From 0fca7339eb159972bba89cd01bfb939a04d2a529 Mon Sep 17 00:00:00 2001 From: Ioanna M Dimitriou H <9728696+ioannad@users.noreply.github.com> Date: Wed, 8 May 2024 17:27:49 +0200 Subject: [PATCH] RAB: Integrate staging tests for .at method (#4070) * RAB: Integrate staging tests for .at method of Array.prototype and TypedArray.prototype This is part of PR #3888 to make reviewing easier. Includes changes to use the helper ./harness/resizableArrayBufferUtils.js --- .../prototype/at/coerced-index-resize.js | 40 ++++++++++++ .../at/typed-array-resizable-buffer.js | 56 ++++++++++++++++ .../prototype/at/coerced-index-resize.js | 41 ++++++++++++ .../prototype/at/resizable-buffer.js | 64 +++++++++++++++++++ 4 files changed, 201 insertions(+) create mode 100644 test/built-ins/Array/prototype/at/coerced-index-resize.js create mode 100644 test/built-ins/Array/prototype/at/typed-array-resizable-buffer.js create mode 100644 test/built-ins/TypedArray/prototype/at/coerced-index-resize.js create mode 100644 test/built-ins/TypedArray/prototype/at/resizable-buffer.js diff --git a/test/built-ins/Array/prototype/at/coerced-index-resize.js b/test/built-ins/Array/prototype/at/coerced-index-resize.js new file mode 100644 index 0000000000..af6b03e327 --- /dev/null +++ b/test/built-ins/Array/prototype/at/coerced-index-resize.js @@ -0,0 +1,40 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// This code is governed by the BSD license found in the LICENSE file. + +/*--- +esid: sec-array.prototype.at +description: > + Array.p.at behaves correctly on TypedArrays backed by resizable buffers when + the TypedArray is resized during parameter conversion +includes: [resizableArrayBufferUtils.js] +features: [resizable-arraybuffer] +---*/ + +function ArrayAtHelper(ta, index) { + return Array.prototype.at.call(ta, index); +} + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const fixedLength = new ctor(rab, 0, 4); + let evil = { + valueOf: () => { + rab.resize(2); + return 0; + } + }; + assert.sameValue(ArrayAtHelper(fixedLength, evil), undefined); +} + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = new ctor(rab); + let evil = { + valueOf: () => { + rab.resize(2); + return -1; + } + }; + // The TypedArray is *not* out of bounds since it's length-tracking. + assert.sameValue(ArrayAtHelper(lengthTracking, evil), undefined); +} diff --git a/test/built-ins/Array/prototype/at/typed-array-resizable-buffer.js b/test/built-ins/Array/prototype/at/typed-array-resizable-buffer.js new file mode 100644 index 0000000000..238ebab160 --- /dev/null +++ b/test/built-ins/Array/prototype/at/typed-array-resizable-buffer.js @@ -0,0 +1,56 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// This code is governed by the BSD license found in the LICENSE file. + +/*--- +esid: sec-array.prototype.at +description: > + Array.p.at behaves correctly on TypedArrays backed by resizable buffers +includes: [resizableArrayBufferUtils.js] +features: [resizable-arraybuffer] +---*/ + +function ArrayAtHelper(ta, index) { + const result = Array.prototype.at.call(ta, index); + return Convert(result); +} + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const fixedLength = new ctor(rab, 0, 4); + const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2); + const lengthTracking = new ctor(rab, 0); + const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT); + + // Write some data into the array. + let ta_write = new ctor(rab); + for (let i = 0; i < 4; ++i) { + WriteToTypedArray(ta_write, i, i); + } + assert.sameValue(ArrayAtHelper(fixedLength, -1), 3); + assert.sameValue(ArrayAtHelper(lengthTracking, -1), 3); + assert.sameValue(ArrayAtHelper(fixedLengthWithOffset, -1), 3); + assert.sameValue(ArrayAtHelper(lengthTrackingWithOffset, -1), 3); + + // Shrink so that fixed length TAs go out of bounds. + rab.resize(3 * ctor.BYTES_PER_ELEMENT); + assert.sameValue(ArrayAtHelper(fixedLength, -1), undefined); + assert.sameValue(ArrayAtHelper(fixedLengthWithOffset, -1), undefined); + assert.sameValue(ArrayAtHelper(lengthTracking, -1), 2); + + assert.sameValue(ArrayAtHelper(lengthTrackingWithOffset, -1), 2); + + // Shrink so that the TAs with offset go out of bounds. + rab.resize(1 * ctor.BYTES_PER_ELEMENT); + assert.sameValue(ArrayAtHelper(fixedLength, -1), undefined); + assert.sameValue(ArrayAtHelper(fixedLengthWithOffset, -1), undefined); + assert.sameValue(ArrayAtHelper(lengthTrackingWithOffset, -1), undefined); + + assert.sameValue(ArrayAtHelper(lengthTracking, -1), 