RAB: Integrate staging tests for the .includes method

test/built-ins/Array/prototype/includes/coerced-searchelement-fromindex-resize.js

@@ -0,0 +1,92 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.includes
+description: >
+ Array.p.includes behaves correctly on TypedArrays backed by resizable buffers
+ that are resized during argument coercion.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer, Array.prototype.includes]
+---*/
+
+function MayNeedBigInt(ta, n) {
+ if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+ return BigInt(n);
+ }
+ return n;
+}
+
+for (let ctor of ctors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const fixedLength = new ctor(rab, 0, 4);
+ let evil = {
+ valueOf: () => {
+ rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+ return 0;
+ }
+ };
+ assert(!Array.prototype.includes.call(fixedLength, undefined));
+ // The TA is OOB so it includes only "undefined".
+ assert(Array.prototype.includes.call(fixedLength, undefined, evil));
+}
+for (let ctor of ctors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const fixedLength = new ctor(rab, 0, 4);
+ let evil = {
+ valueOf: () => {
+ rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+ return 0;
+ }
+ };
+ let n0 = MayNeedBigInt(fixedLength, 0);
+ assert(Array.prototype.includes.call(fixedLength, n0));
+ // The TA is OOB so it includes only "undefined".
+ assert(!Array.prototype.includes.call(fixedLength, n0, evil));
+}
+for (let ctor of ctors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const lengthTracking = new ctor(rab);
+ let evil = {
+ valueOf: () => {
+ rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+ return 0;
+ }
+ };
+ assert(!Array.prototype.includes.call(lengthTracking, undefined));
+ // "includes" iterates until the original length and sees "undefined"s.
+ assert(Array.prototype.includes.call(lengthTracking, undefined, evil));
+}
+for (let ctor of ctors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const lengthTracking = new ctor(rab);
+ for (let i = 0; i < 4; ++i) {
+ WriteToTypedArray(lengthTracking, i, 1);
+ }
+ let evil = {
+ valueOf: () => {
+ rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+ return 0;
+ }
+ };
+ let n0 = MayNeedBigInt(lengthTracking, 0);
+ assert(!Array.prototype.includes.call(lengthTracking, n0));
+ // The TA grew but we only look at the data until the original length.
+ assert(!Array.prototype.includes.call(lengthTracking, n0, evil));
+}
+for (let ctor of ctors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const lengthTracking = new ctor(rab);
+ WriteToTypedArray(lengthTracking, 0, 1);
+ let evil = {
+ valueOf: () => {
+ rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+ return -4;
+ }
+ };
+ let n1 = MayNeedBigInt(lengthTracking, 1);
+ assert(Array.prototype.includes.call(lengthTracking, n1, -4));
+ // The TA grew but the start index conversion is done based on the original
+ // length.
+ assert(Array.prototype.includes.call(lengthTracking, n1, evil));
+}

test/built-ins/Array/prototype/includes/resizable-buffer-special-float-values.js

@@ -0,0 +1,22 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%array%.prototype.includes
+description: >
+ Array.p.includes behaves correctly for special float values on float
+ TypedArrays backed by resizable buffers.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer, Array.prototype.includes]
+---*/
+
+for (let ctor of floatCtors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const lengthTracking = new ctor(rab);
+ lengthTracking[0] = -Infinity;
+ lengthTracking[1] = Infinity;
+ lengthTracking[2] = NaN;
+ assert(Array.prototype.includes.call(lengthTracking, -Infinity));
+ assert(Array.prototype.includes.call(lengthTracking, Infinity));
+ assert(Array.prototype.includes.call(lengthTracking, NaN));
+}

