Merging upstream version 127.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

26 files changed, 141 insertions, 12 deletions

diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer-during-fromIndex-returns-false-for-zero.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer-during-fromIndex-returns-false-for-zero.js
index 493f0bc00d..8c707f19f8 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer-during-fromIndex-returns-false-for-zero.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer-during-fromIndex-returns-false-for-zero.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2020 Rick Waldron. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 /*---
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer-during-fromIndex-returns-true-for-undefined.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer-during-fromIndex-returns-true-for-undefined.js
index 43ba9f0629..fbedbc0525 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer-during-fromIndex-returns-true-for-undefined.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer-during-fromIndex-returns-true-for-undefined.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2020 Rick Waldron. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 /*---
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer.js
index 3d8dff1368..d9e1217a7d 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/detached-buffer.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 /*---
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-equal-or-greater-length-returns-false.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-equal-or-greater-length-returns-false.js
index 4298fc7c08..9f440d7d78 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-equal-or-greater-length-returns-false.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-equal-or-greater-length-returns-false.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-infinity.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-infinity.js
index d067193aaa..4ba0bb426c 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-infinity.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-infinity.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-minus-zero.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-minus-zero.js
index 0bb301447f..149ee34f0b 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-minus-zero.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/fromIndex-minus-zero.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/get-length-uses-internal-arraylength.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/get-length-uses-internal-arraylength.js
index b7a1f870a0..48743ce951 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/get-length-uses-internal-arraylength.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/get-length-uses-internal-arraylength.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/index-compared-against-initial-length-out-of-bounds.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/index-compared-against-initial-length-out-of-bounds.js
new file mode 100644
index 0000000000..a589430e35
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/index-compared-against-initial-length-out-of-bounds.js
@@ -0,0 +1,54 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2024 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.includes
+description: >
+  Index is compared against the initial length when typed array is made out-of-bounds.
+info: |
+  %TypedArray%.prototype.includes ( searchElement [ , fromIndex ] )
+
+  ...
+  2. Let taRecord be ? ValidateTypedArray(O, seq-cst).
+  3. Let len be TypedArrayLength(taRecord).
+  ...
+  5. Let n be ? ToIntegerOrInfinity(fromIndex).
+  ...
+  9. If n ≥ 0, then
+    a. Let k be n.
+  ...
+  11. Repeat, while k < len,
+    ...
+
+features: [TypedArray, resizable-arraybuffer]
+---*/
+
+let rab = new ArrayBuffer(4, {maxByteLength: 20});
+
+// Uses byteOffset to make typed array out-of-bounds when shrinking size to zero.
+let byteOffset = 1;
+
+let ta = new Int8Array(rab, byteOffset);
+
+let index = {
+  valueOf() {
+    // Shrink buffer to zero.
+    rab.resize(0);
+
+    // Index is larger than the initial length.
+    return 10;
+  }
+};
+
+// Typed array is in-bounds.
+assert.sameValue(ta.length, 3);
+
+let result = ta.includes(undefined, index);
+
+// Typed array is out-of-bounds.
+assert.sameValue(ta.length, 0);
+
+assert.sameValue(result, false);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/index-compared-against-initial-length.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/index-compared-against-initial-length.js
new file mode 100644
index 0000000000..572381275e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/index-compared-against-initial-length.js
@@ -0,0 +1,50 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2024 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.includes
+description: >
+  Index is compared against the initial length.
+info: |
+  %TypedArray%.prototype.includes ( searchElement [ , fromIndex ] )
+
+  ...
+  2. Let taRecord be ? ValidateTypedArray(O, seq-cst).
+  3. Let len be TypedArrayLength(taRecord).
+  ...
+  5. Let n be ? ToIntegerOrInfinity(fromIndex).
+  ...
+  9. If n ≥ 0, then
+    a. Let k be n.
+  ...
+  11. Repeat, while k < len,
+    ...
+
+features: [TypedArray, resizable-arraybuffer]
+---*/
+
+let rab = new ArrayBuffer(4, {maxByteLength: 20});
+let ta = new Int8Array(rab);
+
+let index = {
+  valueOf() {
+    // Shrink buffer to zero.
+    rab.resize(0);
+
+    // Index is larger than the initial length.
+    return 10;
+  }
+};
+
+// Auto-length is correctly tracked.
+assert.sameValue(ta.length, 4);
+
+let result = ta.includes(undefined, index);
+
+// Auto-length is correctly set to zero.
+assert.sameValue(ta.length, 0);
+
+assert.sameValue(result, false);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/invoked-as-func.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/invoked-as-func.js
index d90cc7b111..bd792357bb 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/invoked-as-func.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/invoked-as-func.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 /*---
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/invoked-as-method.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/invoked-as-method.js
index 0d138bfa6c..892a20eae3 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/invoked-as-method.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/invoked-as-method.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 /*---
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/length-zero-returns-false.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/length-zero-returns-false.js
index ab59a078d7..505b41f60b 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/length-zero-returns-false.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/length-zero-returns-false.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/length.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/length.js
index 33e7547d6c..bf18d9a8b9 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/length.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/length.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
@@ -23,10 +24,11 @@ includes: [propertyHelper.js, testTypedArray.js]
 features: [TypedArray]
 ---*/
 
