[change-array-by-copy] Fix toReversed for empty and large arrays

Bug: chromium:1367107, v8:12764
Change-Id: I0d07fc49eb68b1fa1a22635411e9b6b79ef2e2d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3915483Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83408}

src/builtins/array-to-reversed.tq

@@ -8,8 +8,8 @@ macro FastPackedArrayToReversed<Accessor: type, T: type>(
     kind: constexpr ElementsKind, elements: FixedArrayBase,
     length: Smi): JSArray {
   // 3. Let A be ? ArrayCreate(𝔽(len)).
-  const copy: FixedArrayBase =
-      AllocateFixedArray(kind, SmiUntag(length), AllocationFlag::kNone);
+  const copy: FixedArrayBase = AllocateFixedArray(
+      kind, SmiUntag(length), AllocationFlag::kAllowLargeObjectAllocation);
 
   // 4. Let k be 0.
   let k: Smi = 0;
@@ -39,6 +39,8 @@ macro TryFastPackedArrayToReversed(implicit context: Context)(receiver: JSAny):
     JSArray labels Slow {
   const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
 
+  if (array.length < 1) return ArrayCreate(0);
+
   const kind: ElementsKind = array.map.elements_kind;
   if (kind == ElementsKind::PACKED_SMI_ELEMENTS) {
     return FastPackedArrayToReversed<array::FastPackedSmiElements, Smi>(

test/mjsunit/harmony/array-to-reversed.js

@@ -57,6 +57,19 @@ assertEquals("toReversed", Array.prototype.toReversed.name);
   assertEquals(["1st","2nd","3rd","4th"], order);
 })();
 
+(function TestEmpty() {
+  assertEquals([], [].toReversed());
+})();
+
+(function TestBig() {
+  let a = [];
+  for (let i = 0; i < 50000; i++) a.push(i);
+  let r = a.toReversed();
+  for (let i = 0; i < 50000; i++) {
+    assertEquals(r[i], a.at(-(i+1)));
+  }
+})();
+
 (function TestTooBig() {
   let a = { length: Math.pow(2, 32) };
   assertThrows(() => Array.prototype.toReversed.call(a), RangeError);