[change-array-by-copy] Add RAB/GSAB tests for toReversed

Bug: v8:12764
Change-Id: I51130143494e6442b335660d2fdcbc75f289fd92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3671759Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80785}

src/builtins/base.tq

@@ -830,6 +830,8 @@ extern macro IsElementsKindInRange(
 extern macro IsFastElementsKind(constexpr ElementsKind): constexpr bool;
 extern macro IsDoubleElementsKind(constexpr ElementsKind): constexpr bool;
 
+extern macro GetNonRabGsabElementsKind(ElementsKind): ElementsKind;
+
 extern macro IsFastAliasedArgumentsMap(implicit context: Context)(Map): bool;
 extern macro IsSlowAliasedArgumentsMap(implicit context: Context)(Map): bool;
 extern macro IsSloppyArgumentsMap(implicit context: Context)(Map): bool;

src/builtins/typed-array-createtypedarray.tq

@@ -483,7 +483,11 @@ transitioning macro TypedArrayCreateSameType(implicit context: Context)(
       context, constructor, constructor, Convert<Number>(newLength), Undefined,
       Undefined);
   dcheck(!IsDetachedBuffer(typedArray.buffer));
-  dcheck(exemplar.elements_kind == typedArray.elements_kind);
+  // The elements kind are equal up to resizability / growability. The newly
+  // created TypedArray is never backed by a resizable / growable buffer.
+  dcheck(
+      GetNonRabGsabElementsKind(exemplar.elements_kind) ==
+      typedArray.elements_kind);
   return typedArray;
 }
 }

test/mjsunit/harmony/typedarray-to-reversed.js

-// Copyright 2018 the V8 project authors. All rights reserved.
+// Copyright 2022 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-change-array-by-copy
+// Flags: --harmony-change-array-by-copy --harmony-rab-gsab
+// Flags: --allow-natives-syntax
 
 d8.file.execute('test/mjsunit/typedarray-helpers.js');
 
+function CheckToReversed(orig) {
+  let r = orig.toReversed();
+  assertEquals(orig.length, r.length);
+  for (let i = 0; i < r.length; i++) {
+    assertEquals(orig[orig.length - i - 1], r[i]);
+  }
+  assertFalse(orig === r);
+}
+
 (function TestSurface() {
   for (let TA of ctors) {
-    assertEquals(TA.prototype.toReversed.length, 0);
-    assertEquals(TA.prototype.toReversed.name, "toReversed");
+    assertEquals(0, TA.prototype.toReversed.length);
+    assertEquals("toReversed", TA.prototype.toReversed.name);
   }
 })();
 
