[change-array-by-copy] Implement TypedArray.prototype.toSpliced

Bug: v8:12764
Change-Id: I5f915d1c4dad22f1ce12423f6149a85ad32d6725
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3733043
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81477}

BUILD.bazel

@@ -887,6 +887,7 @@ filegroup(
         "src/builtins/typed-array-sort.tq",
         "src/builtins/typed-array-subarray.tq",
         "src/builtins/typed-array-to-reversed.tq",
+        "src/builtins/typed-array-to-spliced.tq",
         "src/builtins/typed-array-values.tq",
         "src/builtins/typed-array-with.tq",
         "src/builtins/typed-array.tq",

BUILD.gn

@@ -1793,6 +1793,7 @@ torque_files = [
   "src/builtins/typed-array-sort.tq",
   "src/builtins/typed-array-subarray.tq",
   "src/builtins/typed-array-to-reversed.tq",
+  "src/builtins/typed-array-to-spliced.tq",
   "src/builtins/typed-array-values.tq",
   "src/builtins/typed-array-with.tq",
   "src/builtins/typed-array.tq",

src/builtins/typed-array-to-spliced.tq

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace typed_array {
+const kBuiltinNameToSpliced: constexpr string =
+    '%TypedArray%.prototype.toSpliced';
+
+transitioning macro SlowTypedArrayToSplicedContinuation(
+    implicit context: Context)(
+    accessor: TypedArrayAccessor, array: JSTypedArray, arrayLength: uintptr,
+    copy: JSTypedArray, newLen: uintptr, actualStart: uintptr,
+    actualDeleteCount: uintptr, insertCount: uintptr): void {
+  // 17. Let i be 0.
+  let i: uintptr = 0;
+
+  // 18. Let r be actualStart + actualDeleteCount.
+  let r: uintptr = actualStart + actualDeleteCount;
+
+  // 19. Repeat, while i < actualStart,
+  while (i < actualStart) {
+    // a. Let Pi be ! ToString(𝔽(i)).
+    // b. Let iValue be ! Get(O, Pi).
+    let iValue: JSAny;
+    if (i < arrayLength) {
+      iValue = accessor.LoadNumeric(array, i);
+    } else {
+      iValue = Undefined;
+    }
+
+    // c. Perform ! Set(target, Pi, iValue, true).
+    accessor.StoreJSAny(context, copy, i, iValue) otherwise unreachable;
+
+    // d. Set i to i + 1.
+    ++i;
+  }
+
+  // 20. For each element E of convertedItems, do
+  //   a. Let Pi be ! ToString(𝔽(i)).
+  //   b. Perform ! Set(A, Pi, E, true).
+  //   c. Set i to i + 1.
+  //
+  // Copying already done, just increment i.
+  i += insertCount;
+
+  // 21. Repeat, while i < newLen,
+  while (i < newLen) {
+    // a. Let Pi be ! ToString(𝔽(i)).
+    // b. Let from be ! ToString(𝔽(r)).
+    // c. Let fromValue be ! Get(O, from).
+    let fromValue: JSAny;
+    if (r < arrayLength) {
+      fromValue = accessor.LoadNumeric(array, r);
+    } else {
+      fromValue = Undefined;
+    }
+
+    // d. Perform ! Set(A, Pi, fromValue, true).
+    accessor.StoreJSAny(context, copy, i, fromValue) otherwise unreachable;
+
+    // e. Set i to i + 1.
+    ++i;
+
+    // f. Set r to r + 1.
+    ++r;
+  }
+}
+
+// https://tc39.es/proposal-change-array-by-copy/#sec-%typedarray%.prototype.toSpliced
+transitioning javascript builtin TypedArrayPrototypeToSpliced(
+    js-implicit context: NativeContext, receiver: JSAny)(...arguments): JSAny {
+  try {
+    const start = arguments[0];
+    const deleteCount = arguments[1];
+
+    // 1. Let O be the this value.
