diff --git a/test/built-ins/Array/prototype/includes/coerced-searchelement-fromindex-resize.js b/test/built-ins/Array/prototype/includes/coerced-searchelement-fromindex-resize.js new file mode 100644 index 00000000000..96c5ca2ff41 --- /dev/null +++ b/test/built-ins/Array/prototype/includes/coerced-searchelement-fromindex-resize.js @@ -0,0 +1,92 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// This code is governed by the BSD license found in the LICENSE file. + +/*--- +esid: sec-array.prototype.includes +description: > + Array.p.includes behaves correctly on TypedArrays backed by resizable buffers + that are resized during argument coercion. +includes: [resizableArrayBufferUtils.js] +features: [resizable-arraybuffer, Array.prototype.includes] +---*/ + +function MayNeedBigInt(ta, n) { + if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) { + return BigInt(n); + } + return n; +} + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const fixedLength = new ctor(rab, 0, 4); + let evil = { + valueOf: () => { + rab.resize(2 * ctor.BYTES_PER_ELEMENT); + return 0; + } + }; + assert(!Array.prototype.includes.call(fixedLength, undefined)); + // The TA is OOB so it includes only "undefined". + assert(Array.prototype.includes.call(fixedLength, undefined, evil)); +} +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const fixedLength = new ctor(rab, 0, 4); + let evil = { + valueOf: () => { + rab.resize(2 * ctor.BYTES_PER_ELEMENT); + return 0; + } + }; + let n0 = MayNeedBigInt(fixedLength, 0); + assert(Array.prototype.includes.call(fixedLength, n0)); + // The TA is OOB so it includes only "undefined". + assert(!Array.prototype.includes.call(fixedLength, n0, evil)); +} +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = new ctor(rab); + let evil = { + valueOf: () => { + rab.resize(2 * ctor.BYTES_PER_ELEMENT); + return 0; + } + }; + assert(!Array.prototype.includes.call(lengthTracking, undefined)); + // "includes" iterates until the original length and sees "undefined"s. + assert(Array.prototype.includes.call(lengthTracking, undefined, evil)); +} +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = new ctor(rab); + for (let i = 0; i < 4; ++i) { + WriteToTypedArray(lengthTracking, i, 1); + } + let evil = { + valueOf: () => { + rab.resize(6 * ctor.BYTES_PER_ELEMENT); + return 0; + } + }; + let n0 = MayNeedBigInt(lengthTracking, 0); + assert(!Array.prototype.includes.call(lengthTracking, n0)); + // The TA grew but we only look at the data until the original length. + assert(!Array.prototype.includes.call(lengthTracking, n0, evil)); +} +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = new ctor(rab); + WriteToTypedArray(lengthTracking, 0, 1); + let evil = { + valueOf: () => { + rab.resize(6 * ctor.BYTES_PER_ELEMENT); + return -4; + } + }; + let n1 = MayNeedBigInt(lengthTracking, 1); + assert(Array.prototype.includes.call(lengthTracking, n1, -4)); + // The TA grew but the start index conversion is done based on the original + // length. + assert(Array.prototype.includes.call(lengthTracking, n1, evil)); +} diff --git a/test/built-ins/Array/prototype/includes/resizable-buffer-special-float-values.js b/test/built-ins/Array/prototype/includes/resizable-buffer-special-float-values.js new file mode 100644 index 00000000000..1908d833eb6 --- /dev/null +++ b/test/built-ins/Array/prototype/includes/resizable-buffer-special-float-values.js @@ -0,0 +1,22 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// This code is governed by the BSD license found in the LICENSE file. + +/*--- +esid: sec-%array%.prototype.includes +description: > + Array.p.includes behaves correctly for special float values on float + TypedArrays backed by resizable buffers. +includes: [resizableArrayBufferUtils.js] +features: [resizable-arraybuffer, Array.prototype.includes] +---*/ + +for (let ctor of