test/built-ins/Array/prototype/includes/resizable-buffer.js

@@ -0,0 +1,128 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.includes
+description: >
+ Array.p.includes behaves correctly on TypedArrays backed by resizable buffers.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer, Array.prototype.includes]
+---*/
+
+function MayNeedBigInt(ta, n) {
+ if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+ return BigInt(n);
+ }
+ return n;
+}
+
+for (let ctor of ctors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const fixedLength = new ctor(rab, 0, 4);
+ const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+ const lengthTracking = new ctor(rab, 0);
+ const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+ // Write some data into the array.
+ const taWrite = new ctor(rab);
+ for (let i = 0; i < 4; ++i) {
+ WriteToTypedArray(taWrite, i, 2 * i);
+ }
+
+ // Orig. array: [0, 2, 4, 6]
+ // [0, 2, 4, 6] << fixedLength
+ // [4, 6] << fixedLengthWithOffset
+ // [0, 2, 4, 6, ...] << lengthTracking
+ // [4, 6, ...] << lengthTrackingWithOffset
+
+ // If fixedLength is a BigInt array, they all are BigInt Arrays.
+ let n2 = MayNeedBigInt(fixedLength, 2);
+ let n4 = MayNeedBigInt(fixedLength, 4);
+
+ assert(Array.prototype.includes.call(fixedLength, n2));
+ assert(!Array.prototype.includes.call(fixedLength, undefined));
+ assert(Array.prototype.includes.call(fixedLength, n2, 1));
+ assert(!Array.prototype.includes.call(fixedLength, n2, 2));
+ assert(Array.prototype.includes.call(fixedLength, n2, -3));
+ assert(!Array.prototype.includes.call(fixedLength, n2, -2));
+ assert(!Array.prototype.includes.call(fixedLengthWithOffset, n2));
+ assert(Array.prototype.includes.call(fixedLengthWithOffset, n4));
+ assert(!Array.prototype.includes.call(fixedLengthWithOffset, undefined));
+ assert(Array.prototype.includes.call(fixedLengthWithOffset, n4, 0));
+ assert(!Array.prototype.includes.call(fixedLengthWithOffset, n4, 1));
+ assert(Array.prototype.includes.call(fixedLengthWithOffset, n4, -2));
+ assert(!Array.prototype.includes.call(fixedLengthWithOffset, n4, -1));
+ assert(Array.prototype.includes.call(lengthTracking, n2));
+ assert(!Array.prototype.includes.call(lengthTracking, undefined));
+ assert(Array.prototype.includes.call(lengthTracking, n2, 1));
+ assert(!Array.prototype.includes.call(lengthTracking, n2, 2));
+ assert(Array.prototype.includes.call(lengthTracking, n2, -3));
+ assert(!Array.prototype.includes.call(lengthTracking, n2, -2));
+ assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n2));
+ assert(Array.prototype.includes.call(lengthTrackingWithOffset, n4));
+ assert(!Array.prototype.includes.call(lengthTrackingWithOffset, undefined));
+ assert(Array.prototype.includes.call(lengthTrackingWithOffset, n4, 0));
+ assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n4, 1));
+ assert(Array.prototype.includes.call(lengthTrackingWithOffset, n4, -2));
+ assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n4, -1));
+
+ // Shrink so that fixed length TAs go out of bounds.
+ rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+
+ // Orig. array: [0, 2, 4]
+ // [0, 2, 4, ...] << lengthTracking
+ // [4, ...] << lengthTrackingWithOffset
+
+ assert(!Array.prototype.includes.call(fixedLength, n2));
+ assert(!Array.prototype.includes.call(fixedLengthWithOffset, n2));
+
+ assert(Array.prototype.includes.call(lengthTracking, n2));
+ assert(!Array.prototype.includes.call(lengthTracking, undefined));
+ assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n2));
+ assert(Array.prototype.includes.call(lengthTrackingWithOffset, n4));
+ assert(!Array.prototype.includes.call(lengthTrackingWithOffset, undefined));
+
+ // Shrink so that the TAs with offset go out of bounds.
+ rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+ assert(!Array.prototype.includes.call(fixedLength, n2));
+ assert(!Array.prototype.includes.call(fixedLengthWithOffset, n2));
+ assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n2));
+
+ // Shrink to zero.
+ rab.resize(0);
+ assert(!Array.prototype.includes.call(fixedLength, n2));
+ assert(!Array.prototype.includes.call(fixedLengthWithOffset, n2));
+ assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n2));
+
+ assert(!Array.prototype.includes.call(lengthTracking, n2));
+ assert(!Array.prototype.includes.call(lengthTracking, undefined));
+
+ // Grow so that all TAs are back in-bounds.
+ rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+ for (let i = 0; i < 6; ++i) {
+ WriteToTypedArray(taWrite, i, 2 * i);
+ }
+
+ // Orig. array: [0, 2, 4, 6, 8, 10]
+ // [0, 2, 4, 6] << fixedLength
+ // [4, 6] << fixedLengthWithOffset
+ // [0, 2, 4, 6, 8, 10, ...] << lengthTracking
+ // [4, 6, 8, 10, ...] << lengthTrackingWithOffset
+
+ let n8 = MayNeedBigInt(fixedLength, 8);
+
+ assert(Array.prototype.includes.call(fixedLength, n2));
+ assert(!Array.prototype.includes.call(fixedLength, undefined));
+ assert(!Array.prototype.includes.call(fixedLength, n8));
+ assert(!Array.prototype.includes.call(fixedLengthWithOffset, n2));
+ assert(Array.prototype.includes.call(fixedLengthWithOffset, n4));
+ assert(!Array.prototype.includes.call(fixedLengthWithOffset, undefined));
+ assert(!Array.prototype.includes.call(fixedLengthWithOffset, n8));
+ assert(Array.prototype.includes.call(lengthTracking, n2));
+ assert(!Array.prototype.includes.call(lengthTracking, undefined));
+ assert(Array.prototype.includes.call(lengthTracking, n8));
+ assert(!Array.prototype.includes.call(lengthTrackingWithOffset, n2));
+ assert(Array.prototype.includes.call(lengthTrackingWithOffset, n4));
+ assert(!Array.prototype.includes.call(lengthTrackingWithOffset, undefined));
+ assert(Array.prototype.includes.call(lengthTrackingWithOffset, n8));
+}

