerLength_).
             1. Let _newByteLength_ be _newLength_ &times; _elementSize_.
             1. If _offset_+_newByteLength_ &gt; _bufferByteLength_, throw a *RangeError* exception.
           1. Set _O_'s [[ViewedArrayBuffer]] internal slot to _buffer_.
@@ -32977,7 +32981,9 @@ <h1>ArrayBuffer ( [ _length_ ] )</h1>
         <p>When the `ArrayBuffer` function is called with optional argument _length_, the following steps are taken:</p>
         <emu-alg>
           1. If NewTarget is *undefined*, throw a *TypeError* exception.
-          1. Let _byteLength_ be ? ToLength(_length_).
+          1. Let _integerLength_ be ToInteger(_length_).
+          1. If _integerLength_ &lt; 0, throw a *RangeError* exception.
+          1. Let _byteLength_ be ? ToLength(_integerLength_).
           1. Return ? AllocateArrayBuffer(NewTarget, _byteLength_).
         </emu-alg>
       </emu-clause>
@@ -33167,7 +33173,9 @@ <h1>DataView (_buffer_ [ , _byteOffset_, _byteLength_ ] )</h1>
           1. If _byteLength_ is either not present or *undefined*, then
             1. Let _viewByteLength_ be _bufferByteLength_ - _offset_.
           1. Else,
-            1. Let _viewByteLength_ be ? ToLength(_byteLength_).
+            1. Let _integerLength_ be ToInteger(_byteLength_).
+            1. If _integerLength_ &lt; 0, throw a *RangeError* exception.
+            1. Let _viewByteLength_ be ? ToLength(_integerLength_).
             1. If _offset_+_viewByteLength_ &gt; _bufferByteLength_, throw a *RangeError* exception.
           1. Let _O_ be ? OrdinaryCreateFromConstructor(NewTarget, `"%DataViewPrototype%"`, &laquo; [[DataView]], [[ViewedArrayBuffer]], [[ByteLength]], [[ByteOffset]] &raquo;).
           1. Set _O_'s [[DataView]] internal slot to *true*.