Test case: --- ta = new Int8Array(new ArrayBuffer(2), 1, 1); ta.constructor = { [Symbol.species]: function(ab, offset, length) { print("offset", offset); return new Int8Array(1); } }; ta.subarray({ valueOf() { detachArrayBuffer(ta.buffer, "same-data") return 0; } }); --- Expected: Prints "offset 1" Actual: Prints "offset 0" It's probably easier to move the TypedArrayByteOffset [1] call before the ToInteger [2] calls, compared to not zeroing [[ByteOffset]] when detaching the array buffer. [1] http://hg.mozilla.org/mozilla-central/file/ffac2798999c/js/src/builtin/TypedArray.js#l1140 [2] https://dxr.mozilla.org/mozilla-central/source/js/src/builtin/TypedArray.js#1124

Just a silly spec compliance edge case. :-)

Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=a8133cc6144f27a0e4a4577b06bf16219fba384d

Comment on attachment 8806022 [details] [diff] [review] bug1291003.patch Review of attachment 8806022 [details] [diff] [review]: ----------------------------------------------------------------- Ooookay

Pushed by cbook@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/d3041026a921 Compute byteOffset before calling ToInteger in %TypedArray%.prototype.subarray. r=evilpie