[rab/gsab]: RAB/GSAB support for Function.p.apply

Bug: v8:11111, chromium:1321013
Change-Id: Iec45b885e844ab02059470dd514f47133b0a6efe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650596Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80583}

src/objects/objects.cc

@@ -1035,8 +1035,8 @@ MaybeHandle<FixedArray> CreateListFromArrayLikeFastPath(
           isolate, array, length);
     } else if (object->IsJSTypedArray()) {
       Handle<JSTypedArray> array = Handle<JSTypedArray>::cast(object);
-      size_t length = array->length();
-      if (array->WasDetached() ||
+      size_t length = array->GetLength();
+      if (array->IsDetachedOrOutOfBounds() ||
           length > static_cast<size_t>(FixedArray::kMaxLength)) {
         return MaybeHandle<FixedArray>();
       }

test/mjsunit/typedarray-growablesharedarraybuffer.js

@@ -3682,3 +3682,37 @@ function TestIterationAndGrow(ta, expected, gsab, grow_after,
     Object.freeze(lengthTrackingWithOffset);
   }
 })();
+
+(function FunctionApply() {
+  for (let ctor of ctors) {
+    const gsab = CreateGrowableSharedArrayBuffer(4 * ctor.BYTES_PER_ELEMENT,
+                                                 8 * ctor.BYTES_PER_ELEMENT);
+    const fixedLength = new ctor(gsab, 0, 4);
+    const fixedLengthWithOffset = new ctor(gsab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+    const lengthTracking = new ctor(gsab, 0);
+    const lengthTrackingWithOffset = new ctor(gsab, 2 * ctor.BYTES_PER_ELEMENT);
+
+    const taWrite = new ctor(gsab);
+    for (let i = 0; i < 4; ++i) {
+      WriteToTypedArray(taWrite, i, i);
+    }
+
+    function func(...args) {
+      return [...args];
+    }
+
+    assertEquals([0, 1, 2, 3], ToNumbers(func.apply(null, fixedLength)));
+    assertEquals([2, 3], ToNumbers(func.apply(null, fixedLengthWithOffset)));
+    assertEquals([0, 1, 2, 3], ToNumbers(func.apply(null, lengthTracking)));
+    assertEquals([2, 3], ToNumbers(func.apply(null, lengthTrackingWithOffset)));
+
+    // Grow.
+    gsab.grow(6 * ctor.BYTES_PER_ELEMENT);
+    assertEquals([0, 1, 2, 3], ToNumbers(func.apply(null, fixedLength)));
+    assertEquals([2, 3], ToNumbers(func.apply(null, fixedLengthWithOffset)));
+    assertEquals([0, 1, 2, 3, 0, 0],
+                 ToNumbers(func.apply(null, lengthTracking)));
+    assertEquals([2, 3, 0, 0],
+                 ToNumbers(func.apply(null, lengthTrackingWithOffset)));
+  }
+})();

test/mjsunit/typedarray-resizablearraybuffer-detach.js

@@ -1487,3 +1487,35 @@ d8.file.execute('test/mjsunit/typedarray-helpers.js');
     assertThrows(() => { helper(lengthTracking, evil, 8); }, TypeError);
   }
 })();
+
+(function FunctionApply() {
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT,
+                                           8 * ctor.BYTES_PER_ELEMENT);
+    const fixedLength = new ctor(rab, 0, 4);
+    const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+    const lengthTracking = new ctor(rab, 0);
+    const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+    const taWrite = new ctor(rab);
+    for (let i = 0; i < 4; ++i) {
+      WriteToTypedArray(taWrite, i, i);
+    }
+
+    function func(...args) {
+      return [...args];
+    }
+
+    assertEquals([0, 1, 2, 3], ToNumbers(func.apply(null, fixedLength)));
+    assertEquals([2, 3], ToNumbers(func.apply(null, fixedLengthWithOffset)));
+    assertEquals([0, 1, 2, 3], ToNumbers(func.apply(null, lengthTracking)));
+    assertEquals([2, 3], ToNumbers(func.apply(null, lengthTrackingWithOffset)));
+
+    %ArrayBufferDetach(rab);
+
+    assertEquals([], ToNumbers(func.apply(null, fixedLength)));
+    assertEquals([], ToNumbers(func.apply(null, fixedLengthWithOffset)));
+    assertEquals([], ToNumbers(func.apply(null, lengthTracking)));
+    assertEquals([], ToNumbers(func.apply(null, lengthTrackingWithOffset)));
+  }
+})();

test/mjsunit/typedarray-resizablearraybuffer.js

@@ -6751,3 +6751,61 @@ function TestIterationAndResize(ta, expected, rab, resize_after,
     Object.freeze(lengthTracking);
   }
 })();
+
+(function FunctionApply() {
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT,
+                                           8 * ctor.BYTES_PER_ELEMENT);
+    const fixedLength = new ctor(rab, 0, 4);
+    const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+    const lengthTracking = new ctor(rab, 0);
+    const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+    const taWrite = new ctor(rab);
+    for (let i = 0; i < 4; ++i) {
+      WriteToTypedArray(taWrite, i, i);
+    }
+
+    function func(...args) {
+      return [...args];
+    }
+
+    assertEquals([0, 1, 2, 3], ToNumbers(func.apply(null, fixedLength)));
+    assertEquals([2, 3], ToNumbers(func.apply(null, fixedLengthWithOffset)));
+    assertEquals([0, 1, 2, 3], ToNumbers(func.apply(null, lengthTracking)));
+    assertEquals([2, 3], ToNumbers(func.apply(null, lengthTrackingWithOffset)));
+
+    // Shrink so that fixed length TAs go out of bounds.
+    rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+
+    assertEquals([], ToNumbers(func.apply(null, fixedLength)));
+    assertEquals([], ToNumbers(func.apply(null, fixedLengthWithOffset)));
+    assertEquals([0, 1, 2], ToNumbers(func.apply(null, lengthTracking)));
+    assertEquals([2], ToNumbers(func.apply(null, lengthTrackingWithOffset)));
+
+    // Shrink so that the TAs with offset go out of bounds.
+    rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+
+    assertEquals([], ToNumbers(func.apply(null, fixedLength)));
+    assertEquals([], ToNumbers(func.apply(null, fixedLengthWithOffset)));
+    assertEquals([0], ToNumbers(func.apply(null, lengthTracking)));
+    assertEquals([], ToNumbers(func.apply(null, lengthTrackingWithOffset)));
+
+     // Shrink to zero.
+    rab.resize(0);
+
+    assertEquals([], ToNumbers(func.apply(null, fixedLength)));
+    assertEquals([], ToNumbers(func.apply(null, fixedLengthWithOffset)));
+    assertEquals([], ToNumbers(func.apply(null, lengthTracking)));
+    assertEquals([], ToNumbers(func.apply(null, lengthTrackingWithOffset)));
+
+    // Grow so that all TAs are back in-bounds. New memory is zeroed.
+    rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+    assertEquals([0, 0, 0, 0], ToNumbers(func.apply(null, fixedLength)));
+    assertEquals([0, 0], ToNumbers(func.apply(null, fixedLengthWithOffset)));
+    assertEquals([0, 0, 0, 0, 0, 0],
+                 ToNumbers(func.apply(null, lengthTracking)));
+    assertEquals([0, 0, 0, 0],
+                 ToNumbers(func.apply(null, lengthTrackingWithOffset)));
+  }
+})();