TypedArray species creation skips the content type check #1770

Reproduction

class A extends BigInt64Array { static [Symbol.species] = Uint8Array; }
new A().slice();

Expected

A TypeError is thrown, because the species constructor creates a Number-typed array from a BigInt-typed one.

JavaScriptCore (321440):

$ jsc -e 'class A extends BigInt64Array { static [Symbol.species] = Uint8Array; } new A().slice();'
Exception: TypeError: Content types of source and created typed arrays are different

Actual (QuickJS-ng)

QuickJS-ng returns the Uint8Array:

$ qjs -e 'class A extends BigInt64Array { static [Symbol.species] = Uint8Array; } print(new A().slice().constructor.name);'
Uint8Array

Spec

slice, filter, map and subarray create their result with TypedArraySpeciesCreate, whose last step is "If result.[[ContentType]] is not exemplar.[[ContentType]], throw a TypeError exception." BigInt64Array has content type bigint and Uint8Array has number, so all four must throw. The check does not depend on the length, so an empty source is enough.

QuickJS-ng returns a Uint8Array from all four:

$ qjs -e 'class A extends BigInt64Array { static [Symbol.species] = Uint8Array; } const a = new A(); print([a.slice(), a.filter(() => true), a.map(x => x), a.subarray()].map(r => r.constructor.name).join(", "));'
Uint8Array, Uint8Array, Uint8Array, Uint8Array

As in #1690, a non-empty source hides the missing check, because the element copy fails instead: new A(1).slice() throws TypeError: cannot convert BigInt to number. PR #1694 added the check to the TypedArray constructor only; species creation needs the same test.

JavaScriptCore throws on all four and SpiderMonkey on slice and subarray. V8 15.6.20 behaves like QuickJS-ng here, so it is not a useful reference for this case.

Versions

• QuickJS-ng: 0.17.0
• JavaScriptCore: 321440
• V8: 15.6.20