1 files changed, 35 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/DataView/custom-proto-access-resizes-buffer-valid-by-length.js b/js/src/tests/test262/built-ins/DataView/custom-proto-access-resizes-buffer-valid-by-length.js
new file mode 100644
index 0000000000..9509cb7e15
--- /dev/null
+++ b/js/src/tests/test262/built-ins/DataView/custom-proto-access-resizes-buffer-valid-by-length.js
@@ -0,0 +1,35 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-dataview-buffer-byteoffset-bytelength
+description: >
+  The sum of the view's offset and byte length may equal the underlying
+  buffer's byte length if it is modified during retrieval of the NewTarget's
+  prototype.
+features: [resizable-arraybuffer]
+---*/
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where `ArrayBuffer.prototype.resize`
+// has not been implemented. The following assertion prevents this test from
+// passing in runtimes which have not implemented the method.
+assert.sameValue(typeof ArrayBuffer.prototype.resize, 'function');
+
+var buffer = new ArrayBuffer(3, {maxByteLength: 3});
+
+var newTarget = function() {}.bind(null);
+Object.defineProperty(newTarget, 'prototype', {
+  get: function() {
+    try {
+      buffer.resize(2);
+    } catch (error) {}
+  }
+});
+
+var result = Reflect.construct(DataView, [buffer, 1, 1], newTarget);
+
+assert.sameValue(result.constructor, DataView);
+assert.sameValue(result.byteLength, 1);
+
+reportCompare(0, 0);