ArrayBuffer.prototype.transfer throws a TypeError instead of a RangeError on a resizable buffer

[d01c2]

Reproduction

new ArrayBuffer(8, { maxByteLength: 16 }).transfer(Number.MAX_SAFE_INTEGER);

Expected

A RangeError is thrown.

V8 (15.6.20):

d8> new ArrayBuffer(8, { maxByteLength: 16 }).transfer(Number.MAX_SAFE_INTEGER);
RangeError: ArrayBuffer.prototype.transfer: Invalid length parameter

Actual (QuickJS-ng)

QuickJS-ng reports the rejected length as a type error:

qjs > new ArrayBuffer(8, { maxByteLength: 16 }).transfer(Number.MAX_SAFE_INTEGER);
TypeError: invalid array buffer length

Spec

ArrayBuffer.prototype.transfer calls ArrayBufferCopyAndDetach with preserve-resizability, which converts newLength with ToIndex and keeps the source's [[ArrayBufferMaxByteLength]] as newMaxByteLength.

2 ** 53 - 1 is a valid index, so it reaches AllocateArrayBuffer. That operation throws a RangeError when byteLength exceeds maxByteLength, and every remaining allocation failure in it is a RangeError as well. No step on this path produces a TypeError.

The error type depends on resizability: new ArrayBuffer(8).transfer(Number.MAX_SAFE_INTEGER) is a RangeError in QuickJS-ng, and so is transfer(2 ** 53), which ToIndex rejects before allocation. Only the resizable buffer takes the TypeError path.

Versions

• QuickJS-ng: 0.17.0
• V8: 15.6.20