[rab/gsab] Fix length-tracking TAs with offsets

Bug: v8:11111
Change-Id: I7ff82d1699701dfa38af1da447f0b40a2a2c97b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3053586Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75914}

src/objects/js-array-buffer-inl.h

@@ -204,9 +204,17 @@ size_t JSTypedArray::GetLength() const {
   if (WasDetached()) return 0;
   if (is_length_tracking()) {
     if (is_backed_by_rab()) {
-      return buffer().byte_length() / element_size();
+      if (byte_offset() >= buffer().byte_length()) {
+        return 0;
+      }
+      return (buffer().byte_length() - byte_offset()) / element_size();
     }
-    return buffer().GetBackingStore()->byte_length(std::memory_order_seq_cst) /
+    if (byte_offset() >=
+        buffer().GetBackingStore()->byte_length(std::memory_order_seq_cst)) {
+      return 0;
+    }
+    return (buffer().GetBackingStore()->byte_length(std::memory_order_seq_cst) -
+            byte_offset()) /
            element_size();
   }
   size_t array_length = LengthUnchecked();

test/mjsunit/typedarray-growablesharedarraybuffer.js

@@ -345,6 +345,44 @@ function CreateGrowableSharedArrayBuffer(byteLength, maxByteLength) {
   }
 })();
 
+(function HasWithOffsetsWithFeedback() {
+  function GetElements(ta) {
+    let result = '';
+    for (let i = 0; i < 8; ++i) {
+      result += (i in ta) + ',';
+      //           ^ feedback will be here
+    }
+    return result;
+  }
+  %EnsureFeedbackVectorForFunction(GetElements);
+
+  const gsab = CreateGrowableSharedArrayBuffer(4, 8);
+  const fixedLength = new Int8Array(gsab, 0, 4);
+  const fixedLengthWithOffset = new Int8Array(gsab, 1, 3);
+  const lengthTracking = new Int8Array(gsab, 0);
+  const lengthTrackingWithOffset = new Int8Array(gsab, 1);
+
+  assertEquals('true,true,true,true,false,false,false,false,',
+               GetElements(fixedLength));
+  assertEquals('true,true,true,false,false,false,false,false,',
+              GetElements(fixedLengthWithOffset));
+  assertEquals('true,true,true,true,false,false,false,false,',
+              GetElements(lengthTracking));
+  assertEquals('true,true,true,false,false,false,false,false,',
+              GetElements(lengthTrackingWithOffset));
+
+  gsab.grow(8);
+
+  assertEquals('true,true,true,true,false,false,false,false,',
+               GetElements(fixedLength));
+  assertEquals('true,true,true,false,false,false,false,false,',
+               GetElements(fixedLengthWithOffset));
+  assertEquals('true,true,true,true,true,true,true,true,',
+               GetElements(lengthTracking));
+  assertEquals('true,true,true,true,true,true,true,false,',
+               GetElements(lengthTrackingWithOffset));
+})();
+
 (function EnumerateElements() {
   let gsab = CreateGrowableSharedArrayBuffer(100, 200);
   for (let ctor of ctors) {

test/mjsunit/typedarray-resizablearraybuffer.js

@@ -503,6 +503,66 @@ function CreateResizableArrayBuffer(byteLength, maxByteLength) {
   }
 })();
 
+(function HasWithOffsetsWithFeedback() {
+  function GetElements(ta) {
+    let result = '';
+    for (let i = 0; i < 8; ++i) {
+      result += (i in ta) + ',';
+      //           ^ feedback will be here
+    }
+    return result;
+  }
+  %EnsureFeedbackVectorForFunction(GetElements);
+
+  const rab = CreateResizableArrayBuffer(4, 8);
+  const fixedLength = new Int8Array(rab, 0, 4);
+  const fixedLengthWithOffset = new Int8Array(rab, 1, 3);
+  const lengthTracking = new Int8Array(rab, 0);
+  const lengthTrackingWithOffset = new Int8Array(rab, 1);
+
+  assertEquals('true,true,true,true,false,false,false,false,',
+               GetElements(fixedLength));
+  assertEquals('true,true,true,false,false,false,false,false,',
+              GetElements(fixedLengthWithOffset));
+  assertEquals('true,true,true,true,false,false,false,false,',
+              GetElements(lengthTracking));
+  assertEquals('true,true,true,false,false,false,false,false,',
+              GetElements(lengthTrackingWithOffset));
+
+  rab.resize(2);
+
+  assertEquals('false,false,false,false,false,false,false,false,',
+               GetElements(fixedLength));
+  assertEquals('false,false,false,false,false,false,false,false,',
+              GetElements(fixedLengthWithOffset));
+  assertEquals('true,true,false,false,false,false,false,false,',
+              GetElements(lengthTracking));
+  assertEquals('true,false,false,false,false,false,false,false,',
+              GetElements(lengthTrackingWithOffset));
+
+  // Resize beyond the offset of the length tracking arrays.
+  rab.resize(1);
+  assertEquals('false,false,false,false,false,false,false,false,',
+               GetElements(fixedLength));
+  assertEquals('false,false,false,false,false,false,false,false,',
+              GetElements(fixedLengthWithOffset));
+  assertEquals('true,false,false,false,false,false,false,false,',
+              GetElements(lengthTracking));
+  assertEquals('false,false,false,false,false,false,false,false,',
+              GetElements(lengthTrackingWithOffset));
+
+  rab.resize(8);
+
+  assertEquals('true,true,true,true,false,false,false,false,',
+               GetElements(fixedLength));
+  assertEquals('true,true,true,false,false,false,false,false,',
+               GetElements(fixedLengthWithOffset));
+  assertEquals('true,true,true,true,true,true,true,true,',
+               GetElements(lengthTracking));
+  assertEquals('true,true,true,true,true,true,true,false,',
+               GetElements(lengthTrackingWithOffset));
+})();
+
 (function StoreToOutOfBoundsTypedArrayWithFeedback() {
   function WriteElement2(ta, i) {
     ta[2] = i;

test/test262/test262.status

@@ -597,9 +597,6 @@
   'built-ins/DataView/prototype/setUint8/resizable-buffer': [FAIL],
   'built-ins/TypedArrayConstructors/ctors/typedarray-arg/out-of-bounds-when-species-retrieved-different-type': [FAIL],
   'built-ins/TypedArrayConstructors/ctors/typedarray-arg/out-of-bounds-when-species-retrieved-same-type': [FAIL],
-  'built-ins/TypedArrayConstructors/internals/HasProperty/resizable-array-buffer-auto': [FAIL],
-  'built-ins/TypedArrayConstructors/internals/HasProperty/resizable-array-buffer-fixed': [FAIL],
-  'built-ins/TypedArrayConstructors/internals/OwnPropertyKeys/integer-indexes-resizable-array-buffer-auto': [FAIL],
   'built-ins/TypedArray/prototype/at/return-abrupt-from-this-out-of-bounds': [FAIL],
   'built-ins/TypedArray/prototype/byteOffset/resizable-array-buffer-auto': [FAIL],
   'built-ins/TypedArray/prototype/byteOffset/resizable-array-buffer-fixed': [FAIL],
@@ -692,6 +689,9 @@
   'built-ins/SharedArrayBuffer/prototype/growable/this-is-arraybuffer': [FAIL],
   'built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-arraybuffer': [FAIL],
 
+  # https://github.com/tc39/test262/issues/3109
+  'built-ins/TypedArrayConstructors/internals/HasProperty/resizable-array-buffer-fixed': [FAIL],
+
   ############################ SKIPPED TESTS #############################
 
   # These tests take a looong time to run.