[rab/gsab] RAB/GSAB support in TA.p.subarray

Bug: v8:11111
Change-Id: I58b76ce0ad47eb47ccbd0244b110f7cb0450ced8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3468349Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79350}

src/builtins/typed-array-subarray.tq

@@ -20,42 +20,49 @@ transitioning javascript builtin TypedArrayPrototypeSubArray(
   const buffer = typed_array::GetTypedArrayBuffer(source);
 
   // 6. Let srcLength be O.[[ArrayLength]].
-  const srcLength: uintptr = source.length;
+  let srcLength: uintptr;
+  try {
+    srcLength = LoadJSTypedArrayLengthAndCheckDetached(source)
+        otherwise DetachedOrOutOfBounds;
+  } label DetachedOrOutOfBounds {
+    // 7. If srcLength is out-of-bounds, set srcLength to 0.
+    srcLength = 0;
+  }
 
-  // 7. Let relativeBegin be ? ToInteger(begin).
-  // 8. If relativeBegin < 0, let beginIndex be max((srcLength +
+  // 8. Let relativeBegin be ? ToInteger(begin).
+  // 9. If relativeBegin < 0, let beginIndex be max((srcLength +
   // relativeBegin), 0); else let beginIndex be min(relativeBegin,
   // srcLength).
   const arg0 = arguments[0];
   const begin: uintptr =
       arg0 != Undefined ? ConvertToRelativeIndex(arg0, srcLength) : 0;
 
-  // 9. If end is undefined, let relativeEnd be srcLength;
+  // 10. If end is undefined, let relativeEnd be srcLength;
   //      else, let relativeEnd be ? ToInteger(end).
-  // 10. If relativeEnd < 0, let endIndex be max((srcLength + relativeEnd),
+  // 11. If relativeEnd < 0, let endIndex be max((srcLength + relativeEnd),
   // 0); else let endIndex be min(relativeEnd, srcLength).
   const arg1 = arguments[1];
   const end: uintptr =
       arg1 != Undefined ? ConvertToRelativeIndex(arg1, srcLength) : srcLength;
 
-  // 11. Let newLength be max(endIndex - beginIndex, 0).
+  // 12. Let newLength be max(endIndex - beginIndex, 0).
   const newLength: uintptr = Unsigned(IntPtrMax(Signed(end - begin), 0));
 
-  // 12. Let constructorName be the String value of O.[[TypedArrayName]].
-  // 13. Let elementSize be the Number value of the Element Size value
+  // 13. Let constructorName be the String value of O.[[TypedArrayName]].
+  // 14. Let elementSize be the Number value of the Element Size value
   // specified in Table 52 for constructorName.
   const elementsInfo = typed_array::GetTypedArrayElementsInfo(source);
 
-  // 14. Let srcByteOffset be O.[[ByteOffset]].
+  // 15. Let srcByteOffset be O.[[ByteOffset]].
   const srcByteOffset: uintptr = source.byte_offset;
 
-  // 15. Let beginByteOffset be srcByteOffset + beginIndex × elementSize.
+  // 16. Let beginByteOffset be srcByteOffset + beginIndex × elementSize.
   const beginByteOffset =
       srcByteOffset + elementsInfo.CalculateByteLength(begin)
       otherwise ThrowRangeError(MessageTemplate::kInvalidArrayBufferLength);
 
-  // 16. Let argumentsList be « buffer, beginByteOffset, newLength ».
-  // 17. Return ? TypedArraySpeciesCreate(O, argumentsList).
+  // 17. Let argumentsList be « buffer, beginByteOffset, newLength ».
+  // 18. Return ? TypedArraySpeciesCreate(O, argumentsList).
   return TypedArraySpeciesCreateByBuffer(
       methodName, source, buffer, beginByteOffset, newLength);
 }