+    // 2. Perform ? ValidateTypedArray(O).
+    // 3. Let getBufferByteLength be
+    //    MakeIdempotentArrayBufferByteLengthGetter(SeqCst).
+    // 4. Let len be IntegerIndexedObjectLength(O, getBufferByteLength).
+    const array: JSTypedArray =
+        Cast<JSTypedArray>(receiver) otherwise NotTypedArray;
+    let attachedArrayAndLength = EnsureAttachedAndReadLength(array)
+        otherwise IsDetachedOrOutOfBounds;
+    const originalLength = attachedArrayAndLength.length;
+
+    // 5. Let relativeStart be ? ToIntegerOrInfinity(start).
+    const relativeStart: Number = ToInteger_Inline(start);
+
+    // 6. If relativeStart is -∞, let actualStart be 0.
+    // 7. Else if relativeStart < 0, let actualStart be
+    //    max(len + relativeStart, 0).
+    // 8. Else, let actualStart be min(relativeStart, len).
+    const actualStart =
+        ConvertAndClampRelativeIndex(relativeStart, originalLength);
+
+    // 9. Let insertCount be the number of elements in items.
+    let insertCount: uintptr;
+
+    let actualDeleteCount: uintptr;
+    if (arguments.length == 0) {
+      // 10. If start is not present, then
+      //   a. Let actualDeleteCount be 0.
+      actualDeleteCount = 0;
+      insertCount = 0;
+    } else if (arguments.length == 1) {
+      // 11. Else if deleteCount is not present, then
+      //   a. Let actualDeleteCount be len - actualStart.
+      actualDeleteCount = originalLength - actualStart;
+      insertCount = 0;
+    } else {
+      // 12. Else,
+      //   a. Let dc be ? ToIntegerOrInfinity(deleteCount).
+      //   b. Let actualDeleteCount be the result of clamping dc between 0 and
+      //      len - actualStart.
+      actualDeleteCount = ConvertAndClampRelativeIndex(
+          deleteCount, originalLength - actualStart);
+      insertCount = Convert<uintptr>(arguments.length - 2);
+    }
+
+    // 13. Let convertedItems be a new empty List.
+    const accessor: TypedArrayAccessor =
+        GetTypedArrayAccessor(array.elements_kind);
+
+    // (Step 14 done below, because use of an intermediate list is
+    // unobservable).
+
+    // 15. Let newLen be len + insertCount - actualDeleteCount.
+    const newLen = originalLength + insertCount - actualDeleteCount;
+
+    // 16. Let A be ? TypedArrayCreateSameType(O, « 𝔽(newLen) »).
+    const copy = TypedArrayCreateSameType(array, newLen);
+
+    // 14. For each element E of items, do
+    for (let k: uintptr = 0; k < insertCount; k++) {
+      // a. If O.[[ContentType]] is BigInt, let convertedValue be ? ToBigInt(E).
+      // b. Else, let convertedValue be ? ToNumber(E).
+      // c. Append convertedValue as the last element of convertedItems.
+      accessor.StoreJSAny(
+          context, copy, actualStart + k, arguments[Convert<intptr>(k + 2)])
+          otherwise unreachable;
+    }
+
+    // 17. Let i be 0.
+    // 18. Let r be actualStart + actualDeleteCount.
+    // 19. Repeat, while i < actualStart,
+    //   a. Let Pi be ! ToString(𝔽(i)).
+    //   b. Let iValue be ! Get(O, Pi).
+    //   c. Perform ! Set(target, Pi, iValue, true).
+    //   d. Set i to i + 1.
+    // 20. For each element E of convertedItems, do
+    //   a. Let Pi be ! ToString(𝔽(i)).
