Skip to content

Commit

Permalink
Import relevant files from tc39#3888
Browse files Browse the repository at this point in the history
  • Loading branch information
ioannad authored and ptomato committed Aug 13, 2024
1 parent 7608bfb commit db8c1ad
Show file tree
Hide file tree
Showing 5 changed files with 684 additions and 0 deletions.
97 changes: 97 additions & 0 deletions test/built-ins/Array/prototype/slice/coerced-start-grow.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,97 @@
// Copyright 2023 the V8 project authors. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.

/*---
esid: sec-array.prototype.slice
description: >
Array.p.slice behaves correctly when the receiver is backed by
resizable buffer that is grown by argument coercion
includes: [compareArray.js]
features: [resizable-arraybuffer]
---*/

class MyUint8Array extends Uint8Array {
}

class MyFloat32Array extends Float32Array {
}

class MyBigInt64Array extends BigInt64Array {
}

const builtinCtors = [
Uint8Array,
Int8Array,
Uint16Array,
Int16Array,
Uint32Array,
Int32Array,
Float32Array,
Float64Array,
Uint8ClampedArray,
BigUint64Array,
BigInt64Array
];

const ctors = [
...builtinCtors,
MyUint8Array,
MyFloat32Array,
MyBigInt64Array
];

function CreateResizableArrayBuffer(byteLength, maxByteLength) {
return new ArrayBuffer(byteLength, { maxByteLength: maxByteLength });
}

function WriteToTypedArray(array, index, value) {
if (array instanceof BigInt64Array || array instanceof BigUint64Array) {
array[index] = BigInt(value);
} else {
array[index] = value;
}
}

function Convert(item) {
if (typeof item == 'bigint') {
return Number(item);
}
return item;
}

function ToNumbers(array) {
let result = [];
for (let item of array) {
result.push(Convert(item));
}
return result;
}

const ArraySliceHelper = (ta, ...rest) => {
return Array.prototype.slice.call(ta, ...rest);
};

function SliceParameterConversionGrows() {
for (let ctor of ctors) {
const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
const lengthTracking = new ctor(rab);
for (let i = 0; i < 4; ++i) {
WriteToTypedArray(lengthTracking, i, i + 1);
}
const evil = {
valueOf: () => {
rab.resize(6 * ctor.BYTES_PER_ELEMENT);
return 0;
}
};
assert.compareArray(ToNumbers(ArraySliceHelper(lengthTracking, evil)), [
1,
2,
3,
4
]);
assert.sameValue(rab.byteLength, 6 * ctor.BYTES_PER_ELEMENT);
}
}

SliceParameterConversionGrows();
97 changes: 97 additions & 0 deletions test/built-ins/TypedArray/prototype/slice/coerced-start-grow.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,97 @@
// Copyright 2023 the V8 project authors. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.

/*---
esid: sec-%typedarray%.prototype.slice
description: >
TypedArray.p.slice behaves correctly when the receiver is backed by
resizable buffer that is grown by argument coercion
includes: [compareArray.js]
features: [resizable-arraybuffer]
---*/

class MyUint8Array extends Uint8Array {
}

class MyFloat32Array extends Float32Array {
}

class MyBigInt64Array extends BigInt64Array {
}

const builtinCtors = [
Uint8Array,
Int8Array,
Uint16Array,
Int16Array,
Uint32Array,
Int32Array,
Float32Array,
Float64Array,
Uint8ClampedArray,
BigUint64Array,
BigInt64Array
];

const ctors = [
...builtinCtors,
MyUint8Array,
MyFloat32Array,
MyBigInt64Array
];

function CreateResizableArrayBuffer(byteLength, maxByteLength) {
return new ArrayBuffer(byteLength, { maxByteLength: maxByteLength });
}

function WriteToTypedArray(array, index, value) {
if (array instanceof BigInt64Array || array instanceof BigUint64Array) {
array[index] = BigInt(value);
} else {
array[index] = value;
}
}

function Convert(item) {
if (typeof item == 'bigint') {
return Number(item);
}
return item;
}

function ToNumbers(array) {
let result = [];
for (let item of array) {
result.push(Convert(item));
}
return result;
}

const TypedArraySliceHelper = (ta, ...rest) => {
return ta.slice(...rest);
};

function SliceParameterConversionGrows() {
for (let ctor of ctors) {
const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
const lengthTracking = new ctor(rab);
for (let i = 0; i < 4; ++i) {
WriteToTypedArray(lengthTracking, i, i + 1);
}
const evil = {
valueOf: () => {
rab.resize(6 * ctor.BYTES_PER_ELEMENT);
return 0;
}
};
assert.compareArray(ToNumbers(TypedArraySliceHelper(lengthTracking, evil)), [
1,
2,
3,
4
]);
assert.sameValue(rab.byteLength, 6 * ctor.BYTES_PER_ELEMENT);
}
}

SliceParameterConversionGrows();
103 changes: 103 additions & 0 deletions test/built-ins/TypedArray/prototype/slice/coerced-start-shrink.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,103 @@
// Copyright 2023 the V8 project authors. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.

/*---
esid: sec-%typedarray%.prototype.slice
description: >
TypedArray.p.slice behaves correctly when the receiver is backed by
resizable buffer that is shrunk by argument coercion
includes: [compareArray.js]
features: [resizable-arraybuffer]
---*/

class MyUint8Array extends Uint8Array {
}

class MyFloat32Array extends Float32Array {
}

class MyBigInt64Array extends BigInt64Array {
}

const builtinCtors = [
Uint8Array,
Int8Array,
Uint16Array,
Int16Array,
Uint32Array,
Int32Array,
Float32Array,
Float64Array,
Uint8ClampedArray,
BigUint64Array,
BigInt64Array
];

const ctors = [
...builtinCtors,
MyUint8Array,
MyFloat32Array,
MyBigInt64Array
];

function CreateResizableArrayBuffer(byteLength, maxByteLength) {
return new ArrayBuffer(byteLength, { maxByteLength: maxByteLength });
}

function WriteToTypedArray(array, index, value) {
if (array instanceof BigInt64Array || array instanceof BigUint64Array) {
array[index] = BigInt(value);
} else {
array[index] = value;
}
}

function Convert(item) {
if (typeof item == 'bigint') {
return Number(item);
}
return item;
}

function ToNumbers(array) {
let result = [];
for (let item of array) {
result.push(Convert(item));
}
return result;
}

for (let ctor of ctors) {
const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
const fixedLength = new ctor(rab, 0, 4);
const evil = {
valueOf: () => {
rab.resize(2 * ctor.BYTES_PER_ELEMENT);
return 0;
}
};
assert.throws(TypeError, () => {
fixedLength.slice(evil);
});
assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
}
for (let ctor of ctors) {
const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
const lengthTracking = new ctor(rab);
for (let i = 0; i < 4; ++i) {
WriteToTypedArray(lengthTracking, i, i + 1);
}
const evil = {
valueOf: () => {
rab.resize(2 * ctor.BYTES_PER_ELEMENT);
return 0;
}
};
assert.compareArray(ToNumbers(lengthTracking.slice(evil)), [
1,
2,
0,
0
]);
assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
}
Loading

0 comments on commit db8c1ad

Please sign in to comment.