RAB: Integrate staging tests for the .indexOf method (#4136)

* Import relevant files from #3888

* Removing parts in resizableArrayBufferUtils.js and adding it in includes,
while applying review changes from PRs for previously tested methods.

* Restructures ArrayIndexOfNumOrBigInt to use MayNeedBigInt as it seems clearer.

* Adds missing test file for Array.prototype.indexOf

test/built-ins/Array/prototype/indexOf/coerced-searchelement-fromindex-grow.js

@@ -0,0 +1,55 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.indexof
+description: >
+  Array.p.indexOf behaves correctly when the backing resizable buffer is grown
+  during argument coercion.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function MayNeedBigInt(ta, n) {
+  if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+    return BigInt(n);
+  }
+  return n;
+}
+
+// Growing + length-tracking TA.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, 1);
+  }
+  let evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  let n0 = MayNeedBigInt(lengthTracking, 0);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n0), -1);
+  // The TA grew but we only look at the data until the original length.
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n0, evil), -1);
+}
+
+// Growing + length-tracking TA, index conversion.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  WriteToTypedArray(lengthTracking, 0, 1);
+  let evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return -4;
+    }
+  };
+  let n1 = MayNeedBigInt(lengthTracking, 1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n1, -4), 0);
+  // The TA grew but the start index conversion is done based on the original
+  // length.
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n1, evil), 0);
+}

test/built-ins/Array/prototype/indexOf/coerced-searchelement-fromindex-shrink.js

@@ -0,0 +1,67 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.indexof
+description: >
+  Array.p.indexOf behaves correctly when the backing resizable buffer is shrunk
+  during argument coercion.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function MayNeedBigInt(ta, n) {
+  if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+    return BigInt(n);
+  }
+  return n;
+}
+
+// Shrinking + fixed-length TA.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  let evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  let n0 = MayNeedBigInt(fixedLength, 0);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n0), 0);
+  // The TA is OOB so indexOf returns -1.
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n0, evil), -1);
+}
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  let evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  let n0 = MayNeedBigInt(fixedLength, 0);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n0), 0);
+  // The TA is OOB so indexOf returns -1, also for undefined).
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, undefined, evil), -1);
+}
+
+// Shrinking + length-tracking TA.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i);
+  }
+  let evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  let n2 = MayNeedBigInt(lengthTracking, 2);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n2), 2);
+  // 2 no longer found.
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n2, evil), -1);
+}

test/built-ins/Array/prototype/indexOf/resizable-buffer-special-float-values.js

@@ -0,0 +1,26 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%array%.prototype.indexof
+description: >
+  Array.p.indexOf behaves correctly for special float values on TypedArrays
+  backed by resizable buffers.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer, Array.prototype.includes]
+---*/
+
+for (let ctor of floatCtors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  lengthTracking[0] = -Infinity;
+  lengthTracking[1] = -Infinity;
+  lengthTracking[2] = Infinity;
+  lengthTracking[3] = Infinity;
+  lengthTracking[4] = NaN;
+  lengthTracking[5] = NaN;
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, -Infinity), 0);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, Infinity), 2);
+  // NaN is never found.
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, NaN), -1);
+}

test/built-ins/Array/prototype/indexOf/resizable-buffer.js

@@ -0,0 +1,126 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.indexof
+description: >
+  Array.p.indexOf behaves correctly on TypedArrays backed by resizable buffers.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function MayNeedBigInt(ta, n) {
+  if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+    return BigInt(n);
+  }
+  return n;
+}
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+  const lengthTracking = new ctor(rab, 0);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+  // Write some data into the array.
+  const taWrite = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(taWrite, i, Math.floor(i / 2));
+  }
+
+  // Orig. array: [0, 0, 1, 1]
+  //              [0, 0, 1, 1] << fixedLength
+  //                    [1, 1] << fixedLengthWithOffset
+  //              [0, 0, 1, 1, ...] << lengthTracking
+  //                    [1, 1, ...] << lengthTrackingWithOffset
+
+  // If fixedLength is a BigInt array, they all are BigInt Arrays.
+  let n0 = MayNeedBigInt(fixedLength, 0);
+  let n1 = MayNeedBigInt(fixedLength, 1);
+
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n0), 0);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n0, 1), 1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n0, 2), -1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n0, -2), -1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n0, -3), 1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n1, 1), 2);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n1, -3), 2);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n1, -2), 2);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, undefined), -1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, n1), 0);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, n1, -2), 0);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, n1, -1), 1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, undefined), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n0), 0);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n0, 2), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n1, -3), 2);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, undefined), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, n1), 0);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, n1, 1), 1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, n1, -2), 0);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, undefined), -1);
+
+  // Shrink so that fixed length TAs go out of bounds.
+  rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+
+  // Orig. array: [0, 0, 1]
+  //              [0, 0, 1, ...] << lengthTracking
+  //                    [1, ...] << lengthTrackingWithOffset
+
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n1), -1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, n1), -1);
+
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n1), 2);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, undefined), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, n1), 0);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, undefined), -1);
+
+  // Shrink so that the TAs with offset go out of bounds.
+  rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n0), -1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, n0), -1);
+
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n0), 0);
+
+  // Shrink to zero.
+  rab.resize(0);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n0), -1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n0), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, undefined), -1);
+
+  // Grow so that all TAs are back in-bounds.
+  rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+  for (let i = 0; i < 6; ++i) {
+    WriteToTypedArray(taWrite, i, Math.floor(i / 2));
+  }
+
+  // Orig. array: [0, 0, 1, 1, 2, 2]
+  //              [0, 0, 1, 1] << fixedLength
+  //                    [1, 1] << fixedLengthWithOffset
+  //              [0, 0, 1, 1, 2, 2, ...] << lengthTracking
+  //                    [1, 1, 2, 2, ...] << lengthTrackingWithOffset
+
+  let n2 = MayNeedBigInt(fixedLength, 2);
+
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n1), 2);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, n2), -1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLength, undefined), -1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, n1), 0);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, n2), -1);
+  assert.sameValue(Array.prototype.indexOf.call(fixedLengthWithOffset, undefined), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n1), 2);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, n2), 4);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTracking, undefined), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, n1), 0);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, n2), 2);
+  assert.sameValue(Array.prototype.indexOf.call(lengthTrackingWithOffset, undefined), -1);
+}

test/built-ins/TypedArray/prototype/indexOf/coerced-searchelement-fromindex-grow.js

@@ -0,0 +1,55 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.indexof
+description: >
+  TypedArray.p.indexOf behaves correctly when the backing resizable buffer is
+  grown during argument coercion.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function MayNeedBigInt(ta, n) {
+  if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+    return BigInt(n);
+  }
+  return n;
+}
+
+// Growing + length-tracking TA.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, 1);
+  }
+  let evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  let n0 = MayNeedBigInt(lengthTracking, 0);
+  assert.sameValue(lengthTracking.indexOf(n0), -1);
+  // The TA grew but we only look at the data until the original length.
+  assert.sameValue(lengthTracking.indexOf(n0, evil), -1);
+}
+
+// Growing + length-tracking TA, index conversion.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  WriteToTypedArray(lengthTracking, 0, 1);
+  let evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return -4;
+    }
+  };
+  let n1 = MayNeedBigInt(lengthTracking, 1);
+  assert.sameValue(lengthTracking.indexOf(n1, -4), 0);
+  // The TA grew but the start index conversion is done based on the original
+  // length.
+  assert.sameValue(lengthTracking.indexOf(n1, evil), 0);
+}