[64bit] Bump TypedArray max length to 2**32-1 elements

The actual allocatable size still depends on the allocator;
in particular Blink's ArrayBufferAllocator is currently limited
to 2GB.
WebAssembly memories are not affected by this change (i.e. still
capped at 2GB as well).

For 32-bit platforms, the limit remains at 2**30-1 (=max smi) elements.

Bug: v8:4153
Change-Id: If0d6047dd4061028688d85a3dc0a2684dcca8693
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2007495Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65924}

include/v8.h

@@ -5306,7 +5306,7 @@ class V8_EXPORT TypedArray : public ArrayBufferView {
    */
   static constexpr size_t kMaxLength = internal::kApiSystemPointerSize == 4
                                            ? internal::kSmiMaxValue
-                                           : 0x7FFFFFFF;  // kMaxInt32
+                                           : 0xFFFFFFFF;
 
   /**
    * Number of elements in this typed array

test/mjsunit/es6/typedarray.js

@@ -992,8 +992,9 @@ for(i = 0; i < typedArrayConstructors.length; i++) {
 })();
 
 (function TestBufferLengthTooLong() {
+  const kLength = %TypedArrayMaxLength() + 1;
   try {
-    var buf = new ArrayBuffer(2147483648);
+    var buf = new ArrayBuffer(kLength);
   } catch (e) {
     // The ArrayBuffer allocation fails on 32-bit archs, so no need to try to
     // construct the typed array.

test/mjsunit/mjsunit.status

@@ -424,6 +424,7 @@
 ['arch in (ia32, arm, mips, mipsel)', {
   # Needs >2GB of available contiguous memory.
   'wasm/huge-memory': [SKIP],
+  'wasm/huge-typedarray': [SKIP],
 }],  # 'arch in (ia32, arm, mips, mipsel)'
 
 ##############################################################################

test/mjsunit/regress/regress-crbug-754175.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --mock-arraybuffer-allocator
+// Flags: --mock-arraybuffer-allocator --allow-natives-syntax
 
 function Module(stdlib, foreign, buffer) {
   "use asm";
@@ -10,9 +10,10 @@ function Module(stdlib, foreign, buffer) {
   function foo() { return heap[23] | 0 }
   return { foo:foo };
 }
+const kLength = Math.max(0x100000000, %TypedArrayMaxLength() + 1);
 function instantiate() {
   // On 32-bit architectures buffer allocation will throw.
-  var buffer = new ArrayBuffer(0x100000000);
+  var buffer = new ArrayBuffer(kLength);
   // On 64-bit architectures instantiation will throw.
   var module = Module(this, {}, buffer);
 }

test/mjsunit/wasm/huge-typedarray.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-max-mem-pages=65536
+
+// Currently, the only way to create a huge TypedArray is via a
+// WebAssembly Memory object.
+
+const kNumPages = 65536;
+const kWasmPageSize = 65536;
+const kBytes = kNumPages * kWasmPageSize;
+const kArrayLength = kBytes - 1;
+assertEquals(2 ** 32, kBytes);
+assertEquals(0xFFFFFFFF, kArrayLength);
+
+var mem = new WebAssembly.Memory({ initial: kNumPages });
+var buffer = mem.buffer;
+var array = new Uint8Array(buffer, 0, kArrayLength);
+
+assertEquals(kBytes, buffer.byteLength);
+assertEquals(kArrayLength, array.length);
+assertEquals(undefined, array[-1]);
+assertEquals(0, array[0]);
+assertEquals(0, array[kArrayLength - 1]);
+assertEquals(undefined, array[kArrayLength]);