[GR-54881] %TypedArray%.prototype.map should use Set (not CreateDataP…

…ropertyOrThrow).

PullRequest: js/3182

graal-js/src/com.oracle.truffle.js.test/js/GR-54881.js

@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
+ */
+
+// Checks that %TypedArray%.prototype.map uses Set (not CreateDataPropertyOrThrow)
+
+load("assert.js");
+
+var buffer = new ArrayBuffer(8);
+var array = new Uint8Array(buffer);
+var ctor = function() { return array; };
+ctor[Symbol.species] = ctor;
+array.constructor = ctor;
+
+var calls = 0;
+array.map(function(_,i) {
+    calls++;
+    if (i === 1) buffer.transfer();
+});
+
+assertSame(8, calls);

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/builtins/ArrayPrototypeBuiltins.java

@@ -2422,7 +2422,7 @@ protected Object map(Object thisObj, Object callback, Object thisArg) {
         @Override
         protected MaybeResultNode makeMaybeResultNode() {
             return new ForEachIndexCallNode.MaybeResultNode() {
-                @Child private WriteElementNode writeOwnNode = WriteElementNode.create(getContext(), true, true);
+                @Child private WriteElementNode writeOwnNode = WriteElementNode.create(getContext(), true, !isTypedArrayImplementation);
 
                 @Override
                 public MaybeResult<Object> apply(long index, Object value, Object callbackResult, Object currentResult) {

graal-js/test/testV8.json

@@ -597,6 +597,10 @@
     "filePath" : "mjsunit/es6/typedarray-construct-offset-not-smi.js",
     "status" : "FAIL",
     "comment" : "TODO: evaluate (V8 tests update 2017-07-07)"
+  }, {
+    "filePath" : "mjsunit/es6/typedarray-map.js",
+    "status" : "FAIL",
+    "comment" : "Off-spec test."
   }, {
     "filePath" : "mjsunit/es6/typedarray-of.js",
     "runInIsolation" : true,