RAB: Integrate staging tests for the .slice method (#4174)

* Import relevant files from #3888

* Removing parts in resizableArrayBufferUtils.js and adding it in includes,
while applying review changes from PRs for previously tested methods.

* Add coerced-start-shrink test for Array.p.slice

* Renames files to add more tests for the end argument of .slice.

* Tests for the 'end' argument of .slice and test file for Array.p.slice
parallel to TypedArray.p.slice resizable-buffer.js

test/built-ins/Array/prototype/slice/coerced-start-end-grow.js

@@ -0,0 +1,56 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.slice
+description: >
+  Array.p.slice behaves correctly on TypedArrays backed by resizable buffers that
+  are grown by argument coercion.
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+// The start argument grows the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking, evil)), [
+    1,
+    2,
+    3,
+    4
+  ]);
+  assert.sameValue(rab.byteLength, 6 * ctor.BYTES_PER_ELEMENT);
+}
+
+// The end argument grows the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+
+  const evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return 5;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking,4,evil)), [
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking,3,evil)), [
+    4,
+    0
+  ]);
+  assert.sameValue(rab.byteLength, 6 * ctor.BYTES_PER_ELEMENT);
+}

test/built-ins/Array/prototype/slice/coerced-start-end-shrink.js

@@ -0,0 +1,95 @@
+// Copyright 2023 Igalia S.L. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.slice
+description: >
+  Array.p.slice behaves correctly on TypedArrays backed by resizable buffers that
+  are shrunk by argument coercion.
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+// The start argument shrinks the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength, evil)), [
+    undefined,
+    undefined,
+    undefined,
+    undefined
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength, evil)), [
+  ]);
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking, evil)), [
+    1,
+    2,
+    undefined,
+    undefined
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking, evil)), [
+    1,
+    2
+  ]);
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}
+
+// The end argument shrinks the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 3;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength, 2, evil)), [
+    undefined
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength, 2, evil)), [
+  ]);
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 3;
+    }
+  };
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking, 1, evil)), [
+    2,
+    undefined
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking, 1, evil)), [
+    2
+  ]);
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}

test/built-ins/Array/prototype/slice/resizable-buffer.js

@@ -0,0 +1,124 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.slice
+description: >
+  Array.p.slice behaves correctly on TypedArrays backed by resizable buffers.
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+  const lengthTracking = new ctor(rab, 0);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+  // Write some data into the array.
+  const taWrite = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(taWrite, i, i);
+  }
+  const fixedLengthSlice = Array.prototype.slice.call(fixedLength);
+  assert.compareArray(ToNumbers(fixedLengthSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  const fixedLengthWithOffsetSlice = Array.prototype.slice.call(fixedLengthWithOffset);
+  assert.compareArray(ToNumbers(fixedLengthWithOffsetSlice), [
+    2,
+    3
+  ]);
+  const lengthTrackingSlice = Array.prototype.slice.call(lengthTracking);
+  assert.compareArray(ToNumbers(lengthTrackingSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  const lengthTrackingWithOffsetSlice = Array.prototype.slice.call(lengthTrackingWithOffset);
+  assert.compareArray(ToNumbers(lengthTrackingWithOffsetSlice), [
+    2,
+    3
+  ]);
+
+  // Shrink so that fixed length TAs go out of bounds.
+  rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLengthWithOffset)), []);
+
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking)), [
+    0,
+    1,
+    2
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTrackingWithOffset)), [2]);
+
+  // Shrink so that the TAs with offset go out of bounds.
+  rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLengthWithOffset)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking)), [0]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTrackingWithOffset)), []);
+
+  // Shrink to zero.
+  rab.resize(0);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLengthWithOffset)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking)), []);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTrackingWithOffset)), []);
+
+  // Verify that the previously created slices aren't affected by the
+  // shrinking.
+  assert.compareArray(ToNumbers(fixedLengthSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(ToNumbers(fixedLengthWithOffsetSlice), [
+    2,
+    3
+  ]);
+  assert.compareArray(ToNumbers(lengthTrackingSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(ToNumbers(lengthTrackingWithOffsetSlice), [
+    2,
+    3
+  ]);
+
+  // Grow so that all TAs are back in-bounds. New memory is zeroed.
+  rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLength)), [
+    0,
+    0,
+    0,
+    0
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(fixedLengthWithOffset)), [
+    0,
+    0
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTracking)), [
+    0,
+    0,
+    0,
+    0,
+    0,
+    0
+  ]);
+  assert.compareArray(ToNumbers(Array.prototype.slice.call(lengthTrackingWithOffset)), [
+    0,
+    0,
+    0,
+    0
+  ]);
+}