+    //   b. Perform ! Set(A, Pi, E, true).
+    //   c. Set i to i + 1.
+    // 21. Repeat, while i < newLen,
+    //   a. Let Pi be ! ToString(𝔽(i)).
+    //   b. Let from be ! ToString(𝔽(r)).
+    //   c. Let fromValue be ! Get(O, from).
+    //   d. Perform ! Set(A, Pi, fromValue, true).
+    //   e. Set i to i + 1.
+    //   f. Set r to r + 1.
+    //
+    // Step 20 is performed as part of step 13 above.
+    //
+    // Steps 17-21 (excluding 20) are implemented by memmove'ing 2 parts: the
+    // first part before the inserted items, the second part after the inserted
+    // items.
+    try {
+      // If the array shrunk or was detached due to parameter conversion, we go
+      // to a slow path that implements the spec algorithm naively. While it's
+      // possible to do partial memmoves, computation of the indices and length
+      // for the partial moves are harder to reason about, and miscomputation is
+      // likely a security issue.
+      attachedArrayAndLength =
+          EnsureAttachedAndReadLength(array) otherwise goto Slow(0);
+      const reloadedLength = attachedArrayAndLength.length;
+      if (reloadedLength < originalLength) goto Slow(reloadedLength);
+
+      const info = GetTypedArrayElementsInfo(copy);
+
+      const firstPartLength = actualStart;
+      if (firstPartLength != 0) {
+        const firstPartCountBytes: uintptr =
+            info.CalculateByteLength(firstPartLength) otherwise unreachable;
+        if (IsSharedArrayBuffer(array.buffer)) {
+          CallCRelaxedMemmove(
+              copy.data_ptr, array.data_ptr, firstPartCountBytes);
+        } else {
+          CallCMemmove(copy.data_ptr, array.data_ptr, firstPartCountBytes);
+        }
+      }
+
+      const secondPartStartInSrc = actualStart + actualDeleteCount;
+      const secondPartStartInCopy = actualStart + insertCount;
+      const secondPartLength = newLen - secondPartStartInCopy;
+      dcheck(secondPartLength == originalLength - secondPartStartInSrc);
+      if (secondPartLength != 0) {
+        const secondPartCountBytes: uintptr =
+            info.CalculateByteLength(secondPartLength) otherwise unreachable;
+        const secondPartDstPtr: RawPtr = info.GetDataPointerOffsetByLength(
+            copy, secondPartStartInCopy) otherwise unreachable;
+        const secondPartSrcPtr: RawPtr = info.GetDataPointerOffsetByLength(
+            array, secondPartStartInSrc) otherwise unreachable;
+
+        if (IsSharedArrayBuffer(array.buffer)) {
+          CallCRelaxedMemmove(
+              secondPartDstPtr, secondPartSrcPtr, secondPartCountBytes);
+        } else {
+          CallCMemmove(
+              secondPartDstPtr, secondPartSrcPtr, secondPartCountBytes);
+        }
+      }
+    } label Slow(reloadedLength: uintptr) deferred {
+      SlowTypedArrayToSplicedContinuation(
+          accessor, array, reloadedLength, copy, newLen, actualStart,
+          actualDeleteCount, insertCount);
+    }
+
+    // 22. Return A.
+    return copy;
+  } label NotTypedArray deferred {
+    ThrowTypeError(MessageTemplate::kNotTypedArray, kBuiltinNameToSpliced);
+  } label IsDetachedOrOutOfBounds deferred {
+    ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameToSpliced);
+  }
+}
+}

