fix a lack of error on passing a negative length to the DataView constructor polyfill

Author: zloirock

CHANGELOG.md

@@ -60,7 +60,7 @@
 - Fixed possible loss of symbol enumerability in `Object.defineProperty` in `Symbol` polyfill
 - Fixed return value of `Object.defineProperty` in `Symbol` polyfill in Android ~ 2
 - Fixed order of `%TypedArray%.from` arguments validation
-- Fixed a lack of error on passing an `ArrayBuffer` and a negative length to the `%TypedArray%` constructor polyfill
+- Fixed a lack of error on passing an `ArrayBuffer` and a negative length to the `%TypedArray%` and `DataView` constructors polyfills
 - Fixed some cases of `@@toStringTag` on `%TypedArray%` polyfill
 - Fixed some cases of `ToUint8Clamp` conversion
 - Fixed `NaN` handling in `Date.prototype.setYear` polyfill

packages/core-js/internals/array-buffer.js

@@ -10,7 +10,6 @@ var defineBuiltIns = require('../internals/define-built-ins');
 var fails = require('../internals/fails');
 var anInstance = require('../internals/an-instance');
 var toIntegerOrInfinity = require('../internals/to-integer-or-infinity');
-var toLength = require('../internals/to-length');
 var toIndex = require('../internals/to-index');
 var fround = require('../internals/math-fround');
 var IEEE754 = require('../internals/ieee754');
@@ -126,7 +125,7 @@ if (!NATIVE_ARRAY_BUFFER) {
     var bufferLength = bufferState.byteLength;
     var offset = toIntegerOrInfinity(byteOffset);
     if (offset < 0 || offset > bufferLength) throw new RangeError('Wrong offset');
-    byteLength = byteLength === undefined ? bufferLength - offset : toLength(byteLength);
+    byteLength = byteLength === undefined ? bufferLength - offset : toIndex(byteLength);
     if (offset + byteLength > bufferLength) throw new RangeError(WRONG_LENGTH);
     setInternalState(this, {
       type: DATA_VIEW,

tests/unit-global/es.data-view.js

@@ -31,6 +31,7 @@ QUnit.test('DataView', assert => {
     assert.throws(() => new DataView(new ArrayBuffer(8), -1), RangeError, 'If offset < 0, throw a RangeError exception');
     assert.throws(() => new DataView(new ArrayBuffer(8), 16), RangeError, 'If newByteLength < 0, throw a RangeError exception');
     assert.throws(() => new DataView(new ArrayBuffer(24), 8, 24), RangeError, 'If offset+newByteLength > bufferByteLength, throw a RangeError exception');
+    assert.throws(() => new DataView(new ArrayBuffer(8), 0, -1), RangeError, 'negative byteLength throws RangeError');
     // Android ~ 4.0
     assert.throws(() => DataView(1), TypeError, 'throws without `new`');
     assert.throws(() => DataView(1), 'throws without `new`');
@@ -39,6 +40,7 @@ QUnit.test('DataView', assert => {
     assert.throws(() => new DataView(new ArrayBuffer(8), -1), 'If offset < 0, throw a RangeError exception');
     assert.throws(() => new DataView(new ArrayBuffer(8), 16), 'If newByteLength < 0, throw a RangeError exception');
     assert.throws(() => new DataView(new ArrayBuffer(24), 8, 24), 'If offset+newByteLength > bufferByteLength, throw a RangeError exception');
+    assert.throws(() => new DataView(new ArrayBuffer(8), 0, -1), 'negative byteLength throws');
   }
   dataview = new DataView(new ArrayBuffer(8));
   dataview.setUint32(0, 0x12345678);