test/built-ins/TypedArray/prototype/slice/coerced-start-end-grow.js

@@ -0,0 +1,55 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.slice
+description: >
+  TypedArray.p.slice behaves correctly on TypedArrays backed by resizable buffers
+  that is grown by argument coercion.
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+// The start argument grows the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  assert.compareArray(ToNumbers(lengthTracking.slice(evil)), [
+    1,
+    2,
+    3,
+    4
+  ]);
+  assert.sameValue(rab.byteLength, 6 * ctor.BYTES_PER_ELEMENT);
+}
+
+// The end argument grows the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+      return 5;
+    }
+  };
+  assert.compareArray(ToNumbers(lengthTracking.slice(4,evil)), [
+  ]);
+  assert.compareArray(ToNumbers(lengthTracking.slice(3,evil)), [
+    4,
+    0
+  ]);
+  assert.sameValue(rab.byteLength, 6 * ctor.BYTES_PER_ELEMENT);
+}

test/built-ins/TypedArray/prototype/slice/coerced-start-end-shrink.js

@@ -0,0 +1,86 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.slice
+description: >
+  TypedArray.p.slice behaves correctly on TypedArrays backed by resizable buffers
+  that are shrunk by argument coercion.
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+// The start argument shrinks the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  assert.throws(TypeError, () => {
+    fixedLength.slice(evil);
+  });
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 0;
+    }
+  };
+  assert.compareArray(ToNumbers(lengthTracking.slice(evil)), [
+    1,
+    2,
+    0,
+    0
+  ]);
+  assert.compareArray(ToNumbers(lengthTracking.slice(evil)), [
+    1,
+    2
+  ]);
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}
+
+// The end argument shrinks the resizable array buffer rab.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 5;
+    }
+  };
+  assert.throws(TypeError, () => {
+    fixedLength.slice(1, evil);
+  });
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(lengthTracking, i, i + 1);
+  }
+  const evil = {
+    valueOf: () => {
+      rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      return 5;
+    }
+  };
+  assert.compareArray(ToNumbers(lengthTracking.slice(1,evil)), [
+    2,
+    0,
+    0
+  ]);
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}

test/built-ins/TypedArray/prototype/slice/resizable-buffer.js

@@ -0,0 +1,144 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.slice
+description: >
+  TypedArray.p.slice behaves correctly on TypedArrays backed by resizable
+  buffers.
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+  const lengthTracking = new ctor(rab, 0);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+  // Write some data into the array.
+  const taWrite = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(taWrite, i, i);
+  }
+  const fixedLengthSlice = fixedLength.slice();
+  assert.compareArray(ToNumbers(fixedLengthSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert(!fixedLengthSlice.buffer.resizable);
+  const fixedLengthWithOffsetSlice = fixedLengthWithOffset.slice();
+  assert.compareArray(ToNumbers(fixedLengthWithOffsetSlice), [
+    2,
+    3
+  ]);
+  assert(!fixedLengthWithOffsetSlice.buffer.resizable);
+  const lengthTrackingSlice = lengthTracking.slice();
+  assert.compareArray(ToNumbers(lengthTrackingSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert(!lengthTrackingSlice.buffer.resizable);
+  const lengthTrackingWithOffsetSlice = lengthTrackingWithOffset.slice();
+  assert.compareArray(ToNumbers(lengthTrackingWithOffsetSlice), [
+    2,
+    3
+  ]);
+  assert(!lengthTrackingWithOffsetSlice.buffer.resizable);
+
+  // Shrink so that fixed length TAs go out of bounds.
+  rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+  assert.throws(TypeError, () => {
+    fixedLength.slice();
+  });
+  assert.throws(TypeError, () => {
+    fixedLengthWithOffset.slice();
+  });
+  assert.compareArray(ToNumbers(lengthTracking.slice()), [
+    0,
+    1,
+    2
+  ]);
+  assert.compareArray(ToNumbers(lengthTrackingWithOffset.slice()), [2]);
+
+  // Shrink so that the TAs with offset go out of bounds.
+  rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+  assert.throws(TypeError, () => {
+    fixedLength.slice();
+  });
+  assert.throws(TypeError, () => {
+    fixedLengthWithOffset.slice();
+  });
+  assert.compareArray(ToNumbers(lengthTracking.slice()), [0]);
+  assert.throws(TypeError, () => {
+    lengthTrackingWithOffset.slice();
+  });
+
+  // Shrink to zero.
+  rab.resize(0);
+  assert.throws(TypeError, () => {
+    fixedLength.slice();
+  });
+  assert.throws(TypeError, () => {
+    fixedLengthWithOffset.slice();
+  });
+  assert.compareArray(ToNumbers(lengthTracking.slice()), []);
+  assert.throws(TypeError, () => {
+    lengthTrackingWithOffset.slice();
+  });
+
+  // Verify that the previously created slices aren't affected by the
+  // shrinking.
+  assert.compareArray(ToNumbers(fixedLengthSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(ToNumbers(fixedLengthWithOffsetSlice), [
+    2,
+    3
+  ]);
+  assert.compareArray(ToNumbers(lengthTrackingSlice), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(ToNumbers(lengthTrackingWithOffsetSlice), [
+    2,
+    3
+  ]);
+
+  // Grow so that all TAs are back in-bounds. New memory is zeroed.
+  rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+  assert.compareArray(ToNumbers(fixedLength.slice()), [
+    0,
+    0,
+    0,
+    0
+  ]);
+  assert.compareArray(ToNumbers(fixedLengthWithOffset.slice()), [
+    0,
+    0
+  ]);
+  assert.compareArray(ToNumbers(lengthTracking.slice()), [
+    0,
+    0,
+    0,
+    0,
+    0,
+    0
+  ]);
+  assert.compareArray(ToNumbers(lengthTrackingWithOffset.slice()), [
+    0,
+    0,
+    0,
+    0
+  ]);
+}