src/builtins/typed-array.tq

@@ -50,6 +50,22 @@ struct TypedArrayElementsInfo {
     return (bytes & ((1 << this.sizeLog2) - 1)) != 0;
   }
 
+  // Computes the data pointer with an offset in number of elements.
+  macro GetDataPointerOffsetByLength(
+      array: JSTypedArray, offset: uintptr): RawPtr labels IfInvalid {
+    const dataPtr = array.data_ptr;
+    const byteOffset: uintptr =
+        this.CalculateByteLength(offset) otherwise IfInvalid;
+
+    @if(DEBUG) {
+      const byteLength = LoadJSArrayBufferViewByteLength(array, array.buffer)
+          otherwise unreachable;
+      dcheck(byteOffset <= byteLength);
+    }
+
+    return dataPtr + Convert<intptr>(byteOffset);
+  }
+
   sizeLog2: uintptr;
   kind: ElementsKind;
 }

src/init/bootstrapper.cc

@@ -4543,6 +4543,8 @@ void Genesis::InitializeGlobal_harmony_change_array_by_copy() {
                                isolate());
     SimpleInstallFunction(isolate_, prototype, "toReversed",
                           Builtin::kTypedArrayPrototypeToReversed, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "toSpliced",
+                          Builtin::kTypedArrayPrototypeToSpliced, 2, false);
     SimpleInstallFunction(isolate_, prototype, "with",
                           Builtin::kTypedArrayPrototypeWith, 2, true);
   }

