Add more test for non extensible packed object

Bug: v8:6831
Change-Id: I6e9f6fc718928f2f86d3b3c2dd144a6636b05790
Reviewed-on: https://chromium-review.googlesource.com/c/1481895
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59844}

src/objects/js-objects-inl.h

@@ -788,6 +788,10 @@ bool JSObject::HasDictionaryElements() {
   return GetElementsKind() == DICTIONARY_ELEMENTS;
 }
 
+bool JSObject::HasPackedElements() {
+  return GetElementsKind() == PACKED_ELEMENTS;
+}
+
 bool JSObject::HasFastArgumentsElements() {
   return GetElementsKind() == FAST_SLOPPY_ARGUMENTS_ELEMENTS;
 }

src/objects/js-objects.h

@@ -334,6 +334,8 @@ class JSObject : public JSReceiver {
   inline bool HasSloppyArgumentsElements();
   inline bool HasStringWrapperElements();
   inline bool HasDictionaryElements();
+  // Returns true if an object has elements of PACKED_ELEMENTS
+  inline bool HasPackedElements();
 
   inline bool HasFixedTypedArrayElements();
 

src/runtime/runtime-test.cc

@@ -937,6 +937,7 @@ ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(SmiOrObjectElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(DoubleElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(HoleyElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(DictionaryElements)
+ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(PackedElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(SloppyArgumentsElements)
 // Properties test sitting with elements tests - not fooling anyone.
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(FastProperties)

src/runtime/runtime.h

@@ -463,6 +463,7 @@ namespace internal {
   F(GetWasmRecoveredTrapCount, 0, 1)          \
   F(GlobalPrint, 1, 1)                        \
   F(HasDictionaryElements, 1, 1)              \
+  F(HasPackedElements, 1, 1)                  \
   F(HasDoubleElements, 1, 1)                  \
   F(HasFastElements, 1, 1)                    \
   F(HasFastProperties, 1, 1)                  \

test/mjsunit/object-freeze.js

@@ -396,3 +396,112 @@ assertTrue(Object.isFrozen(obj));
   assertFalse(Object.getOwnPropertyDescriptor(args, "length").writable);
   assertFalse(Object.getOwnPropertyDescriptor(args, "callee").writable);
 })();
+
+// Test packed element array built-in functions with freeze.
+function testPackedFrozenArray1(obj) {
+  assertTrue(Object.isSealed(obj));
+  // Verify that the value can't be written
+  obj1 = new Array(...obj);
+  var length = obj.length;
+  for (var i = 0; i < length-1; i++) {
+    obj[i] = 'new';
+    assertEquals(obj1[i], obj[i]);
+  }
+  // for symbol we cannot compare directly
+  assertTrue(typeof obj[length-1] == 'symbol');
+
+  // Verify that the length can't be written by builtins.
+  assertTrue(Array.isArray(obj));
+  assertThrows(function() { obj.pop(); }, TypeError);
+  assertThrows(function() { obj.push(); }, TypeError);
+  assertThrows(function() { obj.unshift(); }, TypeError);
+  assertThrows(function() { obj.copyWithin(0,0); }, TypeError);
+  assertThrows(function() { obj.fill(0); }, TypeError);
+  assertThrows(function() { obj.reverse(); }, TypeError);
+  assertThrows(function() { obj.sort(); }, TypeError);
+  assertThrows(function() { obj.splice(0); }, TypeError);
+  assertTrue(Object.isFrozen(obj));
+
+  // Verify search, filter, iterator
+  assertEquals(obj.lastIndexOf(1), 2);
+  assertEquals(obj.indexOf('a'), 4);
+  assertFalse(obj.includes(Symbol("test")));
+  assertEquals(obj.find(x => x==0), undefined);
+  assertEquals(obj.findIndex(x => x=='a'), 4);
+  assertTrue(obj.some(x => typeof x == 'symbol'));
+  assertFalse(obj.every(x => x == -1));
+  var filteredArray = obj.filter(e => typeof e == "symbol");
+  assertEquals(filteredArray.length, 1);
+  assertEquals(obj.map(x => x), obj);
+  var countPositiveNumber = 0;
+  obj.forEach(function(item, index) {
+    if (item === 1) {
+      countPositiveNumber++;
+      assertEquals(index, 2);
+    }
+  });
+  assertEquals(countPositiveNumber, 1);
+  assertEquals(obj.length, obj.concat([]).length);
+  var iterator = obj.values();
+  assertEquals(iterator.next().value, undefined);
+  assertEquals(iterator.next().value, null);
+  var iterator = obj.keys();
+  assertEquals(iterator.next().value, 0);
+  assertEquals(iterator.next().value, 1);
+  var iterator = obj.entries();
+  assertEquals(iterator.next().value, [0, undefined]);
+  assertEquals(iterator.next().value, [1, null]);
+}
+
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.freeze(obj);
+testPackedFrozenArray1(obj);
+
+// Verify change from sealed to frozen
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.seal(obj);
+Object.freeze(obj);
+assertTrue(Object.isSealed(obj));
+testPackedFrozenArray1(obj);
+
+// Verify change from non-extensible to frozen
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.preventExtensions(obj);
+Object.freeze(obj);
+assertTrue(Object.isSealed(obj));
+testPackedFrozenArray1(obj);
+
+// Verify flat, map, slice, flatMap, join, reduce, reduceRight for frozen packed array
+function testPackedFrozenArray2(arr) {
+  assertTrue(Object.isFrozen(arr));
+  assertTrue(Array.isArray(arr));
+  assertEquals(arr.map(x => [x]), [['a'], ['b'], ['c']]);
+  assertEquals(arr.flatMap(x => [x]), arr);
+  assertEquals(arr.flat(), arr);
+  assertEquals(arr.join('-'), "a-b-c");
+  const reducer = (accumulator, currentValue) => accumulator + currentValue;
+  assertEquals(arr.reduce(reducer), "abc");
+  assertEquals(arr.reduceRight(reducer), "cba");
+  assertEquals(arr.slice(0, 1), ['a']);
+}
+var arr1 = new Array('a', 'b', 'c');
+assertTrue(%HasPackedElements(arr1));
+Object.freeze(arr1);
+testPackedFrozenArray2(arr1);
+
+// Verify change from sealed to frozen
+var arr2 = new Array('a', 'b', 'c');
+assertTrue(%HasPackedElements(arr2));
+Object.seal(arr2);
+Object.freeze(arr2);
+testPackedFrozenArray2(arr2);
+
+// Verify change from non-extensible to frozen
+var arr2 = new Array('a', 'b', 'c');
+assertTrue(%HasPackedElements(arr2));
+Object.preventExtensions(arr2);
+Object.freeze(arr2);
+testPackedFrozenArray2(arr2);