test/mjsunit/typedarray-growablesharedarraybuffer.js

@@ -3260,3 +3260,107 @@ function TestIterationAndGrow(ta, expected, gsab, grow_after,
     }
   }
 })();
+
+(function Subarray() {
+  for (let ctor of ctors) {
+    const gsab = CreateGrowableSharedArrayBuffer(4 * ctor.BYTES_PER_ELEMENT,
+                                                 8 * ctor.BYTES_PER_ELEMENT);
+    const fixedLength = new ctor(gsab, 0, 4);
+    const fixedLengthWithOffset = new ctor(gsab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+    const lengthTracking = new ctor(gsab, 0);
+    const lengthTrackingWithOffset = new ctor(gsab, 2 * ctor.BYTES_PER_ELEMENT);
+
+    // Write some data into the array.
+    const taWrite = new ctor(gsab);
+    for (let i = 0; i < 4; ++i) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+
+    // Orig. array: [0, 2, 4, 6]
+    //              [0, 2, 4, 6] << fixedLength
+    //                    [4, 6] << fixedLengthWithOffset
+    //              [0, 2, 4, 6, ...] << lengthTracking
+    //                    [4, 6, ...] << lengthTrackingWithOffset
+
+    const fixedLengthSubFull = fixedLength.subarray(0);
+    assertEquals([0, 2, 4, 6], ToNumbers(fixedLengthSubFull));
+    const fixedLengthWithOffsetSubFull = fixedLengthWithOffset.subarray(0);
+    assertEquals([4, 6], ToNumbers(fixedLengthWithOffsetSubFull));
+    const lengthTrackingSubFull = lengthTracking.subarray(0);
+    assertEquals([0, 2, 4, 6], ToNumbers(lengthTrackingSubFull));
+    const lengthTrackingWithOffsetSubFull =
+        lengthTrackingWithOffset.subarray(0);
+    assertEquals([4, 6], ToNumbers(lengthTrackingWithOffsetSubFull));
+
+    // Relative offsets
+    assertEquals([4, 6], ToNumbers(fixedLength.subarray(-2)));
+    assertEquals([6], ToNumbers(fixedLengthWithOffset.subarray(-1)));
+    assertEquals([4, 6], ToNumbers(lengthTracking.subarray(-2)));
+    assertEquals([6], ToNumbers(lengthTrackingWithOffset.subarray(-1)));
+
+    // Grow.
+    gsab.grow(6 * ctor.BYTES_PER_ELEMENT);
+    for (let i = 0; i < 6; ++i) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+
+    // Orig. array: [0, 2, 4, 6, 8, 10]
+    //              [0, 2, 4, 6] << fixedLength
+    //                    [4, 6] << fixedLengthWithOffset
+    //              [0, 2, 4, 6, 8, 10, ...] << lengthTracking
+    //                    [4, 6, 8, 10, ...] << lengthTrackingWithOffset
+
+    assertEquals([0, 2, 4, 6], ToNumbers(fixedLength.subarray(0)));
+    assertEquals([4, 6], ToNumbers(fixedLengthWithOffset.subarray(0)));
+    assertEquals([0, 2, 4, 6, 8, 10], ToNumbers(lengthTracking.subarray(0)));
+    assertEquals([4, 6, 8, 10],
+                 ToNumbers(lengthTrackingWithOffset.subarray(0)));
+
+    assertEquals(4, fixedLengthSubFull.length);
+    assertEquals(2, fixedLengthWithOffsetSubFull.length);
+
+    // TODO(v8:11111): Are subarrays of length-tracking TAs also
+    // length-tracking? See
+    // https://github.com/tc39/proposal-resizablearraybuffer/issues/91
+    assertEquals(4, lengthTrackingSubFull.length);
+    assertEquals(2, lengthTrackingWithOffsetSubFull.length);
+  }
+})();
+
+(function SubarrayParameterConversionGrows() {
+  // Orig. array: [0, 2, 4, 6]
+  //              [0, 2, 4, 6] << fixedLength
+  //              [0, 2, 4, 6, ...] << lengthTracking
+  function CreateGsabForTest(ctor) {
+    const gsab = CreateGrowableSharedArrayBuffer(4 * ctor.BYTES_PER_ELEMENT,
+                                                 8 * ctor.BYTES_PER_ELEMENT);
+    // Write some data into the array.
+    const taWrite = new ctor(gsab);
+    for (let i = 0; i < 4; ++i) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+    return gsab;
+  }
+
+  // Growing + fixed-length TA. Growing won't affect anything.
+  for (let ctor of ctors) {
+    const gsab = CreateGsabForTest(ctor);
+    const fixedLength = new ctor(gsab, 0, 4);
+
+    const evil = { valueOf: () => { gsab.grow(6 * ctor.BYTES_PER_ELEMENT);
+                                    return 0;}};
+    assertEquals([0, 2, 4, 6], ToNumbers(fixedLength.subarray(evil)));
+  }
+
+  // Growing + length-tracking TA. The length computation is done with the
+  // original length.
+  for (let ctor of ctors) {
+    const gsab = CreateGsabForTest(ctor);
+    const lengthTracking = new ctor(gsab, 0);
+
+    const evil = { valueOf: () => { gsab.grow(6 * ctor.BYTES_PER_ELEMENT);
+                                    return 0;}};
+
+    assertEquals([0, 2, 4, 6], ToNumbers(lengthTracking.subarray(evil)));
+  }
+})();