test/mjsunit/harmony/typedarray-to-spliced.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-change-array-by-copy --harmony-rab-gsab
+// Flags: --allow-natives-syntax
+
+d8.file.execute('test/mjsunit/typedarray-helpers.js');
+
+function AssertToSplicedResult(input, ...args) {
+  // Use Array#splice to test against TypedArray#toSpliced.
+  const origArrayCopy = [...input];
+  const s = input.toSpliced.apply(input, args);
+  let arraySpliced = [...input];
+  Array.prototype.splice.apply(arraySpliced, args);
+
+  // The in-place spliced version should be pairwise equal to the toSpliced,
+  // modulo being an actual Array if the input is generic.
+  assertEquals(new input.constructor(arraySpliced), s);
+
+  // The original input should be unchanged.
+  assertEquals(new input.constructor(origArrayCopy), input);
+
+  // The result of toSpliced() is a copy.
+  assertFalse(s === input);
+}
+
+function TestToSplicedHelper(input) {
+  const itemsToInsert = ["5","6"];
+  const startIndices = [0, 1, -1, -100, Infinity, -Infinity];
+  const deleteCounts = [0, 1, 2, 3];
+
+  AssertToSplicedResult(input);
+
+  for (let startIndex of startIndices) {
+    AssertToSplicedResult(input, startIndex);
+    for (let deleteCount of deleteCounts) {
+      AssertToSplicedResult(input, startIndex, deleteCount);
+      AssertToSplicedResult(input, startIndex, deleteCount, ...itemsToInsert);
+    }
+  }
+}
+
+function ResetRABTA(ta) {
+  ta.buffer.resize(4 * ta.constructor.BYTES_PER_ELEMENT);
+  for (let i = 0; i < 4; i++) {
+    ta[i] = i + "";
+  }
+}
+
+(function TestSurface() {
+  for (let TA of ctors) {
+    assertEquals(2, TA.prototype.toSpliced.length);
+    assertEquals("toSpliced", TA.prototype.toSpliced.name);
+  }
+})();
+
+(function TestBasic() {
+  for (let TA of ctors) {
+    let a = new TA(4);
+    for (let i = 0; i < 4; i++) {
+      a[i] = i + "";
+    }
+    TestToSplicedHelper(a);
+  }
+})();
+
+(function TestNonTypedArray() {
+  for (let TA of ctors) {
+    assertThrows(() => { TA.prototype.toSpliced.call([1,2,3,4]); }, TypeError);
+  }
+})();
+
+(function TestBigIntConversion() {
+  for (let TA of [BigInt64Array, BigUint64Array]) {
+    const ta = new TA(4);
+    assertThrows(() => { print(ta.toSpliced(0, 0, 42)); }, TypeError);
+  }
+})();
+
+(function TestResizableBuffer() {
+  for (let TA of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * TA.BYTES_PER_ELEMENT,
+                                           8 * TA.BYTES_PER_ELEMENT);
+    const fixedLength = new TA(rab, 0, 4);
+    const fixedLengthWithOffset = new TA(rab, 2 * TA.BYTES_PER_ELEMENT, 2);
+    const lengthTracking = new TA(rab, 0);
+    const lengthTrackingWithOffset = new TA(rab, 2 * TA.BYTES_PER_ELEMENT);
+
+    // Write some data into the array.
+    const taWrite = new TA(rab);
+    for (let i = 0; i < 4; i++) {
+      taWrite[i] = i + "";
+    }
+
+    // Orig. array: [0, 1, 2, 3]
+    //              [0, 1, 2, 3] << fixedLength
+    //                    [2, 3] << fixedLengthWithOffset
+    //              [0, 1, 2, 3, ...] << lengthTracking
+    //                    [2, 3, ...] << lengthTrackingWithOffset
+
+    TestToSplicedHelper(fixedLength);
+    TestToSplicedHelper(fixedLengthWithOffset);
+    TestToSplicedHelper(lengthTracking);
+    TestToSplicedHelper(lengthTrackingWithOffset);
+
+    // Shrink so that the TAs with offset go out of bounds.
+    rab.resize(1 * TA.BYTES_PER_ELEMENT);
+    WriteToTypedArray(taWrite, 0, 0);
+
+    assertThrows(() => { fixedLength.toSpliced(); }, TypeError);
+    assertThrows(() => { fixedLengthWithOffset.toSpliced(); }, TypeError);
+    TestToSplicedHelper(lengthTracking);
+    assertThrows(() => { lengthTrackingWithOffset.toSpliced(); }, TypeError);
+
+    // Shrink to zero.
+    rab.resize(0);
+
+    assertThrows(() => { fixedLength.toSpliced(); }, TypeError);
+    assertThrows(() => { fixedLengthWithOffset.toSpliced(); }, TypeError);
+    TestToSplicedHelper(lengthTracking);
+    assertThrows(() => { lengthTrackingWithOffset.toSpliced(); }, TypeError);
+
