From d93a1e2b3326c3c49f579defe43c51559035f077 Mon Sep 17 00:00:00 2001 From: Dan Ehrenberg Date: Thu, 14 Jan 2016 11:53:22 -0800 Subject: [PATCH] Ensure ES2016 engines construct Uint8Array (not Buffer) from Buffer.prototype.slice In the ES2016 draft specification, TypedArray methods like %TypedArray%.prototype.subarray() call out to a constructor for the result based on the receiver. Ordinarily, the constructor is instance.constructor, but subclasses can override this using the Symbol.species property on the constructor. Buffer.prototype.slice calls out to %TypedArray%.prototype.subarray, which calls this calculated constructor with three arguments. The argument pattern doesn't correspond to a constructor for Buffer, so without setting Symbol.species appropriately, the wrong kind of result is created. This patch sets Buffer[Symbol.species] to Uint8Array when appropriate, to address the issue. --- index.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/index.js b/index.js index 15d7c50..fee0dc7 100644 --- a/index.js +++ b/index.js @@ -217,6 +217,11 @@ function fromJsonObject (that, object) { if (Buffer.TYPED_ARRAY_SUPPORT) { Buffer.prototype.__proto__ = Uint8Array.prototype Buffer.__proto__ = Uint8Array + if (typeof Symbol !== 'undefined' && Symbol.species && + Buffer[Symbol.species] === Buffer) { + Object.defineProperty(Buffer, Symbol.species, + { value: null, configurable: true }) + } } else { // pre-set for values that may exist in the future Buffer.prototype.length = undefined -- 2.34.1