diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress')
42 files changed, 460 insertions, 114 deletions
diff --git a/deps/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js b/deps/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js index 704af744d2..72d3938511 100644 --- a/deps/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js +++ b/deps/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js @@ -29,7 +29,7 @@ function f(deopt, osr) { var result = "result"; - %_CallFunction(0, 0, function() {}); + %_Call(function() {}, 0, 0); var dummy = deopt + 0; for (var i = 0; osr && i < 2; i++) %OptimizeOsr(); return result; diff --git a/deps/v8/test/mjsunit/regress/regress-1217.js b/deps/v8/test/mjsunit/regress/regress-1217.js deleted file mode 100644 index e00d5371ad..0000000000 --- a/deps/v8/test/mjsunit/regress/regress-1217.js +++ /dev/null @@ -1,50 +0,0 @@ -// Copyright 2011 the V8 project authors. All rights reserved. -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are -// met: -// -// * Redistributions of source code must retain the above copyright -// notice, this list of conditions and the following disclaimer. -// * Redistributions in binary form must reproduce the above -// copyright notice, this list of conditions and the following -// disclaimer in the documentation and/or other materials provided -// with the distribution. -// * Neither the name of Google Inc. nor the names of its -// contributors may be used to endorse or promote products derived -// from this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -// Check that RegExp.prototype is itself a RegExp object. - -var proto = RegExp.prototype; -assertEquals("[object RegExp]", Object.prototype.toString.call(proto)); - -assertEquals("(?:)", proto.source); -assertEquals(false, proto.global); -assertEquals(false, proto.multiline); -assertEquals(false, proto.ignoreCase); -assertEquals(0, proto.lastIndex); - -assertEquals("/(?:)/", proto.toString()); - -var execResult = proto.exec("argle"); -assertEquals(1, execResult.length); -assertEquals("", execResult[0]); -assertEquals("argle", execResult.input); -assertEquals(0, execResult.index); - -assertTrue(proto.test("argle")); - -// We disallow re-compiling the RegExp.prototype object. -assertThrows(function(){ proto.compile("something"); }, TypeError); diff --git a/deps/v8/test/mjsunit/regress/regress-2193.js b/deps/v8/test/mjsunit/regress/regress-2193.js index 50509bfcbd..4ec050e10a 100644 --- a/deps/v8/test/mjsunit/regress/regress-2193.js +++ b/deps/v8/test/mjsunit/regress/regress-2193.js @@ -25,7 +25,7 @@ // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -// Flags: --allow-natives-syntax --cache-optimized-code +// Flags: --allow-natives-syntax function bozo() {}; function MakeClosure() { diff --git a/deps/v8/test/mjsunit/regress/regress-2438.js b/deps/v8/test/mjsunit/regress/regress-2438.js index 7be7e71687..f694ff8e19 100644 --- a/deps/v8/test/mjsunit/regress/regress-2438.js +++ b/deps/v8/test/mjsunit/regress/regress-2438.js @@ -35,14 +35,6 @@ function testSideEffects(subject, re) { re.lastIndex = side_effect_object; re.test(subject); assertEquals(2, counter); - - re.lastIndex = side_effect_object; - subject.match(re); - assertEquals(3, counter); - - re.lastIndex = side_effect_object; - subject.replace(re, ""); - assertEquals(4, counter); } testSideEffects("zzzz", /a/); diff --git a/deps/v8/test/mjsunit/regress/regress-2285.js b/deps/v8/test/mjsunit/regress/regress-2529.js index a0d628df93..cec56a60f5 100644 --- a/deps/v8/test/mjsunit/regress/regress-2285.js +++ b/deps/v8/test/mjsunit/regress/regress-2529.js @@ -1,4 +1,4 @@ -// Copyright 2012 the V8 project authors. All rights