RAB: Integrate staging tests for the .lastIndexOf method

test/built-ins/Array/prototype/lastIndexOf/coerced-position-grow.js

@@ -0,0 +1,57 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.lastindexof
+description: >
+  Array.p.lastIndexOf behaves correctly when the resizable buffer is grown by
+  argument coercion.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function MayNeedBigInt(ta, n) {
+  if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+    return BigInt(n);
+  }
+  return n;
+}
+
+// Growing + length-tracking TA.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, 1);
+  }
+  let evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return -1;
+    }
+  };
+  let n0 = MayNeedBigInt(lengthTracking, 0);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n0), -1);
+  // Because lastIndexOf iterates from the given index downwards, it's not
+  // possible to test that "we only look at the data until the original
+  // length" without also testing that the index conversion happening with the
+  // original length.
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n0, evil), -1);
+}
+
+// Growing + length-tracking TA, index conversion.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  let evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return -4;
+    }
+  };
+  let n0 = MayNeedBigInt(lengthTracking, 0);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n0, -4), 0);
+  // The TA grew but the start index conversion is done based on the original
+  // length.
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n0, evil), 0);
+}

test/built-ins/Array/prototype/lastIndexOf/coerced-position-shrink.js

@@ -0,0 +1,66 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.lastindexof
+description: >
+  Array.p.lastIndexOf behaves correctly when the resizable buffer is shrunk by
+  argument coercion.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function MayNeedBigInt(ta, n) {
+  if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+    return BigInt(n);
+  }
+  return n;
+}
+
+// Shrinking + fixed-length TA.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  let evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 2;
+    }
+  };
+  let n = MayNeedBigInt(fixedLength, 0);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n), 3);
+  // The TA is OOB so lastIndexOf returns -1.
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n, evil), -1);
+}
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  let evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 2;
+    }
+  };
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, MayNeedBigInt(fixedLength, 0)), 3);
+  // The TA is OOB so lastIndexOf returns -1, also for undefined).
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, undefined, evil), -1);
+}
+
+// Shrinking + length-tracking TA.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i);
+  }
+  let evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 2;
+    }
+  };
+  let n = MayNeedBigInt(lengthTracking, 2);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n), 2);
+  // 2 no longer found.
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n, evil), -1);
+}

test/built-ins/Array/prototype/lastIndexOf/resizable-buffer.js

@@ -0,0 +1,132 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.lastindexof
+description: >
+  Array.p.lastIndexOf behaves correctly on TypedArrays backed by resizable
+  buffers.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function MayNeedBigInt(ta, n) {
+  if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+    return BigInt(n);
+  }
+  return n;
+}
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+  const lengthTracking = new ctor(rab, 0);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+  // Write some data into the array.
+  const taWrite = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(taWrite, i, Math.floor(i / 2));
+  }
+
+  // Orig. array: [0, 0, 1, 1]
+  //              [0, 0, 1, 1] << fixedLength
+  //                    [1, 1] << fixedLengthWithOffset
+  //              [0, 0, 1, 1, ...] << lengthTracking
+  //                    [1, 1, ...] << lengthTrackingWithOffset
+
+  // If fixedLength is a BigInt array, they all are BigInt Arrays.
+  let n0 = MayNeedBigInt(fixedLength, 0);
+  let n1 = MayNeedBigInt(fixedLength, 1);
+
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n0), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n0, 1), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n0, 2), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n0, -2), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n0, -3), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n1, 1), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n1, -2), 2);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n1, -3), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, undefined), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, n1), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, n1, -2), 0);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, n1, -1), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, undefined), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n0), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n0, 2), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n0, -3), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n1, 1), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n1, 2), 2);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n1, -3), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, undefined), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n1), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n1, 1), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n1, -2), 0);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n1, -1), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, undefined), -1);
+
+  // Shrink so that fixed length TAs go out of bounds.
+  rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+
+  // Orig. array: [0, 0, 1]
+  //              [0, 0, 1, ...] << lengthTracking
+  //                    [1, ...] << lengthTrackingWithOffset
+
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n1), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, n1), -1);
+
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n0), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, undefined), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n1), 0);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, undefined), -1);
+
+  // Shrink so that the TAs with offset go out of bounds.
+  rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n0), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n0), -1);
+
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n0), 0);
+
+  // Shrink to zero.
+  rab.resize(0);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n0), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n0), -1);
+
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n0), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, undefined), -1);
+
+  // Grow so that all TAs are back in-bounds.
+  rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+  for (let i = 0; i < 6; ++i) {
+    WriteToTypedArray(taWrite, i, Math.floor(i / 2));
+  }
+
+  // Orig. array: [0, 0, 1, 1, 2, 2]
+  //              [0, 0, 1, 1] << fixedLength
+  //                    [1, 1] << fixedLengthWithOffset
+  //              [0, 0, 1, 1, 2, 2, ...] << lengthTracking
+  //                    [1, 1, 2, 2, ...] << lengthTrackingWithOffset
+
+  let n2 = MayNeedBigInt(fixedLength, 2);
+
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n1), 3);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, n2), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLength, undefined), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, n1), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, n2), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(fixedLengthWithOffset, undefined), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n1), 3);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, n2), 5);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTracking, undefined), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n0), -1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n1), 1);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, n2), 3);
+  assert.sameValue(Array.prototype.lastIndexOf.call(lengthTrackingWithOffset, undefined), -1);
+}