+    // Grow so that all TAs are back in-bounds.
+    rab.resize(6 * TA.BYTES_PER_ELEMENT);
+    for (let i = 0; i < 6; ++i) {
+      WriteToTypedArray(taWrite, i, i);
+    }
+
+    // Orig. array: [0, 1, 2, 3, 4, 5]
+    //              [0, 1, 2, 3] << fixedLength
+    //                    [2, 3] << fixedLengthWithOffset
+    //              [0, 1, 2, 3, 4, 5, ...] << lengthTracking
+    //                    [2, 3, 4, 5, ...] << lengthTrackingWithOffset
+
+    TestToSplicedHelper(fixedLength);
+    TestToSplicedHelper(fixedLengthWithOffset);
+    TestToSplicedHelper(lengthTracking);
+    TestToSplicedHelper(lengthTrackingWithOffset);
+  }
+})();
+
+(function TestParameterConversionShrinks() {
+  for (let TA of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * TA.BYTES_PER_ELEMENT,
+                                           8 * TA.BYTES_PER_ELEMENT);
+    const lengthTracking = new TA(rab);
+
+    const undefinedThrows = (lengthTracking instanceof BigInt64Array ||
+                             lengthTracking instanceof BigUint64Array);
+
+    ResetRABTA(lengthTracking);
+    {
+      // First part indices 0-3; no second part
+      // Reloaded length 2
+      // First part length 4, partial fast copy of [0,1]
+      // Second part length 0
+      const evilThree = { valueOf: () => {
+        rab.resize(2 * TA.BYTES_PER_ELEMENT);
+        return 3;
+      }};
+      if (undefinedThrows) {
+        assertThrows(() => { lengthTracking.toSpliced(evilThree); },
+                     TypeError);
+      } else {
+        const s = lengthTracking.toSpliced(evilThree);
+        assertEquals(new TA(["0","1",undefined]), s);
+        assertFalse(s === lengthTracking);
+      }
+    }
+
+    ResetRABTA(lengthTracking);
+    {
+      // No first part; second part indices 1-3
+      // Reloaded length 2
+      // First part length 0, degenerate case of entire fast copy
+      // Second part length 1, partial fast copy of [1]
+      const evilOne = { valueOf: () => {
+        rab.resize(2 * TA.BYTES_PER_ELEMENT);
+        return 1;
+      }};
+      if (undefinedThrows) {
+        assertThrows(() => { lengthTracking.toSpliced(0, evilOne); },
+                     TypeError);
+      } else {
+        const s = lengthTracking.toSpliced(0, evilOne);
+        assertEquals(new TA(["1",undefined,undefined]), s);
+        assertFalse(s === lengthTracking);
+      }
+    }
+
+    ResetRABTA(lengthTracking);
+    {
+      // First part length 1; second part indices 2-3
+      // Reloaded length 3
+      // First part length 1, entire fast copy
+      // Second part length 1, partial fast copy of [2]
+      const evilFive = { valueOf: () => {
+        rab.resize(3 * TA.BYTES_PER_ELEMENT);
+        return "5";
+      }};
+      if (undefinedThrows) {
+        assertThrows(() => { lengthTracking.toSpliced(1, 1, evilFive); },
+                     TypeError);
+      } else {
+        const s = lengthTracking.toSpliced(1, 1, evilFive);
+        assertEquals(new TA(["0","5","2",undefined]), s);
+        assertFalse(s === lengthTracking);
+      }
+    }
+  }
+})();
+
+(function TestParameterConversionGrows() {
+  for (let TA of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * TA.BYTES_PER_ELEMENT,
+                                           8 * TA.BYTES_PER_ELEMENT);
+    const lengthTracking = new TA(rab);
+
+    ResetRABTA(lengthTracking);
+    {
+      const evilThree = { valueOf: () => {
+        rab.resize(6 * TA.BYTES_PER_ELEMENT);
+        return 3;
+      }};
+      const s = lengthTracking.toSpliced(evilThree);
+      assertEquals(new TA(["0","1","2"]), s);
+      assertFalse(s === lengthTracking);
+    }
+
+    ResetRABTA(lengthTracking);
+    {
+      const evilOne = { valueOf: () => {
+        rab.resize(6 * TA.BYTES_PER_ELEMENT);
+        return 1;
+      }};
+      const s = lengthTracking.toSpliced(0, evilOne);
+      assertEquals(new TA(["1","2","3"]), s);
+      assertFalse(s === lengthTracking);
+    }
+
+    ResetRABTA(lengthTracking);
+    {
+      const evilFive = { valueOf: () => {