0); + + // Grow so that all TAs are back in-bounds. New memory is zeroed. + rab.resize(6 * ctor.BYTES_PER_ELEMENT); + assert.sameValue(ArrayAtHelper(fixedLength, -1), 0); + assert.sameValue(ArrayAtHelper(lengthTracking, -1), 0); + assert.sameValue(ArrayAtHelper(fixedLengthWithOffset, -1), 0); + assert.sameValue(ArrayAtHelper(lengthTrackingWithOffset, -1), 0); +} diff --git a/test/built-ins/TypedArray/prototype/at/coerced-index-resize.js b/test/built-ins/TypedArray/prototype/at/coerced-index-resize.js new file mode 100644 index 0000000000..bb8210ef75 --- /dev/null +++ b/test/built-ins/TypedArray/prototype/at/coerced-index-resize.js @@ -0,0 +1,41 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// This code is governed by the BSD license found in the LICENSE file. + +/*--- +esid: sec-%typedarray%.prototype.at +description: > + TypedArray.p.at behaves correctly on TypedArrays backed by resizable buffers + when the TypedArray is resized during parameter conversion +includes: [resizableArrayBufferUtils.js] +features: [resizable-arraybuffer] +---*/ + +function TypedArrayAtHelper(ta, index) { + const result = ta.at(index); + return Convert(result); +} + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const fixedLength = new ctor(rab, 0, 4); + let evil = { + valueOf: () => { + rab.resize(2); + return 0; + } + }; + assert.sameValue(TypedArrayAtHelper(fixedLength, evil), undefined); +} + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const lengthTracking = new ctor(rab); + let evil = { + valueOf: () => { + rab.resize(2); + return -1; + } + }; + // The TypedArray is *not* out of bounds since it's length-tracking. + assert.sameValue(TypedArrayAtHelper(lengthTracking, evil), undefined); +} diff --git a/test/built-ins/TypedArray/prototype/at/resizable-buffer.js b/test/built-ins/TypedArray/prototype/at/resizable-buffer.js new file mode 100644 index 0000000000..6379e40332 --- /dev/null +++ b/test/built-ins/TypedArray/prototype/at/resizable-buffer.js @@ -0,0 +1,64 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// This code is governed by the BSD license found in the LICENSE file. + +/*--- +esid: sec-%typedarray%.prototype.at +description: > + TypedArray.p.at behaves correctly on TypedArrays backed by resizable buffers +includes: [resizableArrayBufferUtils.js] +features: [resizable-arraybuffer] +---*/ + +function TypedArrayAtHelper(ta, index) { + const result = ta.at(index); + return Convert(result); +} + +for (let ctor of ctors) { + const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT); + const fixedLength = new ctor(rab, 0, 4); + const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2); + const lengthTracking = new ctor(rab, 0); + const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT); + + // Write some data into the array. + let ta_write = new ctor(rab); + for (let i = 0; i < 4; ++i) { + WriteToTypedArray(ta_write, i, i); + } + assert.sameValue(TypedArrayAtHelper(fixedLength, -1), 3); + assert.sameValue(TypedArrayAtHelper(lengthTracking, -1), 3); + assert.sameValue(TypedArrayAtHelper(fixedLengthWithOffset, -1), 3); + assert.sameValue(TypedArrayAtHelper(lengthTrackingWithOffset, -1), 3); + + // Shrink so that fixed length TAs go out of bounds. + rab.resize(3 * ctor.BYTES_PER_ELEMENT); + assert.throws(TypeError, () => { + TypedArrayAtHelper(fixedLength, -1); + }); + assert.throws(TypeError, () => { + TypedArrayAtHelper(fixedLengthWithOffset, -1); + }); + assert.sameValue(TypedArrayAtHelper(lengthTracking, -1), 2); + assert.sameValue(TypedArrayAtHelper(lengthTrackingWithOffset, -1), 2); + + // Shrink so that the TAs with offset go out of bounds. + rab.resize(1 * ctor.BYTES_PER_ELEMENT); + assert.throws(TypeError, () => { + TypedArrayAtHelper(fixedLength, -1); + }); + assert.throws(TypeError, () => { + TypedArrayAtHelper(fixedLengthWithOffset, -1); + }); + assert.throws(TypeError, () => { + TypedArrayAtHelper(lengthTrackingWithOffset, -1); + }); + assert.sameValue(TypedArrayAtHelper(lengthTracking, -1), 0); + + // Grow so that all TAs are back in-bounds. New memory is zeroed. + rab.resize(6 * ctor.BYTES_PER_ELEMENT); + assert.sameValue(TypedArrayAtHelper(fixedLength, -1), 0); + assert.sameValue(TypedArrayAtHelper(lengthTracking, -1), 0); + assert.sameValue(TypedArrayAtHelper(fixedLengthWithOffset, -1), 0); + assert.sameValue(TypedArrayAtHelper(lengthTrackingWithOffset, -1), 0); +}