test/built-ins/TypedArray/prototype/lastIndexOf/coerced-position-grow.js

@@ -0,0 +1,57 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.lastindexof
+description: >
+  TypedArray.p.lastIndexOf behaves correctly on TypedArrays backed by resizable
+  buffers that are grown by argument coercion.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function MayNeedBigInt(ta, n) {
+  if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+    return BigInt(n);
+  }
+  return n;
+}
+
+// Growing + length-tracking TA.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, 1);
+  }
+  let evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return -1;
+    }
+  };
+  let n0 = MayNeedBigInt(lengthTracking, 0);
+  assert.sameValue(lengthTracking.lastIndexOf(n0), -1);
+  // Because lastIndexOf iterates from the given index downwards, it's not
+  // possible to test that "we only look at the data until the original
+  // length" without also testing that the index conversion happening with the
+  // original length.
+  assert.sameValue(lengthTracking.lastIndexOf(n0, evil), -1);
+}
+
+// Growing + length-tracking TA, index conversion.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  let evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return -4;
+    }
+  };
+  let n0 = MayNeedBigInt(lengthTracking, 0);
+  assert.sameValue(lengthTracking.lastIndexOf(n0, -4), 0);
+  // The TA grew but the start index conversion is done based on the original
+  // length.
+  assert.sameValue(lengthTracking.lastIndexOf(n0, evil), 0);
+}

test/built-ins/TypedArray/prototype/lastIndexOf/coerced-position-shrink.js

@@ -0,0 +1,67 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.lastindexof
+description: >
+  TypedArray.p.lastIndexOf behaves correctly on TypedArrays backed by resizable
+  buffers that are shrunk by argument coercion.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function MayNeedBigInt(ta, n) {
+  if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+    return BigInt(n);
+  }
+  return n;
+}
+
+// Shrinking + fixed-length TA.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  let evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 2;
+    }
+  };
+  let n0 = MayNeedBigInt(fixedLength, 0);
+  assert.sameValue(fixedLength.lastIndexOf(n0), 3);
+  // The TA is OOB so lastIndexOf returns -1.
+  assert.sameValue(fixedLength.lastIndexOf(n0, evil), -1);
+}
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  let evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 2;
+    }
+  };
+  let n0 = MayNeedBigInt(fixedLength, 0);
+  assert.sameValue(fixedLength.lastIndexOf(n0), 3);
+  // The TA is OOB so lastIndexOf returns -1, also for undefined).
+  assert.sameValue(fixedLength.lastIndexOf(undefined, evil), -1);
+}
+
+// Shrinking + length-tracking TA.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i);
+  }
+  let evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 2;
+    }
+  };
+  let n2 = MayNeedBigInt(lengthTracking, 2);
+  assert.sameValue(lengthTracking.lastIndexOf(n2), 2);
+  // 2 no longer found.
+  assert.sameValue(lengthTracking.lastIndexOf(n2, evil), -1);
+}