Missing checks for immutable objects returned from species constructors

[anba]

https://tc39.es/ecma262/#sec-%typedarray%.prototype.filter:

9. Let A be ? TypedArraySpeciesCreate(O, « 𝔽(captured) »).
10. Let n be 0.
11. For each element e of kept, do
    a. Perform ! Set(A, ! ToString(𝔽(n)), e, true).
    b. Set n to n + 1.

If A is an immutable TypedArray object, then Set can return with an abrupt completion, so using ! Set is no longer correct.

Other callers to TypedArraySpeciesCreate:

• https://tc39.es/ecma262/#sec-%typedarray%.prototype.slice also needs to be updated.
• https://tc39.es/ecma262/#sec-%typedarray%.prototype.map already uses ? Set.

---

I guess the simplest fix is to update https://tc39.es/ecma262/#sec-typedarraycreatefromconstructor and add a new step 3.d:

3.d. If IsImmutableBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception

Or rewriting TypedArrayCreateFromConstructor to pass the correct access-mode:

1. If the number of elements in argumentList is 1 and argumentList[0] is a Number, then
   a. Let accessMode be WRITE.
2. Else,
   b. Let accessMode be READ.
3. Let newTypedArray be ? Construct(constructor, argumentList).
4. Let taRecord be ? ValidateTypedArray(newTypedArray, seq-cst, accessMode).
5. If accessMode is WRITE, then
   a. Assert: IsTypedArrayOutOfBounds(taRecord) is false.
   b. Let length be TypedArrayLength(taRecord).
   c. If length < ℝ(argumentList[0]), throw a TypeError exception.
6. Return newTypedArray.

Drive-by change: Update step 5.a. to use Assert, because ValidateTypedArray already throws for out-of-bounds.

[gibson042]

Ugh, species. Thanks for the report. Please review #47, in which I have opted to add an optional accessMode parameter to TypedArraySpeciesCreate and passed in WRITE from %TypedArray%.prototype.{filter,map,slice} (but not from %TypedArray%.prototype.subarray, which returns without attempting any buffer manipulation).