test/mjsunit/object-prevent-extensions.js

@@ -160,3 +160,90 @@ assertFalse(Object.isExtensible(obj2));
 assertFalse(Object.isSealed(obj));
 assertFalse(Object.isSealed(obj2));
 assertTrue(%HaveSameMap(obj, obj2));
+
+// Test packed element array built-in functions with preventExtensions.
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.preventExtensions(obj);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+
+// Verify that the length can't be written by builtins.
+assertThrows(function() { obj.push(1); }, TypeError);
+assertThrows(function() { obj.unshift(1); }, TypeError);
+assertThrows(function() { obj.splice(0, 0, 1); }, TypeError);
+
+// Verify search, filter, iterator
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.preventExtensions(obj);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+assertEquals(obj.lastIndexOf(1), 2);
+assertEquals(obj.indexOf('a'), 4);
+assertFalse(obj.includes(Symbol("test")));
+assertEquals(obj.find(x => x==0), undefined);
+assertEquals(obj.findIndex(x => x=='a'), 4);
+assertTrue(obj.some(x => typeof x == 'symbol'));
+assertFalse(obj.every(x => x == -1));
+var filteredArray = obj.filter(e => typeof e == "symbol");
+assertEquals(filteredArray.length, 1);
+assertEquals(obj.map(x => x), obj);
+var countPositiveNumber = 0;
+obj.forEach(function(item, index) {
+  if (item === 1) {
+    countPositiveNumber++;
+    assertEquals(index, 2);
+  }
+});
+assertEquals(countPositiveNumber, 1);
+assertEquals(obj.length, obj.concat([]).length);
+var iterator = obj.values();
+assertEquals(iterator.next().value, undefined);
+assertEquals(iterator.next().value, null);
+var iterator = obj.keys();
+assertEquals(iterator.next().value, 0);
+assertEquals(iterator.next().value, 1);
+var iterator = obj.entries();
+assertEquals(iterator.next().value, [0, undefined]);
+assertEquals(iterator.next().value, [1, null]);
+
+// Verify that the value can be written
+var length = obj.length;
+for (var i = 0; i < length-1; i++) {
+  obj[i] = 'new';
+  assertEquals(obj[i], 'new');
+}
+
+// Verify flat, map, flatMap, join, reduce, reduceRight for sealed packed array
+var arr = ['a', 'b', 'c'];
+assertTrue(%HasPackedElements(arr));
+Object.preventExtensions(arr);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+assertEquals(arr.map(x => [x]), [['a'], ['b'], ['c']]);
+assertEquals(arr.flatMap(x => [x]), arr);
+assertEquals(arr.flat(), arr);
+assertEquals(arr.join('-'), "a-b-c");
+const reducer = (accumulator, currentValue) => accumulator + currentValue;
+assertEquals(arr.reduce(reducer), "abc");
+assertEquals(arr.reduceRight(reducer), "cba");
+assertEquals(arr.slice(0, 1), ['a']);
+
+// Verify change content of sealed packed array
+arr.sort();
+assertEquals(arr.join(''), "abc");
+arr.reverse();
+assertEquals(arr.join(''), "cba");
+arr.copyWithin(0, 1, 2);
+assertEquals(arr.join(''),"bba");
+arr.fill('d');
+assertEquals(arr.join(''), "ddd");
+arr.pop();
+assertEquals(arr.join(''), "dd");

test/mjsunit/object-seal.js

@@ -153,7 +153,6 @@ arr[0] = 'foo';
 // We should be able to overwrite the existing value.
 assertEquals('foo', arr[0]);
 
