[rab/gsab] Fix toStringTag for RAB/GSAB-backed TypedArrays

Bug: v8:11111
Change-Id: I4846910d05bb5d83c964b2279efdb7cf2a4545b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3733028Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81451}

src/builtins/builtins-typed-array-gen.cc

@@ -11,6 +11,7 @@
 #include "src/execution/protectors.h"
 #include "src/handles/handles-inl.h"
 #include "src/heap/factory-inl.h"
+#include "src/objects/elements-kind.h"
 #include "src/objects/js-array-buffer-inl.h"
 
 namespace v8 {
@@ -573,26 +574,43 @@ TF_BUILTIN(TypedArrayPrototypeToStringTag, TypedArrayBuiltinsAssembler) {
 
   // Dispatch on the elements kind, offset by
   // FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND.
-  size_t const kTypedElementsKindCount = LAST_FIXED_TYPED_ARRAY_ELEMENTS_KIND -
-                                         FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND +
-                                         1;
+  static_assert(LAST_FIXED_TYPED_ARRAY_ELEMENTS_KIND + 1 ==
+                FIRST_RAB_GSAB_FIXED_TYPED_ARRAY_ELEMENTS_KIND);
+  size_t const kTypedElementsKindCount =
+      LAST_RAB_GSAB_FIXED_TYPED_ARRAY_ELEMENTS_KIND -
+      FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND + 1;
 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype) \
   Label return_##type##array(this);               \
   BIND(&return_##type##array);                    \
   Return(StringConstant(#Type "Array"));
   TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
+
+  // clang-format off
   Label* elements_kind_labels[kTypedElementsKindCount] = {
+  // The TYPED_ARRAYS macro is invoked twice because while the RAB/GSAB-backed
+  // TAs have distinct ElementsKinds internally, they have the same "class"
+  // name for toString output.
 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype) &return_##type##array,
-      TYPED_ARRAYS(TYPED_ARRAY_CASE)
+  TYPED_ARRAYS(TYPED_ARRAY_CASE)
+  TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
   };
+
   int32_t elements_kinds[kTypedElementsKindCount] = {
 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype) \
   TYPE##_ELEMENTS - FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND,
-      TYPED_ARRAYS(TYPED_ARRAY_CASE)
+  // The use of FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND below is not a typo! This
+  // computes an index into elements_kind_labels, and all TypedArray
+  // ElementsKind values are contiguous.
+#define RAB_GSAB_TYPED_ARRAY_CASE(Type, type, TYPE, ctype) \
+  TYPE##_ELEMENTS - FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND,
+  TYPED_ARRAYS(TYPED_ARRAY_CASE)
+  RAB_GSAB_TYPED_ARRAYS(RAB_GSAB_TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
+#undef RAB_GSAB_TYPED_ARRAY_CASE
   };
+  // clang-format on
 
   // We offset the dispatch by FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND, so that
   // this can be turned into a non-sparse table switch for ideal performance.

test/mjsunit/harmony/typedarray-tostringtag.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-rab-gsab
+
+d8.file.execute('test/mjsunit/typedarray-helpers.js');
+
+const sab = new SharedArrayBuffer(4 * 8);
+const rab = CreateResizableArrayBuffer(4 * 8, 8 * 8);
+const gsab = CreateGrowableSharedArrayBuffer(4 * 8, 8 * 8);
+
+for (let TA of builtinCtors) {
+  const backedByAB = new TA();
+  const backedBySAB = new TA(sab);
+  const backedByRAB = new TA(rab);
+  const backedByGSAB = new TA(gsab);
+  const expected = `[object ${TA.name}]`;
+  assertEquals(expected, Object.prototype.toString.call(backedByAB));
+  assertEquals(expected, Object.prototype.toString.call(backedBySAB));
+  assertEquals(expected, Object.prototype.toString.call(backedByRAB));
+  assertEquals(expected, Object.prototype.toString.call(backedByGSAB));
+}

test/mjsunit/typedarray-helpers.js

@@ -6,7 +6,7 @@ class MyUint8Array extends Uint8Array {};
 class MyFloat32Array extends Float32Array {};
 class MyBigInt64Array extends BigInt64Array {};
 
-const ctors = [
+const builtinCtors = [
   Uint8Array,
   Int8Array,
   Uint16Array,
@@ -17,7 +17,11 @@ const ctors = [
   Float64Array,
   Uint8ClampedArray,
   BigUint64Array,
-  BigInt64Array,
+  BigInt64Array
+];
+
+const ctors = [
+  ...builtinCtors,
   MyUint8Array,
   MyFloat32Array,
   MyBigInt64Array,