Do not allow invocation of ArrayBuffer and array buffer views' constructors as functions.

test/mjsunit/external-array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 501 matching lines @@
 aa = a.subarray(0,-8);
 assertInstance(aa, Uint16Array);
 assertEquals(0, aa.length);
 assertEquals(0, aa.byteLength);
 assertEquals(2, aa.BYTES_PER_ELEMENT);
 assertSame(a.buffer, aa.buffer);
 
 assertThrows(function(){ a.subarray.call({}, 0) });
 assertThrows(function(){ a.subarray.call([], 0) });
 
-// Call constructors directly as functions, and through .call and .apply
+// Try to call constructors directly as functions, and through .call
+// and .apply. Should fail.
 
-b = ArrayBuffer(100)
-a = Int8Array(b, 5, 77)
-assertInstance(b, ArrayBuffer)
-assertInstance(a, Int8Array)
-assertSame(b, a.buffer)
-assertEquals(5, a.byteOffset)
-assertEquals(77, a.byteLength)
-b = ArrayBuffer.call(null, 10)
-a = Uint16Array.call(null, b, 2, 4)
-assertInstance(b, ArrayBuffer)
-assertInstance(a, Uint16Array)
-assertSame(b, a.buffer)
-assertEquals(2, a.byteOffset)
-assertEquals(8, a.byteLength)
-b = ArrayBuffer.apply(null, [1000])
-a = Float32Array.apply(null, [b, 128, 1])
-assertInstance(b, ArrayBuffer)
-assertInstance(a, Float32Array)
-assertSame(b, a.buffer)
-assertEquals(128, a.byteOffset)
-assertEquals(4, a.byteLength)
-
+assertThrows(function() { ArrayBuffer(100); }, TypeError);
+assertThrows(function() { Int8Array(b, 5, 77); }, TypeError);
+assertThrows(function() { ArrayBuffer.call(null, 10); }, TypeError);
+assertThrows(function() { Uint16Array.call(null, b, 2, 4); }, TypeError);
+assertThrows(function() { ArrayBuffer.apply(null, [1000]); }, TypeError);
+assertThrows(function() { Float32Array.apply(null, [b, 128, 1]); }, TypeError);
 
 // Test array.set in different combinations.
 
 function assertArrayPrefix(expected, array) {
   for (var i = 0; i < expected.length; ++i) {
     assertEquals(expected[i], array[i]);
   }
 }
 
 var a11 = new Int16Array([1, 2, 3, 4, 0, -1])
@@ skipping 68 matching lines @@
 assertThrows(function() { a.set({}) })
 
 
 // Test arraybuffer.slice
 
 var a0 = new Int8Array([1, 2, 3, 4, 5, 6])
 var b0 = a0.buffer
 
 var b1 = b0.slice(0)
 assertEquals(b0.byteLength, b1.byteLength)
-assertArrayPrefix([1, 2, 3, 4, 5, 6], Int8Array(b1))
+assertArrayPrefix([1, 2, 3, 4, 5, 6], new Int8Array(b1))
 
 var b2 = b0.slice(3)
 assertEquals(b0.byteLength - 3, b2.byteLength)
-assertArrayPrefix([4, 5, 6], Int8Array(b2))
+assertArrayPrefix([4, 5, 6], new Int8Array(b2))
 
 var b3 = b0.slice(2, 4)
 assertEquals(2, b3.byteLength)
-assertArrayPrefix([3, 4], Int8Array(b3))
+assertArrayPrefix([3, 4], new Int8Array(b3))
 
 function goo(a, i) {
   return a[i];
 }
 
 function boo(a, i, v) {
   return a[i] = v;
 }
 
 function do_tagged_index_external_array_test(constructor) {
@@ skipping 31 matching lines @@
 
 built_in_array = new Array(1.5, 2, 3, 4, 5, 6);
 assertEquals(1.5, goo(built_in_array, 0));
 assertEquals(1.5, goo(built_in_array, 0));
 %OptimizeFunctionOnNextCall(goo);
 %OptimizeFunctionOnNextCall(boo);
 boo(built_in_array, 0, 2.5);
 assertEquals(2.5, goo(built_in_array, 0));
 %ClearFunctionTypeFeedback(goo);
 %ClearFunctionTypeFeedback(boo);