test/mjsunit/typedarray-resizablearraybuffer-detach.js

@@ -1329,3 +1329,118 @@ d8.file.execute('test/mjsunit/typedarray-helpers.js');
                  TypeError);
   }
 })();
+
+(function Subarray() {
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT,
+                                           8 * ctor.BYTES_PER_ELEMENT);
+    const fixedLength = new ctor(rab, 0, 4);
+    const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+    const lengthTracking = new ctor(rab, 0);
+    const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+    // Write some data into the array.
+    const taWrite = new ctor(rab);
+    for (let i = 0; i < 4; ++i) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+
+    // Orig. array: [0, 2, 4, 6]
+    //              [0, 2, 4, 6] << fixedLength
+    //                    [4, 6] << fixedLengthWithOffset
+    //              [0, 2, 4, 6, ...] << lengthTracking
+    //                    [4, 6, ...] << lengthTrackingWithOffset
+
+    const fixedLengthSubFull = fixedLength.subarray(0);
+    assertEquals([0, 2, 4, 6], ToNumbers(fixedLengthSubFull));
+    const fixedLengthWithOffsetSubFull = fixedLengthWithOffset.subarray(0);
+    assertEquals([4, 6], ToNumbers(fixedLengthWithOffsetSubFull));
+    const lengthTrackingSubFull = lengthTracking.subarray(0);
+    assertEquals([0, 2, 4, 6], ToNumbers(lengthTrackingSubFull));
+    const lengthTrackingWithOffsetSubFull =
+        lengthTrackingWithOffset.subarray(0);
+    assertEquals([4, 6], ToNumbers(lengthTrackingWithOffsetSubFull));
+
+    %ArrayBufferDetach(rab);
+
+    // The previously created subarrays are OOB.
+    assertEquals(0, fixedLengthSubFull.length);
+    assertEquals(0, fixedLengthWithOffsetSubFull.length);
+    assertEquals(0, lengthTrackingSubFull.length);
+    assertEquals(0, lengthTrackingWithOffsetSubFull.length);
+
+    // Trying to create new subarrays fails.
+    assertThrows(() => { fixedLength.subarray(0); }, TypeError);
+    assertThrows(() => { fixedLengthWithOffset.subarray(0); }, TypeError);
+    assertThrows(() => { lengthTracking.subarray(0); }, TypeError);
+    assertThrows(() => { lengthTrackingWithOffset.subarray(0); }, TypeError);
+  }
+})();
+
+(function SubarrayParameterConversionDetaches() {
+  // Orig. array: [0, 2, 4, 6]
+  //              [0, 2, 4, 6] << fixedLength
+  //              [0, 2, 4, 6, ...] << lengthTracking
+  function CreateRabForTest(ctor) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT,
+                                           8 * ctor.BYTES_PER_ELEMENT);
+    // Write some data into the array.
+    const taWrite = new ctor(rab);
+    for (let i = 0; i < 4; ++i) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+    return rab;
+  }
+
+  // Fixed-length TA + first parameter conversion detaches. Can't construct
+  // even zero-length TAs with a detached buffer.
+  for (let ctor of ctors) {
+    const rab = CreateRabForTest(ctor);
+    const fixedLength = new ctor(rab, 0, 4);
+
+    let evil = { valueOf: () => {
+      %ArrayBufferDetach(rab);
+      return 0;
+    }};
+    assertThrows(() => { fixedLength.subarray(evil, 0); }, TypeError);
+  }
+
+  // Length-tracking TA + first parameter conversion detaches. Can't construct
+  // even zero-length TAs with a detached buffer.
+  for (let ctor of ctors) {
+    const rab = CreateRabForTest(ctor);
+    const fixedLength = new ctor(rab, 0, 4);
+
+    let evil = { valueOf: () => {
+      %ArrayBufferDetach(rab);
+      return 0;
+    }};
+    assertThrows(() => { fixedLength.subarray(evil, 0); }, TypeError);
+  }
+
+  // Fixed-length TA + second parameter conversion detaches. Can't construct
+  // even zero-length TAs with a detached buffer.
+  for (let ctor of ctors) {
+    const rab = CreateRabForTest(ctor);
+    const fixedLength = new ctor(rab, 0, 4);
+
+    let evil = { valueOf: () => {
+      %ArrayBufferDetach(rab);
+      return 0;
+    }};
+    assertThrows(() => { fixedLength.subarray(0, evil); }, TypeError);
+  }
+
+  // Length-tracking TA + second parameter conversion detaches. Can't construct
+  // even zero-length TAs with a detached buffer.
+  for (let ctor of ctors) {
+    const rab = CreateRabForTest(ctor);
+    const fixedLength = new ctor(rab, 0, 4);
+
+    let evil = { valueOf: () => {
+      %ArrayBufferDetach(rab);
+      return 0;
+    }};
+    assertThrows(() => { fixedLength.subarray(0, evil); }, TypeError);
+  }
+})();