fix buffer mutation exposure in Iterator.prototype.windows polyfill

Author: zloirock

CHANGELOG.md

@@ -20,6 +20,7 @@
 - Fixed some cases of iterators closing in `Iterator.{ zip, zipKeyed }` polyfills
 - Fixed validation of iterators `.next()` results an objects in `Iterator.{ zip, zipKeyed }` polyfills
 - Fixed a lack of early error in `Iterator.concat` polyfill on primitive as an iterator
+- Fixed buffer mutation exposure in `Iterator.prototype.windows` polyfill
 - Fixed iterator closing in `Set.prototype.{ isDisjointFrom, isSupersetOf }` polyfill
 - Fixed (updated following the final spec) one more case `Set.prototype.difference` polyfill with updating `this`
 - Fixed `DataView.prototype.setFloat16` polyfill in (0, 1) range

packages/core-js/internals/iterator-window.js

@@ -23,12 +23,12 @@ var IteratorProxy = createIteratorProxy(function () {
   while (true) {
     result = anObject(call(next, iterator));
     done = this.done = !!result.done;
-    if (allowPartial && done && buffer.length && buffer.length < windowSize) return createIterResultObject(buffer, false);
+    if (allowPartial && done && buffer.length && buffer.length < windowSize) return createIterResultObject(slice(buffer, 0), false);
     if (done) return createIterResultObject(undefined, true);
 
     if (buffer.length === windowSize) this.buffer = buffer = slice(buffer, 1);
     push(buffer, result.value);
-    if (buffer.length === windowSize) return createIterResultObject(buffer, false);
+    if (buffer.length === windowSize) return createIterResultObject(slice(buffer, 0), false);
   }
 }, false, true);
 

tests/unit-global/esnext.iterator.windows.js

@@ -51,4 +51,14 @@ QUnit.test('Iterator#windows', assert => {
 
   assert.throws(() => windows.call(createIterator([1]), 2, null), TypeError, 'incorrect `undersized` argument #1');
   assert.throws(() => windows.call(createIterator([1]), 2, 'allowpartial'), TypeError, 'incorrect `undersized` argument #2');
+
+  // windows should return independent copies (not the same buffer)
+  {
+    const iter = windows.call(createIterator([1, 2, 3, 4, 5]), 3);
+    const w1 = iter.next().value;
+    assert.deepEqual(w1, [1, 2, 3], 'window 1');
+    w1[1] = 99;
+    const w2 = iter.next().value;
+    assert.deepEqual(w2, [2, 3, 4], 'window 2 not affected by mutation of window 1');
+  }
 });

tests/unit-pure/esnext.iterator.windows.js

@@ -50,4 +50,14 @@ QUnit.test('Iterator#windows', assert => {
 
   assert.throws(() => windows.call(createIterator([1]), 2, null), TypeError, 'incorrect `undersized` argument #1');
   assert.throws(() => windows.call(createIterator([1]), 2, 'allowpartial'), TypeError, 'incorrect `undersized` argument #2');
+
+  // windows should return independent copies (not the same buffer)
+  {
+    const iter = windows.call(createIterator([1, 2, 3, 4, 5]), 3);
+    const w1 = iter.next().value;
+    assert.deepEqual(w1, [1, 2, 3], 'window 1');
+    w1[1] = 99;
+    const w2 = iter.next().value;
+    assert.deepEqual(w2, [2, 3, 4], 'window 2 not affected by mutation of window 1');
+  }
 });