+        rab.resize(6 * TA.BYTES_PER_ELEMENT);
+        return "5";
+      }};
+      const s = lengthTracking.toSpliced(1, 1, evilFive);
+      assertEquals(new TA(["0","5","2","3"]), s);
+      assertFalse(s === lengthTracking);
+    }
+  }
+})();
+
+(function TestParameterConversionDetaches() {
+  function CreateTA(TA) {
+    let ta = new TA(4);
+    for (let i = 0; i < 4; i++) {
+      ta[i] = i + "";
+    }
+    return ta;
+  }
+
+  for (let TA of ctors) {
+    let ta = CreateTA(TA);
+    const undefinedThrows = (ta instanceof BigInt64Array ||
+                             ta instanceof BigUint64Array);
+
+    {
+      const evilThree = { valueOf: () => {
+        %ArrayBufferDetach(ta.buffer);
+        return 3;
+      }};
+      if (undefinedThrows) {
+        assertThrows(() => { ta.toSpliced(evilThree); },
+                     TypeError);
+      } else {
+        const s = ta.toSpliced(evilThree);
+        assertEquals(new TA([undefined,undefined,undefined]), s);
+        assertFalse(s === ta);
+      }
+    }
+
+    ta = CreateTA(TA);
+    {
+      const evilOne = { valueOf: () => {
+        %ArrayBufferDetach(ta.buffer);
+        return 1;
+      }};
+      if (undefinedThrows) {
+        assertThrows(() => { ta.toSpliced(0, evilOne); },
+                     TypeError);
+      } else {
+        const s = ta.toSpliced(0, evilOne);
+        assertEquals(new TA([undefined,undefined,undefined]), s);
+        assertFalse(s === ta);
+      }
+    }
+
+    ta = CreateTA(TA);
+    {
+      const evilFive = { valueOf: () => {
+        %ArrayBufferDetach(ta.buffer);
+        return "5";
+      }};
+      if (undefinedThrows) {
+        assertThrows(() => { ta.toSpliced(1, 1, evilFive); },
+                     TypeError);
+      } else {
+        const s = ta.toSpliced(1, 1, evilFive);
+        assertEquals(new TA([undefined,"5",undefined,undefined]), s);
+        assertFalse(s === ta);
+      }
+    }
+  }
+})();
+
+(function TestGrowableSAB() {
+  for (let TA of ctors) {
+    const gsab = CreateGrowableSharedArrayBuffer(4 * TA.BYTES_PER_ELEMENT,
+                                           8 * TA.BYTES_PER_ELEMENT);
+    const fixedLength = new TA(gsab, 0, 4);
+    const fixedLengthWithOffset = new TA(gsab, 2 * TA.BYTES_PER_ELEMENT, 2);
+    const lengthTracking = new TA(gsab, 0);
+    const lengthTrackingWithOffset = new TA(gsab, 2 * TA.BYTES_PER_ELEMENT);
+
+    // Write some data into the array.
+    const taWrite = new TA(gsab);
+    for (let i = 0; i < 4; i++) {
+      taWrite[i] = (2 * i) + "";
+    }
+
+    // Orig. array: [0, 2, 4, 6]
+    //              [0, 2, 4, 6] << fixedLength
+    //                    [4, 6] << fixedLengthWithOffset
+    //              [0, 2, 4, 6, ...] << lengthTracking
+    //                    [4, 6, ...] << lengthTrackingWithOffset
+    TestToSplicedHelper(fixedLength);
+    TestToSplicedHelper(fixedLengthWithOffset);
+    TestToSplicedHelper(lengthTracking);
+    TestToSplicedHelper(lengthTrackingWithOffset);
+
+    // Grow.
+    gsab.grow(6 * TA.BYTES_PER_ELEMENT);
+    for (let i = 0; i < 6; ++i) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+
+    // Orig. array: [0, 2, 4, 6, 8, 10]
+    //              [0, 2, 4, 6] << fixedLength
+    //                    [4, 6] << fixedLengthWithOffset
+    //              [0, 2, 4, 6, 8, 10, ...] << lengthTracking
+    //                    [4, 6, 8, 10, ...] << lengthTrackingWithOffset
+    TestToSplicedHelper(fixedLength);
+    TestToSplicedHelper(fixedLengthWithOffset);
+    TestToSplicedHelper(lengthTracking);
+    TestToSplicedHelper(lengthTrackingWithOffset);
+  }
+})();
+
+(function TestDetached() {
+  for (let TA of ctors) {
+    let a = new TA(4);
+    %ArrayBufferDetach(a.buffer);
+    assertThrows(() => { a.toSpliced(); }, TypeError);
+  }
+})();
+
+(function TestNoSpecies() {
+  class MyUint8Array extends Uint8Array {
+    static get [Symbol.species]() { return MyUint8Array; }
+  }
+  assertEquals(Uint8Array, (new MyUint8Array()).toSpliced().constructor);
+})();