@@ -19,11 +29,126 @@ d8.file.execute('test/mjsunit/typedarray-helpers.js');
     for (let i = 0; i < 4; i++) {
       a[i] = i + "";
     }
-    let r = a.toReversed();
+    CheckToReversed(a);
+  }
+})();
+
+(function TestNonTypedArray() {
+  for (let TA of ctors) {
+    assertThrows(() => { TA.prototype.toReversed.call([1,2,3,4]); }, TypeError);
+  }
+})();
+
+(function TestResizableBuffer() {
+  for (let TA of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * TA.BYTES_PER_ELEMENT,
+                                           8 * TA.BYTES_PER_ELEMENT);
+    const fixedLength = new TA(rab, 0, 4);
+    const fixedLengthWithOffset = new TA(rab, 2 * TA.BYTES_PER_ELEMENT, 2);
+    const lengthTracking = new TA(rab, 0);
+    const lengthTrackingWithOffset = new TA(rab, 2 * TA.BYTES_PER_ELEMENT);
+
+    // Write some data into the array.
+    const taWrite = new TA(rab);
     for (let i = 0; i < 4; i++) {
-      assertEquals(a[i], r[4-i-1]);
+      WriteToTypedArray(taWrite, i, i);
+    }
+
+    // Orig. array: [0, 1, 2, 3]
+    //              [0, 1, 2, 3] << fixedLength
+    //                    [2, 3] << fixedLengthWithOffset
+    //              [0, 1, 2, 3, ...] << lengthTracking
+    //                    [2, 3, ...] << lengthTrackingWithOffset
+
+    CheckToReversed(fixedLength);
+    CheckToReversed(fixedLengthWithOffset);
+    CheckToReversed(lengthTracking);
+    CheckToReversed(lengthTrackingWithOffset);
+
+    // Shrink so that the TAs with offset go out of bounds.
+    rab.resize(1 * TA.BYTES_PER_ELEMENT);
+    WriteToTypedArray(taWrite, 0, 0);
+
+    assertThrows(() => { fixedLength.toReversed(); }, TypeError);
+    assertThrows(() => { fixedLengthWithOffset.toReversed(); }, TypeError);
+    CheckToReversed(lengthTracking);
+    assertThrows(() => { lengthTrackingWithOffset.toReversed(); }, TypeError);
+
+    // Shrink to zero.
+    rab.resize(0);
+
+    assertThrows(() => { fixedLength.toReversed(); }, TypeError);
+    assertThrows(() => { fixedLengthWithOffset.toReversed(); }, TypeError);
+    CheckToReversed(lengthTracking);
+    assertThrows(() => { lengthTrackingWithOffset.toReversed(); }, TypeError);
+
+    // Grow so that all TAs are back in-bounds.
+    rab.resize(6 * TA.BYTES_PER_ELEMENT);
+    for (let i = 0; i < 6; ++i) {
+      WriteToTypedArray(taWrite, i, i);
     }
-    assertFalse(a === r);
+
+    // Orig. array: [0, 1, 2, 3, 4, 5]
+    //              [0, 1, 2, 3] << fixedLength
+    //                    [2, 3] << fixedLengthWithOffset
+    //              [0, 1, 2, 3, 4, 5, ...] << lengthTracking
+    //                    [2, 3, 4, 5, ...] << lengthTrackingWithOffset
+
+    CheckToReversed(fixedLength);
+    CheckToReversed(fixedLengthWithOffset);
+    CheckToReversed(lengthTracking);
+    CheckToReversed(lengthTrackingWithOffset);
+  }
+})();
+
+(function TestGrowableSAB() {
+  for (let TA of ctors) {
+    const gsab = CreateGrowableSharedArrayBuffer(4 * TA.BYTES_PER_ELEMENT,
+                                           8 * TA.BYTES_PER_ELEMENT);
+    const fixedLength = new TA(gsab, 0, 4);
+    const fixedLengthWithOffset = new TA(gsab, 2 * TA.BYTES_PER_ELEMENT, 2);
+    const lengthTracking = new TA(gsab, 0);
+    const lengthTrackingWithOffset = new TA(gsab, 2 * TA.BYTES_PER_ELEMENT);
+
+    // Write some data into the array.
+    const taWrite = new TA(gsab);
+    for (let i = 0; i < 4; i++) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+
+    // Orig. array: [0, 2, 4, 6]
+    //              [0, 2, 4, 6] << fixedLength
+    //                    [4, 6] << fixedLengthWithOffset
+    //              [0, 2, 4, 6, ...] << lengthTracking
+    //                    [4, 6, ...] << lengthTrackingWithOffset
+    CheckToReversed(fixedLength);
+    CheckToReversed(fixedLengthWithOffset);
+    CheckToReversed(lengthTracking);
+    CheckToReversed(lengthTrackingWithOffset);
+
+    // Grow.
+    gsab.grow(6 * TA.BYTES_PER_ELEMENT);
+    for (let i = 0; i < 6; ++i) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+
+    // Orig. array: [0, 2, 4, 6, 8, 10]
+    //              [0, 2, 4, 6] << fixedLength
+    //                    [4, 6] << fixedLengthWithOffset
+    //              [0, 2, 4, 6, 8, 10, ...] << lengthTracking
+    //                    [4, 6, 8, 10, ...] << lengthTrackingWithOffset
+    CheckToReversed(fixedLength);
+    CheckToReversed(fixedLengthWithOffset);
+    CheckToReversed(lengthTracking);
+    CheckToReversed(lengthTrackingWithOffset);
+  }
+})();
+
+(function TestDetached() {
+  for (let TA of ctors) {
+    let a = new TA(4);
+    %ArrayBufferDetach(a.buffer);
+    assertThrows(() => { a.toReversed(); }, TypeError);
   }
 })();