-
 // Test that isSealed returns the correct value even if configurable
 // has been set to false on all properties manually and the extensible
 // flag has also been set to false manually.
@@ -393,3 +392,104 @@ assertTrue((new Sealed()).prototypeExists);
 obj = new Int32Array(10)
 Object.seal(obj);
 assertTrue(Object.isSealed(obj));
+
+// Test packed element array built-in functions with seal.
+function testPackedSealedArray1(obj) {
+  assertTrue(Object.isSealed(obj));
+  assertFalse(Object.isFrozen(obj));
+  assertTrue(Array.isArray(obj));
+
+  // Verify that the length can't be written by builtins.
+  assertThrows(function() { obj.pop(); }, TypeError);
+  assertThrows(function() { obj.push(1); }, TypeError);
+  assertThrows(function() { obj.unshift(1); }, TypeError);
+  assertThrows(function() { obj.splice(0); }, TypeError);
+
+  // Verify search, filter, iterator
+  obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+  assertTrue(%HasPackedElements(obj));
+  Object.seal(obj);
+  assertTrue(Object.isSealed(obj));
+  assertFalse(Object.isFrozen(obj));
+  assertTrue(Array.isArray(obj));
+  assertEquals(obj.lastIndexOf(1), 2);
+  assertEquals(obj.indexOf('a'), 4);
+  assertFalse(obj.includes(Symbol("test")));
+  assertEquals(obj.find(x => x==0), undefined);
+  assertEquals(obj.findIndex(x => x=='a'), 4);
+  assertTrue(obj.some(x => typeof x == 'symbol'));
+  assertFalse(obj.every(x => x == -1));
+  var filteredArray = obj.filter(e => typeof e == "symbol");
+  assertEquals(filteredArray.length, 1);
+  assertEquals(obj.map(x => x), obj);
+  var countPositiveNumber = 0;
+  obj.forEach(function(item, index) {
+    if (item === 1) {
+      countPositiveNumber++;
+      assertEquals(index, 2);
+    }
+  });
+  assertEquals(countPositiveNumber, 1);
+  assertEquals(obj.length, obj.concat([]).length);
+  var iterator = obj.values();
+  assertEquals(iterator.next().value, undefined);
+  assertEquals(iterator.next().value, null);
+  var iterator = obj.keys();
+  assertEquals(iterator.next().value, 0);
+  assertEquals(iterator.next().value, 1);
+  var iterator = obj.entries();
+  assertEquals(iterator.next().value, [0, undefined]);
+  assertEquals(iterator.next().value, [1, null]);
+
+  // Verify that the value can be written
+  var length = obj.length;
+  for (var i = 0; i < length-1; i++) {
+    obj[i] = 'new';
+    assertEquals(obj[i], 'new');
+  }
+};
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.seal(obj);
+testPackedSealedArray1(obj);
+
+// Verify after transition from preventExtensions
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.preventExtensions(obj);
+Object.seal(obj);
+testPackedSealedArray1(obj);
+
+// Verify flat, map, slice, flatMap, join, reduce, reduceRight for sealed packed array
+function testPackedSealedArray2(arr) {
+  assertTrue(Object.isSealed(arr));
+  assertFalse(Object.isFrozen(arr));
+  assertEquals(arr.map(x => [x]), [['a'], ['b'], ['c']]);
+  assertEquals(arr.flatMap(x => [x]), arr);
+  assertEquals(arr.flat(), arr);
+  assertEquals(arr.join('-'), "a-b-c");
+  const reducer = (accumulator, currentValue) => accumulator + currentValue;
+  assertEquals(arr.reduce(reducer), "abc");
+  assertEquals(arr.reduceRight(reducer), "cba");
+  assertEquals(arr.slice(0, 1), ['a']);
+  // Verify change content of sealed packed array
+  arr.sort();
+  assertEquals(arr.join(''), "abc");
+  arr.reverse();
+  assertEquals(arr.join(''), "cba");
+  arr.copyWithin(0, 1, 2);
+  assertEquals(arr.join(''),"bba");
+  arr.fill('d');
+  assertEquals(arr.join(''), "ddd");
+}
+
+var arr1 = new Array('a', 'b', 'c');
+assertTrue(%HasPackedElements(arr1));
+Object.seal(arr1);
+testPackedSealedArray2(arr1);
+
+var arr2 = new Array('a', 'b', 'c');
+assertTrue(%HasPackedElements(arr2));
+Object.preventExtensions(arr2);
+Object.seal(arr2);
+testPackedSealedArray2(arr2);