According to the spec, TypedArray.prototype.set checks
IsImmutableBuffer(target.[[ViewedArrayBuffer]]) before converting
the offset argument to integer and before reading from the source
object.
Additionally, when setting from a TypedArray source, reading from an
immutable source TypedArray is permitted, so the source array should
be validated using TypedArrayAccessMode::kRead rather than kWrite.
Drive-By: Add a fast case for Smi indices where the steps are not
observable and we can fold all checks.
TAG=agy
CONV=94aa3be8-9990-41fe-a565-c62e3daa9a42
Bug: 450237486
Change-Id: I21790be90cde9a96ba7c1f573f034016d9c29850
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8252528
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#109366}
- Add non-generic transferToImmutable validation tests
- Extend DataView setter coverage to ensure all write paths throw
- Fix duplicate test name for sliceToImmutable order checks
This improves coverage for invalid receivers, multi-byte DataView
writes, and ensures test clarity by removing duplicate test names.
Change-Id: I5ad8c50c7c39216f56ffe15beb66bf2c595fd305
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7257714
Commit-Queue: Seokho Song <seokho@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Seokho Song <seokho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#104456}
Olivier Flückiger