RAB: Integrate staging tests for the .slice method

test/built-ins/Array/prototype/slice/coerced-start-end-grow.js

@@ -0,0 +1,56 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.slice
+description: >
+  Array.p.slice behaves correctly on TypedArrays backed by resizable buffers that
+  are grown by argument coercion.
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+// The start argument grows the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking, evil)), [
+    1,
+    2,
+    3,
+    4
+  ]);
+  assert.sameValue(rab.byteLength, 6 * ctor.BYTES_PER_ELEMENT);
+}
+
+// The end argument grows the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+
+  const evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return 5;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking,4,evil)), [
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking,3,evil)), [
+    4,
+    0
+  ]);
+  assert.sameValue(rab.byteLength, 6 * ctor.BYTES_PER_ELEMENT);
+}

test/built-ins/Array/prototype/slice/coerced-start-end-shrink.js

@@ -0,0 +1,95 @@
+// Copyright 2023 Igalia S.L. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.slice
+description: >
+  Array.p.slice behaves correctly on TypedArrays backed by resizable buffers that
+  are shrunk by argument coercion.
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+// The start argument shrinks the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength, evil)), [
+    undefined,
+    undefined,
+    undefined,
+    undefined
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength, evil)), [
+  ]);
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking, evil)), [
+    1,
+    2,
+    undefined,
+    undefined
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking, evil)), [
+    1,
+    2
+  ]);
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}
+
+// The end argument shrinks the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 3;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength, 2, evil)), [
+    undefined
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength, 2, evil)), [
+  ]);
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 3;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking, 1, evil)), [
+    2,
+    undefined
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking, 1, evil)), [
+    2
+  ]);
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}

test/built-ins/Array/prototype/slice/resizable-buffer.js

@@ -0,0 +1,124 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.slice
+description: >
+  Array.p.slice behaves correctly on TypedArrays backed by resizable buffers.
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+  const lengthTracking = new ctor(rab, 0);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+  // Write some data into the array.
+  const taWrite = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(taWrite, i, i);
+  }
+  const fixedLengthSlice = Array.prototype.slice.call(fixedLength);
+  assert.compareArray(ToNumbers(fixedLengthSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  const fixedLengthWithOffsetSlice = Array.prototype.slice.call(fixedLengthWithOffset);
+  assert.compareArray(ToNumbers(fixedLengthWithOffsetSlice), [
+    2,
+    3
+  ]);
+  const lengthTrackingSlice = Array.prototype.slice.call(lengthTracking);
+  assert.compareArray(ToNumbers(lengthTrackingSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  const lengthTrackingWithOffsetSlice = Array.prototype.slice.call(lengthTrackingWithOffset);
+  assert.compareArray(ToNumbers(lengthTrackingWithOffsetSlice), [
+    2,
+    3
+  ]);
+
+  // Shrink so that fixed length TAs go out of bounds.
+  rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLengthWithOffset)), []);
+
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking)), [
+    0,
+    1,
+    2
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTrackingWithOffset)), [2]);
+
+  // Shrink so that the TAs with offset go out of bounds.
+  rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLengthWithOffset)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking)), [0]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTrackingWithOffset)), []);
+
+  // Shrink to zero.
+  rab.resize(0);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLengthWithOffset)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTrackingWithOffset)), []);
+
+  // Verify that the previously created slices aren't affected by the
+  // shrinking.
+  assert.compareArray(ToNumbers(fixedLengthSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(ToNumbers(fixedLengthWithOffsetSlice), [
+    2,
+    3
+  ]);
+  assert.compareArray(ToNumbers(lengthTrackingSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(ToNumbers(lengthTrackingWithOffsetSlice), [
+    2,
+    3
+  ]);
+
+  // Grow so that all TAs are back in-bounds. New memory is zeroed.
+  rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength)), [
+    0,
+    0,
+    0,
+    0
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLengthWithOffset)), [
+    0,
+    0
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking)), [
+    0,
+    0,
+    0,
+    0,
+    0,
+    0
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTrackingWithOffset)), [
+    0,
+    0,
+    0,
+    0
+  ]);
+}

test/built-ins/TypedArray/prototype/slice/coerced-start-end-grow.js

@@ -0,0 +1,55 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.slice
+description: >
+  TypedArray.p.slice behaves correctly on TypedArrays backed by resizable buffers
+  that is grown by argument coercion.
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+// The start argument grows the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  assert.compareArray(ToNumbers(lengthTracking.slice(evil)), [
+    1,
+    2,
+    3,
+    4
+  ]);
+  assert.sameValue(rab.byteLength, 6 * ctor.BYTES_PER_ELEMENT);
+}
+
+// The end argument grows the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return 5;
+    }
+  };
+  assert.compareArray(ToNumbers(lengthTracking.slice(4,evil)), [
+  ]);
+  assert.compareArray(ToNumbers(lengthTracking.slice(3,evil)), [
+    4,
+    0
+  ]);
+  assert.sameValue(rab.byteLength, 6 * ctor.BYTES_PER_ELEMENT);
+}