[JSC] Align %TypedArray%.prototype.includes with ECMA-262

Gumichocopengin8 · sosukesuzuki · commit e8fa381db9af · 2025-12-15T17:20:14.000-08:00
https://bugs.webkit.org/show_bug.cgi?id=304149 Reviewed by Yusuke Suzuki and Sosuke Suzuki. This patch fixes `%TypedArray%.prototype.includes` by adding range check to ensure the `index` is less than the array length, aligning the behavior with ECMA-262[1]. [1]: https://tc39.es/ecma262/#sec-%typedarray%.prototype.includes Test: JSTests/stress/typedarray-resize-includes.js * JSTests/stress/typedarray-resize-includes.js: Added. (shouldBe): (throw.new.Error): * JSTests/test262/expectations.yaml: * Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h: (JSC::genericTypedArrayViewProtoFuncIncludes): Canonical link: https://commits.webkit.org/304485@main
diff --git a/JSTests/stress/typedarray-resize-includes.js b/JSTests/stress/typedarray-resize-includes.js
@@ -0,0 +1,37 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected) {
+        throw new Error(`actual: ${actual}, expected: ${expected}`);
+    }
+}
+
+{
+    var arraybuffer = new ArrayBuffer(4, { maxByteLength: 20 });
+    var byteOffset = 1; // Uses byteOffset to make typed array out-of-bounds when shrinking size to zero.
+    var int8array = new Int8Array(arraybuffer, byteOffset);
+    var index = {
+        valueOf() {
+            arraybuffer.resize(0);
+            return 10;
+        },
+    };
+    shouldBe(int8array.length, 3);
+    var result = int8array.includes(undefined, index);
+    shouldBe(int8array.length, 0);
+    shouldBe(result, false);
+}
+
+{
+    var arraybuffer = new ArrayBuffer(2, { maxByteLength: 20 });
+    var intarray = new Int8Array(arraybuffer);
+    intarray[0] = 21;
+    intarray[1] = 31;
+    shouldBe(intarray.length, 2);
+    arraybuffer.resize(1);
+    shouldBe(intarray.length, 1);
+    shouldBe(intarray.includes(21), true);
+    shouldBe(intarray.includes(31), false);
+    arraybuffer.resize(0);
+    shouldBe(intarray.length, 0);
+    shouldBe(intarray.includes(21), false);
+    shouldBe(intarray.includes(31), false);
+}
diff --git a/JSTests/test262/expectations.yaml b/JSTests/test262/expectations.yaml
@@ -409,9 +409,6 @@ test/built-ins/Temporal/PlainTime/prototype/until/order-of-operations.js:
 test/built-ins/Temporal/getOwnPropertyNames.js:
   default: 'Test262Error: ZonedDateTime'
   strict mode: 'Test262Error: ZonedDateTime'
-test/built-ins/TypedArray/prototype/includes/index-compared-against-initial-length-out-of-bounds.js:
-  default: 'Test262Error: Expected SameValue(«true», «false») to be true'
-  strict mode: 'Test262Error: Expected SameValue(«true», «false») to be true'
 test/built-ins/TypedArray/prototype/includes/index-compared-against-initial-length.js:
   default: 'Test262Error: Expected SameValue(«true», «false») to be true'
   strict mode: 'Test262Error: Expected SameValue(«true», «false») to be true'
diff --git a/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h b/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h
@@ -455,7 +455,7 @@ ALWAYS_INLINE EncodedJSValue genericTypedArrayViewProtoFuncIncludes(VM& vm, JSGl
         IdempotentArrayBufferByteLengthGetter<std::memory_order_seq_cst> getter;
         auto lengthValue = integerIndexedObjectLength(thisObject, getter);
         if (!lengthValue) [[unlikely]]
-            return JSValue::encode(jsBoolean(valueToFind.isUndefined()));
+            return JSValue::encode(jsBoolean(index < length && valueToFind.isUndefined()));
 
         updatedLength = lengthValue.value();
     }

Original file line number	Diff line number	Diff line change
`@@ -455,7 +455,7 @@ ALWAYS_INLINE EncodedJSValue genericTypedArrayViewProtoFuncIncludes(VM& vm, JSGl`
`455`	`455`	`IdempotentArrayBufferByteLengthGetter<std::memory_order_seq_cst> getter;`
`456`	`456`	`auto lengthValue = integerIndexedObjectLength(thisObject, getter);`
`457`	`457`	`if (!lengthValue) [[unlikely]]`
`458`		`- return JSValue::encode(jsBoolean(valueToFind.isUndefined()));`
	`458`	`+ return JSValue::encode(jsBoolean(index < length && valueToFind.isUndefined()));`
`459`	`459`
`460`	`460`	`updatedLength = lengthValue.value();`
`461`	`461`	`}`