-assert.sameValue(TypedArray.prototype.includes.length, 1);
-
-verifyNotEnumerable(TypedArray.prototype.includes, "length");
-verifyNotWritable(TypedArray.prototype.includes, "length");
-verifyConfigurable(TypedArray.prototype.includes, "length");
+verifyProperty(TypedArray.prototype.includes, "length", {
+  value: 1,
+  writable: false,
+  enumerable: false,
+  configurable: true
+});
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/name.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/name.js
index a76942e846..4876464dc4 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/name.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/name.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
@@ -20,10 +21,11 @@ includes: [propertyHelper.js, testTypedArray.js]
 features: [TypedArray]
 ---*/
 
-assert.sameValue(TypedArray.prototype.includes.name, "includes");
-
-verifyNotEnumerable(TypedArray.prototype.includes, "name");
-verifyNotWritable(TypedArray.prototype.includes, "name");
-verifyConfigurable(TypedArray.prototype.includes, "name");
+verifyProperty(TypedArray.prototype.includes, "name", {
+  value: "includes",
+  writable: false,
+  enumerable: false,
+  configurable: true
+});
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/not-a-constructor.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/not-a-constructor.js
index 726d7ec28f..7793b8f45c 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/not-a-constructor.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/not-a-constructor.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2020 Rick Waldron. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
@@ -29,7 +30,7 @@ assert.sameValue(
 
 assert.throws(TypeError, () => {
   let u8 = new Uint8Array(1); new u8.includes(1);
-}, '`let u8 = new Uint8Array(1); new u8.includes(1)` throws TypeError');
+});
 
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/prop-desc.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/prop-desc.js
index 3931bd6be2..7435acc534 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/prop-desc.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/prop-desc.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 /*---
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-from-this-out-of-bounds.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-from-this-out-of-bounds.js
index 13200e4c27..f495195719 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-from-this-out-of-bounds.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-from-this-out-of-bounds.js
@@ -1,4 +1,4 @@
-// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// |reftest| shell-option(--enable-arraybuffer-resizable) shell-option(--enable-float16array) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
 // Copyright (C) 2021 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 /*---
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-tointeger-fromindex-symbol.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-tointeger-fromindex-symbol.js
index 495c48b1a1..2ae78b4366 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-tointeger-fromindex-symbol.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-tointeger-fromindex-symbol.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-tointeger-fromindex.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-tointeger-fromindex.js
index ee5c08f7df..aeff01f614 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-tointeger-fromindex.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/return-abrupt-tointeger-fromindex.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/samevaluezero.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/samevaluezero.js
index a7bfc4042d..cde21311ba 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/samevaluezero.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/samevaluezero.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/search-found-returns-true.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/search-found-returns-true.js
index 7d2cf925b7..fcaa097e9c 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/search-found-returns-true.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/search-found-returns-true.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/search-not-found-returns-false.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/search-not-found-returns-false.js
index f647deebf9..16111c4ea2 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/search-not-found-returns-false.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/search-not-found-returns-false.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/searchelement-not-integer.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/searchelement-not-integer.js
index 22d65b5c0b..8288c44960 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/searchelement-not-integer.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/searchelement-not-integer.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2020 Google. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 /*---
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/this-is-not-object.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/this-is-not-object.js
index ffaadb48fc..c58b4656d6 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/this-is-not-object.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/this-is-not-object.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 /*---
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/this-is-not-typedarray-instance.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/this-is-not-typedarray-instance.js
index 3a7d86dcd3..7c5085f9d9 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/this-is-not-typedarray-instance.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/this-is-not-typedarray-instance.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 /*---
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/tointeger-fromindex.js b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/tointeger-fromindex.js
index ad25ab47d7..56987497c9 100644
--- a/js/src/tests/test262/built-ins/TypedArray/prototype/includes/tointeger-fromindex.js
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/includes/tointeger-fromindex.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.