tools/v8heapconst.py

@@ -540,30 +540,30 @@ KNOWN_OBJECTS = {
   ("old_space", 0x04a15): "StringSplitCache",
   ("old_space", 0x04e1d): "RegExpMultipleCache",
   ("old_space", 0x05225): "BuiltinsConstantsTable",
-  ("old_space", 0x05665): "AsyncFunctionAwaitRejectSharedFun",
-  ("old_space", 0x05689): "AsyncFunctionAwaitResolveSharedFun",
-  ("old_space", 0x056ad): "AsyncGeneratorAwaitRejectSharedFun",
-  ("old_space", 0x056d1): "AsyncGeneratorAwaitResolveSharedFun",
-  ("old_space", 0x056f5): "AsyncGeneratorYieldResolveSharedFun",
-  ("old_space", 0x05719): "AsyncGeneratorReturnResolveSharedFun",
-  ("old_space", 0x0573d): "AsyncGeneratorReturnClosedRejectSharedFun",
-  ("old_space", 0x05761): "AsyncGeneratorReturnClosedResolveSharedFun",
-  ("old_space", 0x05785): "AsyncIteratorValueUnwrapSharedFun",
-  ("old_space", 0x057a9): "PromiseAllResolveElementSharedFun",
-  ("old_space", 0x057cd): "PromiseAllSettledResolveElementSharedFun",
-  ("old_space", 0x057f1): "PromiseAllSettledRejectElementSharedFun",
-  ("old_space", 0x05815): "PromiseAnyRejectElementSharedFun",
-  ("old_space", 0x05839): "PromiseCapabilityDefaultRejectSharedFun",
-  ("old_space", 0x0585d): "PromiseCapabilityDefaultResolveSharedFun",
-  ("old_space", 0x05881): "PromiseCatchFinallySharedFun",
-  ("old_space", 0x058a5): "PromiseGetCapabilitiesExecutorSharedFun",
-  ("old_space", 0x058c9): "PromiseThenFinallySharedFun",
-  ("old_space", 0x058ed): "PromiseThrowerFinallySharedFun",
-  ("old_space", 0x05911): "PromiseValueThunkFinallySharedFun",
-  ("old_space", 0x05935): "ProxyRevokeSharedFun",
-  ("old_space", 0x05959): "ShadowRealmImportValueFulfilledSFI",
-  ("old_space", 0x0597d): "SourceTextModuleExecuteAsyncModuleFulfilledSFI",
-  ("old_space", 0x059a1): "SourceTextModuleExecuteAsyncModuleRejectedSFI",
+  ("old_space", 0x05669): "AsyncFunctionAwaitRejectSharedFun",
+  ("old_space", 0x0568d): "AsyncFunctionAwaitResolveSharedFun",
+  ("old_space", 0x056b1): "AsyncGeneratorAwaitRejectSharedFun",
+  ("old_space", 0x056d5): "AsyncGeneratorAwaitResolveSharedFun",
+  ("old_space", 0x056f9): "AsyncGeneratorYieldResolveSharedFun",
+  ("old_space", 0x0571d): "AsyncGeneratorReturnResolveSharedFun",
+  ("old_space", 0x05741): "AsyncGeneratorReturnClosedRejectSharedFun",
+  ("old_space", 0x05765): "AsyncGeneratorReturnClosedResolveSharedFun",
+  ("old_space", 0x05789): "AsyncIteratorValueUnwrapSharedFun",
+  ("old_space", 0x057ad): "PromiseAllResolveElementSharedFun",
+  ("old_space", 0x057d1): "PromiseAllSettledResolveElementSharedFun",
+  ("old_space", 0x057f5): "PromiseAllSettledRejectElementSharedFun",
+  ("old_space", 0x05819): "PromiseAnyRejectElementSharedFun",
+  ("old_space", 0x0583d): "PromiseCapabilityDefaultRejectSharedFun",
+  ("old_space", 0x05861): "PromiseCapabilityDefaultResolveSharedFun",
+  ("old_space", 0x05885): "PromiseCatchFinallySharedFun",
+  ("old_space", 0x058a9): "PromiseGetCapabilitiesExecutorSharedFun",
+  ("old_space", 0x058cd): "PromiseThenFinallySharedFun",
+  ("old_space", 0x058f1): "PromiseThrowerFinallySharedFun",
+  ("old_space", 0x05915): "PromiseValueThunkFinallySharedFun",
+  ("old_space", 0x05939): "ProxyRevokeSharedFun",
+  ("old_space", 0x0595d): "ShadowRealmImportValueFulfilledSFI",
+  ("old_space", 0x05981): "SourceTextModuleExecuteAsyncModuleFulfilledSFI",
+  ("old_space", 0x059a5): "SourceTextModuleExecuteAsyncModuleRejectedSFI",
 }
 
 # Lower 32 bits of first page addresses for various heap spaces.