Allow block-wise splice to be used even when the new array length exceeds Integer.MAX_VALUE.

(cherry picked from commit 68dfdfb)

Author: woess

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/builtins/ArrayPrototypeBuiltins.java

@@ -2037,7 +2037,7 @@ static void doCached(JSArrayObject array, long len, long actualStart, long actua
                             @Bind Node node,
                             @Cached @Shared GetPrototypeNode getPrototypeNode,
                             @Cached @Shared InlinedConditionProfile arrayElementwise) {
-                if (arrayElementwise.profile(node, parent.mustUseElementwise(array, len, actualDeleteCount, itemCount, cachedArrayType.cast(arrayType), getPrototypeNode))) {
+                if (arrayElementwise.profile(node, parent.mustUseElementwise(array, len, cachedArrayType.cast(arrayType), getPrototypeNode))) {
                     parent.spliceJSArrayElementwise(array, len, actualStart, actualDeleteCount, itemCount);
                 } else {
                     parent.spliceJSArrayBlockwise(array, actualStart, actualDeleteCount, itemCount, cachedArrayType.cast(arrayType));
@@ -2049,21 +2049,20 @@ static void doUncached(JSArrayObject array, long len, long actualStart, long act
                             @Bind Node node,
                             @Cached @Shared GetPrototypeNode getPrototypeNode,
                             @Cached @Shared InlinedConditionProfile arrayElementwise) {
-                if (arrayElementwise.profile(node, parent.mustUseElementwise(array, len, actualDeleteCount, itemCount, arrayType, getPrototypeNode))) {
+                if (arrayElementwise.profile(node, parent.mustUseElementwise(array, len, arrayType, getPrototypeNode))) {
                     parent.spliceJSArrayElementwise(array, len, actualStart, actualDeleteCount, itemCount);
                 } else {
                     parent.spliceJSArrayBlockwise(array, actualStart, actualDeleteCount, itemCount, arrayType);
                 }
             }
         }
 
-        final boolean mustUseElementwise(JSDynamicObject obj, long expectedLength, long deleteCount, long itemCount, ScriptArray array, GetPrototypeNode getPrototypeNode) {
+        final boolean mustUseElementwise(JSDynamicObject obj, long expectedLength, ScriptArray array, GetPrototypeNode getPrototypeNode) {
             return array.isLengthNotWritable() ||
                             getPrototypeNode.execute(obj) != getRealm().getArrayPrototype() ||
                             !getContext().getArrayPrototypeNoElementsAssumption().isValid() ||
                             (!getContext().getFastArrayAssumption().isValid() && JSSlowArray.isJSSlowArray(obj)) ||
-                            array.length(obj) != expectedLength ||
-                            expectedLength + itemCount - deleteCount >= Integer.MAX_VALUE;
+                            array.length(obj) != expectedLength;
         }
 
         private void spliceRead(Object thisObj, long actualStart, long actualDeleteCount, Object aObj, long length) {

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/nodes/access/WriteElementNode.java

@@ -823,7 +823,8 @@ protected boolean doConstantArray(JSDynamicObject target, AbstractConstantArray
                         @Cached InlinedBranchProfile objectValueBranch,
                         @Cached InlinedConditionProfile inBoundsIf,
                         @Cached CreateWritableProfileAccess createWritableProfile) {
-            if (inBoundsIf.profile(this, index >= 0 && index < 0x7fff_ffff)) {
+            if (inBoundsIf.profile(this, index >= 0 && index < 0x7fff_ffff && constantArray.length(target) <= Integer.MAX_VALUE)) {
+                // Note: createWritable* must only be used if the array length fits in int.
                 ScriptArray newArray;
                 if (value instanceof Integer) {
                     intValueBranch.enter(this);

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/AbstractConstantArray.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2023, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * The Universal Permissive License (UPL), Version 1.0
@@ -55,7 +55,7 @@ protected AbstractConstantArray(int integrityLevel, DynamicArrayCache cache) {
 
     @Override
     public final ScriptArray setElementImpl(JSDynamicObject object, long index, Object value, boolean strict) {
-        if (index <= Integer.MAX_VALUE) {
+        if (index < Integer.MAX_VALUE && length(object) <= Integer.MAX_VALUE) {
             if (value instanceof Integer) {
                 return createWriteableInt(object, index, (int) value, null, CreateWritableProfileAccess.getUncached()).setElementImpl(object, index, value, strict);
             } else if (value instanceof Double) {
@@ -86,7 +86,7 @@ public final Object getElementInBounds(JSDynamicObject object, long index) {
     public abstract Object getElementInBounds(JSDynamicObject object, int index);
 
     @Override
-    public final long length(JSDynamicObject object) {
+    public long length(JSDynamicObject object) {
         return lengthInt(object);
     }
 

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/AbstractConstantEmptyArray.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * The Universal Permissive License (UPL), Version 1.0
@@ -73,8 +73,15 @@ public Object getElementInBounds(JSDynamicObject object, int index) {
     }
 
     @Override
-    public int lengthInt(JSDynamicObject object) {
-        return (int) getCapacity(object);
+    public final long length(JSDynamicObject object) {
+        return getCapacity(object);
+    }
+
+    @Override
+    public final int lengthInt(JSDynamicObject object) {
+        long capacity = getCapacity(object);
+        assert JSRuntime.longIsRepresentableAsInt(capacity) : capacity;
+        return (int) capacity;
     }
 
     @Override