buffer: fix regression in Buffer(buf) constructor

Commit 3a2f273b got the source and the target wrong when copying over
the data. Fix that and add a regression test.

Fixes #6111.

lib/buffer.js

@@ -88,7 +88,7 @@ function Buffer(subject, encoding) {
       this.length = this.write(subject, 0, encoding);
     } else {
       if (util.isBuffer(subject))
-        this.copy(subject, 0, 0, this.length);
+        subject.copy(this, 0, 0, this.length);
       else if (util.isNumber(subject.length) || util.isArray(subject))
         for (var i = 0; i < this.length; i++)
           this[i] = subject[i];

test/simple/test-buffer.js

@@ -965,3 +965,19 @@ assert.throws(function() {
   Buffer('', 'buffer');
 }, TypeError);
 
+// Regression test for #6111. Constructing a buffer from another buffer
+// should a) work, and b) not corrupt the source buffer.
+(function() {
+  var a = [0];
+  for (var i = 0; i < 7; ++i) a = a.concat(a);
+  a = a.map(function(_, i) { return i });
+  var b = Buffer(a);
+  var c = Buffer(b);
+  assert.equal(b.length, a.length);
+  assert.equal(c.length, a.length);
+  for (var i = 0, k = a.length; i < k; ++i) {
+    assert.equal(a[i], i);
+    assert.equal(b[i], i);
+    assert.equal(c[i], i);
+  }
+})();