[browser][wasm] Array values are not subject to assertions

[ArcadeMode]

Description

Noticed in #123523. Int32 array values can overflow without notification to the user (mono & coreclr show this behavior).

Likely this means no value assertions are performed for arrays in general.

Reproduction Steps

UnitTest: System.Runtime.InteropServices.JavaScript.Tests.JSImportTest.Int32ArrayWithOutOfRangeValues
(added in #123523 might not be on main yet)

Expected behavior

JSException with overflow message like for other overflow asserts, for tasks thrown to the receiver, for other argument types thrown back to the caller.

Actual behavior

Int32 overflows, other numerics likely do so too.

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

[dotnet-policy-service]

Tagging subscribers to 'arch-wasm': @lewing, @pavelsavara
See info in area-owners.md if you want to be subscribed.

[pavelsavara]

I guess this is where the overflow would silently happen
https://github.com/dotnet/runtime/blob/fa45d5a6e68647209f63eca9c05b85fc60036331/src/native/libs/System.Runtime.InteropServices.JavaScript.Native/interop/marshal-to-cs.ts#L463C28-L463C33

But I think we would have to live with that, for performance reasons.

I guess we only need to validate the values if we are passed Array.isArray(value) rather than value instanceof Int32Array.

But I think this could be also closed as "by design" and let the user to do his own validation, if they want to pay the CPU cost.

@maraf what do you think ?

[ArcadeMode]

If left as by design it might warrant a gotcha in the docs

[ArcadeMode]

I did a bit more testing and found the following that might be interesting to consider how to move forward.

The JS array: [0, 1, 2147483648, 2, { kaboom: "?" }, 3, "yes kowalski, kaboom", [4] , [5, 6], 7]
Marshals to CS as [0, 1, -2147483648, 2, 0, 3, 0, 4, 0, 7] (type int[])

The overflow was known, but apparently objects and strings are read as 0. Arrays are also set to 0 except arrays of length 1, which are found on the CS side as the value of the one element.

I am uncertain if/how we would deal with this. At the very least it doesnt crash 🤷‍♂️.