test/built-ins/TypedArray/prototype/slice/speciesctor-resize.js

@@ -0,0 +1,129 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.slice
+description: >
+  TypedArray.p.slice behaves correctly on TypedArrays backed by resizable buffers
+  which the species constructor resizes.
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+// The corresponding test for Array.prototype.slice is not possible, since it
+// doesn't call the species constructor if the "original array" is not an Array.
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  let resizeWhenConstructorCalled = false;
+  class MyArray extends ctor {
+    constructor(...params) {
+      super(...params);
+      if (resizeWhenConstructorCalled) {
+        rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      }
+    }
+  }
+  ;
+  const fixedLength = new MyArray(rab, 0, 4);
+  resizeWhenConstructorCalled = true;
+  assert.throws(TypeError, () => {
+    fixedLength.slice();
+  });
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const taWrite = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(taWrite, i, 1);
+  }
+  let resizeWhenConstructorCalled = false;
+  class MyArray extends ctor {
+    constructor(...params) {
+      super(...params);
+      if (resizeWhenConstructorCalled) {
+        rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      }
+    }
+  }
+  ;
+  const lengthTracking = new MyArray(rab);
+  resizeWhenConstructorCalled = true;
+  const a = lengthTracking.slice();
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+  // The length of the resulting TypedArray is determined before
+  // TypedArraySpeciesCreate is called, and it doesn't change.
+  assert.sameValue(a.length, 4);
+  assert.compareArray(ToNumbers(a), [
+    1,
+    1,
+    0,
+    0
+  ]);
+}
+
+// Test that the (start, end) parameters are computed based on the original
+// length.
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const taWrite = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(taWrite, i, 1);
+  }
+  let resizeWhenConstructorCalled = false;
+  class MyArray extends ctor {
+    constructor(...params) {
+      super(...params);
+      if (resizeWhenConstructorCalled) {
+        rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+      }
+    }
+  }
+  ;
+  const lengthTracking = new MyArray(rab);
+  resizeWhenConstructorCalled = true;
+  const a = lengthTracking.slice(-3, -1);
+  assert.sameValue(rab.byteLength, 2 * ctor.BYTES_PER_ELEMENT);
+  // The length of the resulting TypedArray is determined before
+  // TypedArraySpeciesCreate is called, and it doesn't change.
+  assert.sameValue(a.length, 2);
+  assert.compareArray(ToNumbers(a), [
+    1,
+    0
+  ]);
+}
+
+// Test where the buffer gets resized "between elements".
+{
+  const rab = CreateResizableArrayBuffer(8, 16);
+  const taWrite = new Uint8Array(rab);
+  for (let i = 0; i < 8; ++i) {
+    WriteToTypedArray(taWrite, i, 255);
+  }
+  let resizeWhenConstructorCalled = false;
+  class MyArray extends Uint16Array {
+    constructor(...params) {
+      super(...params);
+      if (resizeWhenConstructorCalled) {
+        rab.resize(5);
+      }
+    }
+  }
+  ;
+  const lengthTracking = new MyArray(rab);
+  assert.compareArray(ToNumbers(lengthTracking), [
+    65535,
+    65535,
+    65535,
+    65535
+  ]);
+  resizeWhenConstructorCalled = true;
+  const a = lengthTracking.slice();
+  assert.sameValue(rab.byteLength, 5);
+  assert.sameValue(a.length, 4);
+  assert.sameValue(a[0], 65535);
+  assert.sameValue(a[1], 65535);
+  assert.sameValue(a[2], 0);
+  assert.sameValue(a[3], 0);
+}