From 3e74b28c36845aa0c4e0950e19fd4a1b1764ed59 Mon Sep 17 00:00:00 2001
From: Gergo Csizi <gergocs@inf.u-szeged.hu>
Date: Mon, 25 Nov 2024 11:43:04 +0100
Subject: [PATCH] Fix Typedarray.slice fastpath when the content type is
 matching

This patch fixes #4888.

The implementation is based on PR #4898, only resolved the conflicts and
applied requested changes.

Co-authored-by: Robert Fancsik robert.fancsik@h-lab.eu
JerryScript-DCO-1.0-Signed-off-by: Gergo Csizi gergocs@inf.u-szeged.hu
---
 .../ecma-builtin-typedarray-prototype.c       | 27 +++++++++++++--
 tests/jerry/array-slice.js                    | 33 +++++++++++++++++++
 .../es.next/regression-test-issue-4888.js     | 31 +++++++++++++++++
 3 files changed, 88 insertions(+), 3 deletions(-)
 create mode 100644 tests/jerry/array-slice.js
 create mode 100644 tests/jerry/es.next/regression-test-issue-4888.js

diff --git a/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c b/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c
index 553cffda74..4b57d9f4f2 100644
--- a/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c
+++ b/jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c
@@ -1711,14 +1711,35 @@ ecma_builtin_typedarray_prototype_slice (ecma_value_t this_arg, /**< this argume
 
   uint8_t *dst_buffer_p = ecma_typedarray_get_buffer (&new_typedarray_info);
 
-  JERRY_ASSERT (new_typedarray_info.offset == 0);
-
   src_buffer_p += relative_start << info_p->shift;
 
   if (info_p->id == new_typedarray_info.id)
   {
     // 22.2.3.23. Step 22. h-i.
-    memcpy (dst_buffer_p, src_buffer_p, count << info_p->shift);
+
+    if (JERRY_LIKELY (new_typedarray_info.offset == 0))
+    {
+      if (info_p->array_buffer_p == new_typedarray_info.array_buffer_p)
+      {
+        return new_typedarray;
+      }
+
+      memcpy (dst_buffer_p, src_buffer_p, count << info_p->shift);
+    }
+    else
+    {
+      uint32_t byte_shift = (uint32_t) (1 << info_p->shift);
+
+      while (count)
+      {
+        memmove (dst_buffer_p, src_buffer_p, byte_shift);
+
+        dst_buffer_p += byte_shift;
+        src_buffer_p += byte_shift;
+
+        count--;
+      }
+    }
   }
   else
   {
diff --git a/tests/jerry/array-slice.js b/tests/jerry/array-slice.js
new file mode 100644
index 0000000000..d8d17b14a3
--- /dev/null
+++ b/tests/jerry/array-slice.js
@@ -0,0 +1,33 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+let buf = new ArrayBuffer(10);
+let a1 = new Int8Array(buf, 0, 5);
+a1.fill(1);
+a1.constructor = {
+    [Symbol.species]: function (len) {
+        return new Int8Array(buf, 5, 5);
+    }
+};
+let a2 = a1.slice(2,4);
+res = new Int8Array(buf, 0, 10);
+
+//Expected: 1, 1, 1, 1, 1, 1, 1, 0, 0, 0
+for (let i = 0; i < 10; i++) {
+    if (i < 7) {
+        assert(res[i] === 1);
+    } else {
+        assert(res[i] === 0);
+    }
+}
diff --git a/tests/jerry/es.next/regression-test-issue-4888.js b/tests/jerry/es.next/regression-test-issue-4888.js
new file mode 100644
index 0000000000..60dc2d7f45
--- /dev/null
+++ b/tests/jerry/es.next/regression-test-issue-4888.js
@@ -0,0 +1,31 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var ab = new Int8Array(20).map((v, i) => i + 1).buffer;
+var ta = new Int8Array(ab, 0, 10);
+ta.constructor = {
+  [Symbol.species]: function (len) {
+    return new Int8Array(ab, 1, len);
+  }
+};
+
+var tb = ta.slice();
+
+for (let e of ta) {
+  assert(e === 1);
+}
+
+for (let e of tb) {
+  assert(e === 1);
+}