Normative: Remove @@species from InitializeTypedArrayFromTypedArray

[syg]

When creating a TypedArray (the target) from another TypedArray (the source) in InitializeTypedArrayFromTypedArray, target gets a newly allocated ArrayBuffer whose prototype is the source's buffer's species constructor's prototype, but that species constructor is never called. Also this only happens if the buffer is not a SharedArrayBuffer.

Pretty funny!

Anyway not sure what purpose it serves to only hook up the species prototype but never call the species constructor. AFAICT, in all other uses of SpeciesConstructor, we call Construct on it.

Alas, major engines agree on this comedy:

let construction_count = 0;

class GrossBuffer extends ArrayBuffer {
  constructor() {
    super(...arguments);
    if (construction_count++ == 1) throw "bad";
  }
  get isGross() { return true; };
  static get [Symbol.species]() { print("barf"); return GrossBuffer; }
}

let gross_buf = new GrossBuffer(1024);
let gross_ta = new Uint8Array(gross_buf);
let mystery_ta = new Int8Array(gross_ta);
print(mystery_ta.buffer.__proto__ === GrossBuffer.prototype);
// true
print(mystery_ta.buffer.isGross);
// true

#### jsc
barf
true
true

#### sm
barf
true
true

#### v8
barf
true
true

#### xs
barf
true
true

Still, I want to see we can remove this one weird use.

/cc @marjakh who initially discovered this.

[bakkot]

A cursory look around finds that use of extends ArrayBuffer on GitHub is almost exclusively restricted to tests of browser engines and exploits, so I'd be surprised if this breaks anything.

[ljharb]

What about node’s Buffer, polyfilled to run in the browser?

[bakkot]

What about it?

[bathos]

I’m very in favor of this change. It’s currently a huge ordeal to clone array buffer data in a manner that’s guaranteed not to invoke user code because of this behavior.

[ljharb]

@bakkot does it extend ArrayBuffer? I’m on mobile rn so i can’t check; i forget if it’s that or one of the typed array types.

[bakkot]

It extends UInt8Array; its underlying .buffer is just a plain ArrayBuffer.

[bakkot]

also found a jit exploit :P

I mentioned exploits! There's actually a couple distinct ones (e.g.).

I feel like "this feature has been used more often for exploits than for its actual intended use" is a pretty good reason to remove a feature.