Fix Typedarray.slice fastpath when the content type is matching

This patch fixes #4888.

The implementation is based on PR #4898, only resolved the conflicts and
applied requested changes.

Co-authored-by: Robert Fancsik [email protected]
JerryScript-DCO-1.0-Signed-off-by: Gergo Csizi [email protected]

Author: gergocs

jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c

@@ -1711,14 +1711,35 @@ ecma_builtin_typedarray_prototype_slice (ecma_value_t this_arg, /**< this argume
 
   uint8_t *dst_buffer_p = ecma_typedarray_get_buffer (&new_typedarray_info);
 
-  JERRY_ASSERT (new_typedarray_info.offset == 0);
-
   src_buffer_p += relative_start << info_p->shift;
 
   if (info_p->id == new_typedarray_info.id)
   {
     // 22.2.3.23. Step 22. h-i.
-    memcpy (dst_buffer_p, src_buffer_p, count << info_p->shift);
+
+    if (JERRY_LIKELY (new_typedarray_info.offset == 0))
+    {
+      if (info_p->array_buffer_p == new_typedarray_info.array_buffer_p)
+      {
+        return new_typedarray;
+      }
+
+      memcpy (dst_buffer_p, src_buffer_p, count << info_p->shift);
+    }
+    else
+    {
+      uint32_t byte_shift = (uint32_t) (1 << info_p->shift);
+
+      while (count)
+      {
+        memmove (dst_buffer_p, src_buffer_p, byte_shift);
+
+        dst_buffer_p += byte_shift;
+        src_buffer_p += byte_shift;
+
+        count--;
+      }
+    }
   }
   else
   {

tests/jerry/array-slice.js

@@ -0,0 +1,33 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+let buf = new ArrayBuffer(10);
+let a1 = new Int8Array(buf, 0, 5);
+a1.fill(1);
+a1.constructor = {
+    [Symbol.species]: function (len) {
+        return new Int8Array(buf, 5, 5);
+    }
+};
+let a2 = a1.slice(2,4);
+res = new Int8Array(buf, 0, 10);
+
+//Expected: 1, 1, 1, 1, 1, 1, 1, 0, 0, 0
+for (let i = 0; i < 10; i++) {
+    if (i < 7) {
+        assert(res[i] === 1);
+    } else {
+        assert(res[i] === 0);
+    }
+}

tests/jerry/es.next/regression-test-issue-4888.js

@@ -0,0 +1,31 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var ab = new Int8Array(20).map((v, i) => i + 1).buffer;
+var ta = new Int8Array(ab, 0, 10);
+ta.constructor = {
+  [Symbol.species]: function (len) {
+    return new Int8Array(ab, 1, len);
+  }
+};
+
+var tb = ta.slice();
+
+for (let e of ta) {
+  assert(e === 1);
+}
+
+for (let e of tb) {
+  assert(e === 1);
+}