test/built-ins/TypedArray/prototype/includes/coerced-searchelement-fromindex-resize.js

@@ -0,0 +1,92 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.includes
+description: >
+ TypedArray.p.includes behaves correctly on TypedArrays backed by resizable
+ buffers that are resized during argument coercion.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer, Array.prototype.includes]
+---*/
+
+function MayNeedBigInt(ta, n) {
+ if (typeof n == 'number' && (ta instanceof BigInt64Array || ta instanceof BigUint64Array)) {
+ return BigInt(n);
+ }
+ return n;
+}
+
+for (let ctor of ctors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const fixedLength = new ctor(rab, 0, 4);
+ let evil = {
+ valueOf: () => {
+ rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+ return 0;
+ }
+ };
+ assert(!fixedLength.includes(undefined));
+ // The TA is OOB so it includes only "undefined".
+ assert(fixedLength.includes(undefined, evil));
+}
+for (let ctor of ctors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const fixedLength = new ctor(rab, 0, 4);
+ let evil = {
+ valueOf: () => {
+ rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+ return 0;
+ }
+ };
+ let n0 = MayNeedBigInt(fixedLength, 0);
+ assert(fixedLength.includes(n0));
+ // The TA is OOB so it includes only "undefined".
+ assert(!fixedLength.includes(n0, evil));
+}
+for (let ctor of ctors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const lengthTracking = new ctor(rab);
+ let evil = {
+ valueOf: () => {
+ rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+ return 0;
+ }
+ };
+ assert(!lengthTracking.includes(undefined));
+ // "includes" iterates until the original length and sees "undefined"s.
+ assert(lengthTracking.includes(undefined, evil));
+}
+for (let ctor of ctors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const lengthTracking = new ctor(rab);
+ for (let i = 0; i < 4; ++i) {
+ WriteToTypedArray(lengthTracking, i, 1);
+ }
+ let evil = {
+ valueOf: () => {
+ rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+ return 0;
+ }
+ };
+ let n0 = MayNeedBigInt(lengthTracking, 0);
+ assert(!lengthTracking.includes(n0));
+ // The TA grew but we only look at the data until the original length.
+ assert(!lengthTracking.includes(n0, evil));
+}
+for (let ctor of ctors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const lengthTracking = new ctor(rab);
+ WriteToTypedArray(lengthTracking, 0, 1);
+ let evil = {
+ valueOf: () => {
+ rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+ return -4;
+ }
+ };
+ let n1 = MayNeedBigInt(lengthTracking, 1);
+ assert(lengthTracking.includes(n1, -4));
+ // The TA grew but the start index conversion is done based on the original
+ // length.
+ assert(lengthTracking.includes(n1, evil));
+}

test/built-ins/TypedArray/prototype/includes/resizable-buffer-special-float-values.js

@@ -0,0 +1,22 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.includes
+description: >
+ TypedArray.p.includes behaves correctly for special float values when
+ receiver is a float TypedArray backed by a resizable buffer.
+includes: [resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer, Array.prototype.includes]
+---*/
+
+for (let ctor of floatCtors) {
+ const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+ const lengthTracking = new ctor(rab);
+ lengthTracking[0] = -Infinity;
+ lengthTracking[1] = Infinity;
+ lengthTracking[2] = NaN;
+ assert(lengthTracking.includes(-Infinity));
+ assert(lengthTracking.includes(Infinity));
+ assert(lengthTracking.includes(NaN));
+}