RAB: Integrate staging tests for .at method (#4070)

* RAB: Integrate staging tests for .at method
of Array.prototype and TypedArray.prototype

This is part of PR #3888 to make reviewing easier.
Includes changes to use the helper ./harness/resizableArrayBufferUtils.js

test/built-ins/Array/prototype/at/coerced-index-resize.js

@@ -0,0 +1,40 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.at
+description: >
+  Array.p.at behaves correctly on TypedArrays backed by resizable buffers when
+  the TypedArray is resized during parameter conversion
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function ArrayAtHelper(ta, index) {
+  return Array.prototype.at.call(ta, index);
+}
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  let evil = {
+    valueOf: () => {
+      rab.resize(2);
+      return 0;
+    }
+  };
+  assert.sameValue(ArrayAtHelper(fixedLength, evil), undefined);
+}
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  let evil = {
+    valueOf: () => {
+      rab.resize(2);
+      return -1;
+    }
+  };
+  // The TypedArray is *not* out of bounds since it's length-tracking.
+  assert.sameValue(ArrayAtHelper(lengthTracking, evil), undefined);
+}

test/built-ins/Array/prototype/at/typed-array-resizable-buffer.js

@@ -0,0 +1,56 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.at
+description: >
+  Array.p.at behaves correctly on TypedArrays backed by resizable buffers
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function ArrayAtHelper(ta, index) {
+  const result = Array.prototype.at.call(ta, index);
+  return Convert(result);
+}
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+  const lengthTracking = new ctor(rab, 0);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+  // Write some data into the array.
+  let ta_write = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(ta_write, i, i);
+  }
+  assert.sameValue(ArrayAtHelper(fixedLength, -1), 3);
+  assert.sameValue(ArrayAtHelper(lengthTracking, -1), 3);
+  assert.sameValue(ArrayAtHelper(fixedLengthWithOffset, -1), 3);
+  assert.sameValue(ArrayAtHelper(lengthTrackingWithOffset, -1), 3);
+
+  // Shrink so that fixed length TAs go out of bounds.
+  rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+  assert.sameValue(ArrayAtHelper(fixedLength, -1), undefined);
+  assert.sameValue(ArrayAtHelper(fixedLengthWithOffset, -1), undefined);
+  assert.sameValue(ArrayAtHelper(lengthTracking, -1), 2);
+
+  assert.sameValue(ArrayAtHelper(lengthTrackingWithOffset, -1), 2);
+
+  // Shrink so that the TAs with offset go out of bounds.
+  rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+  assert.sameValue(ArrayAtHelper(fixedLength, -1), undefined);
+  assert.sameValue(ArrayAtHelper(fixedLengthWithOffset, -1), undefined);
+  assert.sameValue(ArrayAtHelper(lengthTrackingWithOffset, -1), undefined);
+
+  assert.sameValue(ArrayAtHelper(lengthTracking, -1), 0);
+
+  // Grow so that all TAs are back in-bounds. New memory is zeroed.
+  rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+  assert.sameValue(ArrayAtHelper(fixedLength, -1), 0);
+  assert.sameValue(ArrayAtHelper(lengthTracking, -1), 0);
+  assert.sameValue(ArrayAtHelper(fixedLengthWithOffset, -1), 0);
+  assert.sameValue(ArrayAtHelper(lengthTrackingWithOffset, -1), 0);
+}

test/built-ins/TypedArray/prototype/at/coerced-index-resize.js

@@ -0,0 +1,41 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.at
+description: >
+  TypedArray.p.at behaves correctly on TypedArrays backed by resizable buffers
+  when the TypedArray is resized during parameter conversion
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function TypedArrayAtHelper(ta, index) {
+  const result = ta.at(index);
+  return Convert(result);
+}
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  let evil = {
+    valueOf: () => {
+      rab.resize(2);
+      return 0;
+    }
+  };
+  assert.sameValue(TypedArrayAtHelper(fixedLength, evil), undefined);
+}
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  let evil = {
+    valueOf: () => {
+      rab.resize(2);
+      return -1;
+    }
+  };
+  // The TypedArray is *not* out of bounds since it's length-tracking.
+  assert.sameValue(TypedArrayAtHelper(lengthTracking, evil), undefined);
+}

test/built-ins/TypedArray/prototype/at/resizable-buffer.js

@@ -0,0 +1,64 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.at
+description: >
+  TypedArray.p.at behaves correctly on TypedArrays backed by resizable buffers
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+function TypedArrayAtHelper(ta, index) {
+  const result = ta.at(index);
+  return Convert(result);
+}
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+  const lengthTracking = new ctor(rab, 0);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+  // Write some data into the array.
+  let ta_write = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(ta_write, i, i);
+  }
+  assert.sameValue(TypedArrayAtHelper(fixedLength, -1), 3);
+  assert.sameValue(TypedArrayAtHelper(lengthTracking, -1), 3);
+  assert.sameValue(TypedArrayAtHelper(fixedLengthWithOffset, -1), 3);
+  assert.sameValue(TypedArrayAtHelper(lengthTrackingWithOffset, -1), 3);
+
+  // Shrink so that fixed length TAs go out of bounds.
+  rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+  assert.throws(TypeError, () => {
+    TypedArrayAtHelper(fixedLength, -1);
+  });
+  assert.throws(TypeError, () => {
+    TypedArrayAtHelper(fixedLengthWithOffset, -1);
+  });
+  assert.sameValue(TypedArrayAtHelper(lengthTracking, -1), 2);
+  assert.sameValue(TypedArrayAtHelper(lengthTrackingWithOffset, -1), 2);
+
+  // Shrink so that the TAs with offset go out of bounds.
+  rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+  assert.throws(TypeError, () => {
+    TypedArrayAtHelper(fixedLength, -1);
+  });
+  assert.throws(TypeError, () => {
+    TypedArrayAtHelper(fixedLengthWithOffset, -1);
+  });
+  assert.throws(TypeError, () => {
+    TypedArrayAtHelper(lengthTrackingWithOffset, -1);
+  });
+  assert.sameValue(TypedArrayAtHelper(lengthTracking, -1), 0);
+
+  // Grow so that all TAs are back in-bounds. New memory is zeroed.
+  rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+  assert.sameValue(TypedArrayAtHelper(fixedLength, -1), 0);
+  assert.sameValue(TypedArrayAtHelper(lengthTracking, -1), 0);
+  assert.sameValue(TypedArrayAtHelper(fixedLengthWithOffset, -1), 0);
+  assert.sameValue(TypedArrayAtHelper(lengthTrackingWithOffset, -1), 0);
+}