floatCtors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = new ctor(rab); + lengthTracking[0] = -Infinity; + lengthTracking[1] = Infinity; + lengthTracking[2] = NaN; + assert(Array.prototype.includes.call(lengthTracking, -Infinity)); + assert(Array.prototype.includes.call(lengthTracking, Infinity)); + assert(Array.prototype.includes.call(lengthTracking, NaN)); +} diff --git a/test/built-ins/Array/prototype/includes/resizable-buffer.js b/test/built-ins/Array/prototype/includes/resizable-buffer.js new file mode 100644 index 00000000000..b9a78cef9af --- /dev/null +++ b/test/built-ins/Array/prototype/includes/resizable-buffer.js @@ -0,0 +1,128 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// This code is governed by the BSD license found in the LICENSE file. + +/*--- +esid: sec-array.prototype.includes +description: > + Array.p.includes behaves correctly on TypedArrays backed by resizable buffers. +includes: [resizableArrayBufferUtils.js] +features: [resizable-arraybuffer, Array.prototype.includes] +---*/ + +function MayNeedBigInt(ta, n) { + if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) { + return BigInt(n); + } + return n; +} + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const fixedLength = new ctor(rab, 0, 4); + const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2); + const lengthTracking = new ctor(rab, 0); + const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT); + + // Write some data into the array. + const taWrite = new ctor(rab); + for (let i = 0; i < 4; ++i) { + WriteToTypedArray(taWrite, i, 2 * i); + } + + // Orig. array: [0, 2, 4, 6] + // [0, 2, 4, 6] << fixedLength + // [4, 6] << fixedLengthWithOffset + // [0, 2, 4, 6, ...] << lengthTracking + // [4, 6, ...] << lengthTrackingWithOffset + + // If fixedLength is a BigInt array, they all are BigInt Arrays. + let n2 = MayNeedBigInt(fixedLength, 2); + let n4 = MayNeedBigInt(fixedLength, 4); + + assert(Array.prototype.includes.call(fixedLength, n2)); + assert(!Array.prototype.includes.call(fixedLength, undefined)); + assert(Array.prototype.includes.call(fixedLength, n2, 1)); + assert(!Array.prototype.includes.call(fixedLength, n2, 2)); + assert(Array.prototype.includes.call(fixedLength, n2, -3)); + assert(!Array.prototype.includes.call(fixedLength, n2, -2)); + assert(!Array.prototype.includes.call(fixedLengthWithOffset, n2)); + assert(Array.prototype.includes.call(fixedLengthWithOffset, n4)); + assert(!Array.prototype.includes.call(fixedLengthWithOffset, undefined)); + assert(Array.prototype.includes.call(fixedLengthWithOffset, n4, 0)); + assert(!Array.prototype.includes.call(fixedLengthWithOffset, n4, 1)); + assert(Array.prototype.includes.call(fixedLengthWithOffset, n4, -2)); + assert(!Array.prototype.includes.call(fixedLengthWithOffset, n4, -1)); + assert(Array.prototype.includes.call(lengthTracking, n2)); + assert(!Array.prototype.includes.call(lengthTracking, undefined)); + assert(Array.prototype.includes.call(lengthTracking, n2, 1)); + assert(!Array.prototype.includes.call(lengthTracking, n2, 2)); + assert(Array.prototype.includes.call(lengthTracking, n2, -3)); + assert(!Array.prototype.includes.call(lengthTracking, n2, -2)); + assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n2)); + assert(Array.prototype.includes.call(lengthTrackingWithOffset, n4)); + assert(!Array.prototype.includes.call(lengthTrackingWithOffset, undefined)); + assert(Array.prototype.includes.call(lengthTrackingWithOffset, n4, 0)); + assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n4, 1)); + assert(Array.prototype.includes.call(lengthTrackingWithOffset, n4, -2)); + assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n4, -1)); + + // Shrink so that fixed length TAs go out of bounds. + rab.resize(3 * ctor.BYTES_PER_ELEMENT); + + // Orig. array: [0, 2, 4] + // [0, 2, 4, ...] << lengthTracking + // [4, ...] << lengthTrackingWithOffset + + assert(!Array.prototype.includes.call(fixedLength, n2)); + assert(!Array.prototype.includes.call(fixedLengthWithOffset, n2)); + + assert(Array.prototype.includes.call(lengthTracking, n2)); + assert(!Array.prototype.includes.call(lengthTracking, undefined)); + assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n2)); + assert(Array.prototype.includes.call(lengthTrackingWithOffset, n4)); + assert(!Array.prototype.includes.call(lengthTrackingWithOffset, undefined)); + + // Shrink so that the TAs with offset go out of bounds. + rab.resize(1 * ctor.BYTES_PER_ELEMENT); + assert(!Array.prototype.includes.call(fixedLength, n2)); + assert(!Array.prototype.includes.call(fixedLengthWithOffset, n2)); + assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n2)); + + // Shrink to zero. + rab.resize(0); + assert(!Array.prototype.includes.call(fixedLength, n2)); + assert(!Array.prototype.includes.call(fixedLengthWithOffset, n2)); + assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n2)); + + assert(!Array.prototype.includes.call(lengthTracking, n2)); + assert(!Array.prototype.includes.call(lengthTracking, undefined)); + + // Grow so that all TAs are back in-bounds. + rab.resize(6 * ctor.BYTES_PER_ELEMENT); + for (let i = 0; i < 6; ++i) { + WriteToTypedArray(taWrite, i, 2 * i); + } + + // Orig. array: [0, 2, 4, 6, 8, 10] + // [0, 2, 4, 6] << fixedLength + // [4, 6] << fixedLengthWithOffset + // [0, 2, 4, 6, 8, 10, ...] << lengthTracking + // [4, 6, 8, 10, ...] << lengthTrackingWithOffset + + let n8 = MayNeedBigInt(fixedLength, 8); + + assert(Array.prototype.includes.call(fixedLength, n2)); + assert(!Array.prototype.includes.call(fixedLength, undefined)); + assert(!Array.prototype.includes.call(fixedLength, n8)); + assert(!Array.prototype.includes.call(fixedLengthWithOffset, n2)); + assert(Array.prototype.includes.call(fixedLengthWithOffset, n4)); + assert(!Array.prototype.includes.call(fixedLengthWithOffset, undefined)); + assert(!Array.prototype.includes.call(fixedLengthWithOffset, n8)); + assert(Array.prototype.includes.call(lengthTracking, n2)); + assert(!Array.prototype.includes.call(lengthTracking, undefined)); + assert(Array.prototype.includes.call(lengthTracking, n8)); + assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n2)); + assert(Array.prototype.includes.call(lengthTrackingWithOffset, n4)); + assert(!Array.prototype.includes.call(lengthTrackingWithOffset, undefined)); + assert(Array.prototype.includes.call(lengthTrackingWithOffset, n8)); +} diff --git a/test/built-ins/TypedArray/prototype/includes/coerced-searchelement-fromindex-resize.js b/test/built-ins/TypedArray/prototype/includes/coerced-searchelement-fromindex-resize.js new file mode 100644 index 00000000000..8fed6fec140 --- /dev/null +++ b/test/built-ins/TypedArray/prototype/includes/coerced-searchelement-fromindex-resize.js @@ -0,0 +1,92 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// This code is governed by the BSD license found in the LICENSE file. + +/*--- +esid: sec-%typedarray%.prototype.includes +description: > + TypedArray.p.includes behaves correctly on TypedArrays backed by resizable + buffers that are resized during argument coercion. +includes: [resizableArrayBufferUtils.js] +features: [resizable-arraybuffer, Array.prototype.includes] +---*/ + +function MayNeedBigInt(ta, n) { + if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) { + return BigInt(n); + } + return n; +} + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const fixedLength = new ctor(rab, 0, 4); + let evil = { + valueOf: () => { + rab.resize(2 * ctor.BYTES_PER_ELEMENT); + return 0; + } + }; + assert(!fixedLength.includes(undefined)); + // The TA is OOB so it includes only "undefined". + assert(fixedLength.includes(undefined, evil)); +} +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const fixedLength = new ctor(rab, 0, 4); + let evil = { + valueOf: () => { + rab.resize(2 * ctor.BYTES_PER_ELEMENT); + return 0; + } + }; + let n0 = MayNeedBigInt(fixedLength, 0); + assert(fixedLength.includes(n0)); + // The TA is OOB so it includes only "undefined". + assert(!fixedLength.includes(n0, evil)); +} +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = new ctor(rab); + let evil = { + valueOf: () => { + rab.resize(2 * ctor.BYTES_PER_ELEMENT); + return 0; + } + }; + assert(!lengthTracking.includes(undefined)); + // "includes" iterates until the original length and sees "undefined"s. + assert(lengthTracking.includes(undefined, evil)); +} +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = new ctor(rab); + for (let i = 0; i < 4; ++i) { + WriteToTypedArray(lengthTracking, i, 1); + } + let evil = { + valueOf: () => { + rab.resize(6 * ctor.BYTES_PER_ELEMENT); + return 0; + } + }; + let n0 = MayNeedBigInt(lengthTracking, 0); + assert(!lengthTracking.includes(n0)); + // The TA grew but we only look at the data until the original length. + assert(!lengthTracking.includes(n0, evil)); +} +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = new ctor(rab); + WriteToTypedArray(lengthTracking, 0, 1); + let evil = { + valueOf: () => { + rab.resize(6 * ctor.BYTES_PER_ELEMENT); + return -4; + } + }; + let n1 = MayNeedBigInt(lengthTracking, 1); + assert(lengthTracking.includes(n1, -4)); + // The TA grew but the start index conversion is done based on the original + // length. + assert(lengthTracking.includes(n1, evil)); +} diff --git a/test/built-ins/TypedArray/prototype/includes/resizable-buffer-special-float-values.js b/test/built-ins/TypedArray/prototype/includes/resizable-buffer-special-float-values.js new file mode 100644 index 00000000000..36429d4041a --- /dev/null +++ b/test/built-ins/TypedArray/prototype/includes/resizable-buffer-special-float-values.js @@ -0,0 +1,22 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// This code is governed by the BSD license found in the LICENSE file. + +/*--- +esid: sec-%typedarray%.prototype.includes +description: > + TypedArray.p.includes behaves correctly for special float values when + receiver is a float TypedArray backed by a resizable buffer. +includes: [resizableArrayBufferUtils.js] +features: [resizable-arraybuffer, Array.prototype.includes] +---*/ + +for (let ctor of floatCtors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = new ctor(rab); + lengthTracking[0] = -Infinity; + lengthTracking[1] = Infinity; + lengthTracking[2] = NaN; + assert(lengthTracking.includes(-Infinity)); + assert(lengthTracking.includes(Infinity)); + assert(lengthTracking.includes(NaN)); +} diff --git a/test/built-ins/TypedArray/prototype/includes/resizable-buffer.js b/test/built-ins/TypedArray/prototype/includes/resizable-buffer.js new file mode 100644 index 00000000000..8e99ce5db68 --- /dev/null +++ b/test/built-ins/TypedArray/prototype/includes/resizable-buffer.js @@ -0,0 +1,144 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// This code is governed by the BSD license found in the LICENSE file. + +/*--- +esid: sec-%typedarray%.prototype.includes +description: > + TypedArray.p.includes behaves correctly on TypedArrays backed by resizable + buffers. +includes: [resizableArrayBufferUtils.js] +features: [resizable-arraybuffer, Array.prototype.includes] +---*/ + +function MayNeedBigInt(ta, n) { + if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) { + return BigInt(n); + } + return n; +} + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const fixedLength = new ctor(rab, 0, 4); + const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2); + const lengthTracking = new ctor(rab, 0); + const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT); + + // Write some data into the array. + const taWrite = new ctor(rab); + for (let i = 0; i < 4; ++i) { + WriteToTypedArray(taWrite, i, 2 * i); + } + + // Orig. array: [0, 2, 4, 6] + // [0, 