Fix subclassing of ArrayBuffer and TypedArrays

Change-Id: I481974c224f7fdb4df6b641e8dd550add96b4c08
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

1 files changed, 15 insertions, 2 deletions

diff --git a/src/qml/jsruntime/qv4typedarray.cpp b/src/qml/jsruntime/qv4typedarray.cpp
index 7492f8872d..d0125a3cfe 100644
--- a/src/qml/jsruntime/qv4typedarray.cpp
+++ b/src/qml/jsruntime/qv4typedarray.cpp
@@ -280,11 +280,20 @@ void Heap::TypedArrayCtor::init(QV4::ExecutionContext *scope, TypedArray::Type t
     type = t;
 }
 
-ReturnedValue TypedArrayCtor::virtualCallAsConstructor(const FunctionObject *f, const Value *argv, int argc, const Value *)
+ReturnedValue TypedArrayCtor::virtualCallAsConstructor(const FunctionObject *f, const Value *argv, int argc, const Value *newTarget)
 {
     Scope scope(f->engine());
     const TypedArrayCtor *that = static_cast<const TypedArrayCtor *>(f);
 
+    auto updateProto = [=](Scope &scope, Scoped<TypedArray> &a) {
+        if (newTarget->heapObject() != f->heapObject() && newTarget->isFunctionObject()) {
+            const FunctionObject *nt = static_cast<const FunctionObject *>(newTarget);
+            ScopedObject o(scope, nt->protoProperty());
+            if (o)
+                a->setPrototypeOf(o);
+        }
+    };
+
     if (!argc || !argv[0].isObject()) {
         // ECMA 6 22.2.1.1
         qint64 l = argc ? argv[0].toIndex() : 0;
@@ -306,6 +315,7 @@ ReturnedValue TypedArrayCtor::virtualCallAsConstructor(const FunctionObject *f,
         array->d()->byteLength = byteLength;
         array->d()->byteOffset = 0;
 
+        updateProto(scope, array);
         return array.asReturnedValue();
     }
     Scoped<TypedArray> typedArray(scope, argc ? argv[0] : Primitive::undefinedValue());
@@ -346,6 +356,7 @@ ReturnedValue TypedArrayCtor::virtualCallAsConstructor(const FunctionObject *f,
             }
         }
 
+        updateProto(scope, array);
         return array.asReturnedValue();
     }
     Scoped<ArrayBuffer> buffer(scope, argc ? argv[0] : Primitive::undefinedValue());
@@ -383,6 +394,8 @@ ReturnedValue TypedArrayCtor::virtualCallAsConstructor(const FunctionObject *f,
         array->d()->buffer.set(scope.engine, buffer->d());
         array->d()->byteLength = byteLength;
         array->d()->byteOffset = byteOffset;
+
+        updateProto(scope, array);
         return array.asReturnedValue();
     }
 
@@ -421,7 +434,7 @@ ReturnedValue TypedArrayCtor::virtualCallAsConstructor(const FunctionObject *f,
         b += elementSize;
     }
 
-
+    updateProto(scope, array);
     return array.asReturnedValue();
 }