2, 4, 6] << fixedLength + // [4, 6] << fixedLengthWithOffset + // [0, 2, 4, 6, ...] << lengthTracking + // [4, 6, ...] << lengthTrackingWithOffset + + // If fixedLength is a BigInt array, they all are BigInt Arrays. + let n2 = MayNeedBigInt(fixedLength, 2); + let n4 = MayNeedBigInt(fixedLength, 4); + + assert(fixedLength.includes(n2)); + assert(!fixedLength.includes(undefined)); + assert(fixedLength.includes(n2, 1)); + assert(!fixedLength.includes(n2, 2)); + assert(fixedLength.includes(n2, -3)); + assert(!fixedLength.includes(n2, -2)); + assert(!fixedLengthWithOffset.includes(n2)); + assert(fixedLengthWithOffset.includes(n4)); + assert(!fixedLengthWithOffset.includes(undefined)); + assert(fixedLengthWithOffset.includes(n4, 0)); + assert(!fixedLengthWithOffset.includes(n4, 1)); + assert(fixedLengthWithOffset.includes(n4, -2)); + assert(!fixedLengthWithOffset.includes(n4, -1)); + assert(lengthTracking.includes(n2)); + assert(!lengthTracking.includes(undefined)); + assert(lengthTracking.includes(n2, 1)); + assert(!lengthTracking.includes(n2, 2)); + assert(lengthTracking.includes(n2, -3)); + assert(!lengthTracking.includes(n2, -2)); + assert(!lengthTrackingWithOffset.includes(n2)); + assert(lengthTrackingWithOffset.includes(n4)); + assert(!lengthTrackingWithOffset.includes(undefined)); + assert(lengthTrackingWithOffset.includes(n4, 0)); + assert(!lengthTrackingWithOffset.includes(n4, 1)); + assert(lengthTrackingWithOffset.includes(n4, -2)); + assert(!lengthTrackingWithOffset.includes(n4, -1)); + + // Shrink so that fixed length TAs go out of bounds. + rab.resize(3 * ctor.BYTES_PER_ELEMENT); + + // Orig. array: [0, 2, 4] + // [0, 2, 4, ...] << lengthTracking + // [4, ...] << lengthTrackingWithOffset + + assert.throws(TypeError, () => { + fixedLength.includes(n2); + }); + assert.throws(TypeError, () => { + fixedLengthWithOffset.includes(n2); + }); + + assert(lengthTracking.includes(n2)); + assert(!lengthTracking.includes(undefined)); + assert(!lengthTrackingWithOffset.includes(n2)); + assert(lengthTrackingWithOffset.includes(n4)); + assert(!lengthTrackingWithOffset.includes(undefined)); + + // Shrink so that the TAs with offset go out of bounds. + rab.resize(1 * ctor.BYTES_PER_ELEMENT); + assert.throws(TypeError, () => { + fixedLength.includes(n2); + }); + assert.throws(TypeError, () => { + fixedLengthWithOffset.includes(n2); + }); + assert.throws(TypeError, () => { + lengthTrackingWithOffset.includes(n2); + }); + + // Shrink to zero. + rab.resize(0); + assert.throws(TypeError, () => { + fixedLength.includes(n2); + }); + assert.throws(TypeError, () => { + fixedLengthWithOffset.includes(n2); + }); + assert.throws(TypeError, () => { + lengthTrackingWithOffset.includes(n2); + }); + assert(!lengthTracking.includes(n2)); + assert(!lengthTracking.includes(undefined)); + + // Grow so that all TAs are back in-bounds. + rab.resize(6 * ctor.BYTES_PER_ELEMENT); + for (let i = 0; i < 6; ++i) { + WriteToTypedArray(taWrite, i, 2 * i); + } + + // Orig. array: [0, 2, 4, 6, 8, 10] + // [0, 2, 4, 6] << fixedLength + // [4, 6] << fixedLengthWithOffset + // [0, 2, 4, 6, 8, 10, ...] << lengthTracking + // [4, 6, 8, 10, ...] << lengthTrackingWithOffset + + let n8 = MayNeedBigInt(fixedLength, 8); + + assert(fixedLength.includes(n2)); + assert(!fixedLength.includes(undefined)); + assert(!fixedLength.includes(n8)); + assert(!fixedLengthWithOffset.includes(n2)); + assert(fixedLengthWithOffset.includes(n4)); + assert(!fixedLengthWithOffset.includes(undefined)); + assert(!fixedLengthWithOffset.includes(n8)); + assert(lengthTracking.includes(n2)); + assert(!lengthTracking.includes(undefined)); + assert(lengthTracking.includes(n8)); + assert(!lengthTrackingWithOffset.includes(n2)); + assert(lengthTrackingWithOffset.includes(n4)); + assert(!lengthTrackingWithOffset.includes(undefined)); + assert(lengthTrackingWithOffset.includes(n8)); +}