reserved. +// Copyright 2015 the V8 project authors. All rights reserved. // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: @@ -25,7 +25,19 @@ // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -// Flags: --allow-natives-syntax -assertThrows(function() { %_CallFunction(null, 0, ""); }); -assertThrows(function() { %_CallFunction(null, 0, 1); }); +// Regression test for v8 bug 2529. + +function makeScript(s) { + return 'while(true) { try { "try"; break } finally { "finally" }; ' + s + ' }'; +} + +var s1 = makeScript(''); +var s2 = makeScript('y = "done"'); +var s3 = makeScript('if (true) 2; else var x = 3;'); +var s4 = makeScript('if (true) 2; else 3;'); + +assertEquals("try", eval(s1)); +assertEquals("try", eval(s2)); +assertEquals("try", eval(s3)); +assertEquals("try", eval(s4)); diff --git a/deps/v8/test/mjsunit/regress/regress-3183.js b/deps/v8/test/mjsunit/regress/regress-3183.js index 0c915b0aec..4551621e65 100644 --- a/deps/v8/test/mjsunit/regress/regress-3183.js +++ b/deps/v8/test/mjsunit/regress/regress-3183.js @@ -83,7 +83,7 @@ } function bar(x, deopt) { - %_CallFunction(null, 'push', [x][0], ((deopt + 0), 1), f1); + %_Call(f1, null, 'push', [x][0], ((deopt + 0), 1)); } function foo() { return bar(arguments[0], arguments[1]); } diff --git a/deps/v8/test/mjsunit/regress/regress-3229.js b/deps/v8/test/mjsunit/regress/regress-3229.js index 1a0ed64412..419cade8cd 100644 --- a/deps/v8/test/mjsunit/regress/regress-3229.js +++ b/deps/v8/test/mjsunit/regress/regress-3229.js @@ -17,7 +17,6 @@ testEscapes("\\/\\/", new RegExp("\\/\\/")); testEscapes("\\/\\/\\/\\/", new RegExp("////")); testEscapes("\\/\\/\\/\\/", new RegExp("\\//\\//")); testEscapes("(?:)", new RegExp("")); -testEscapes("(?:)", RegExp.prototype); // Read-only property. var r = /\/\//; diff --git a/deps/v8/test/mjsunit/regress/regress-3281.js b/deps/v8/test/mjsunit/regress/regress-3281.js index 7d42c026b6..f7b167e3b8 100644 --- a/deps/v8/test/mjsunit/regress/regress-3281.js +++ b/deps/v8/test/mjsunit/regress/regress-3281.js @@ -5,8 +5,10 @@ // Flags: --expose-natives-as=builtins // Should not crash or raise an exception. +var SetIterator = builtins.ImportNow("SetIterator"); var s = new Set(); -var setIterator = new builtins.SetIterator(s, 2); +var setIterator = new SetIterator(s, 2); +var MapIterator = builtins.ImportNow("MapIterator"); var m = new Map(); -var mapIterator = new builtins.MapIterator(m, 2); +var mapIterator = new MapIterator(m, 2); diff --git a/deps/v8/test/mjsunit/regress/regress-403292.js b/deps/v8/test/mjsunit/regress/regress-403292.js index 4e7ba283f7..2e24d48ac4 100644 --- a/deps/v8/test/mjsunit/regress/regress-403292.js +++ b/deps/v8/test/mjsunit/regress/regress-403292.js @@ -4,6 +4,8 @@ // Flags: --allow-natives-syntax --expose-natives-as=builtins --expose-gc +var SetIterator = builtins.ImportNow("SetIterator"); +var MapIterator = builtins.ImportNow("MapIterator"); var __v_7 = []; var __v_8 = {}; var __v_10 = {}; @@ -21,9 +23,9 @@ assertEquals("good", __f_1()); } catch(e) { print("Caught: " + e); } try { __v_3 = new Set(); -__v_5 = new builtins.SetIterator(__v_3, -12); +__v_5 = new SetIterator(__v_3, -12); __v_4 = new Map(); -__v_6 = new builtins.MapIterator(__v_4, 2); +__v_6 = new MapIterator(__v_4, 2); __f_3(Array); } catch(e) { print("Caught: " + e); } function __f_4(__v_8, filter) { diff --git a/deps/v8/test/mjsunit/regress/regress-447561.js b/deps/v8/test/mjsunit/regress/regress-447561.js index 0d7a321de0..e1a5ba5aa5 100644 --- a/deps/v8/test/mjsunit/regress/regress-447561.js +++ b/deps/v8/test/mjsunit/regress/regress-447561.js @@ -3,8 +3,8 @@ // found in the LICENSE file. __proto__ = /foo/gi; -assertEquals("foo", source); -assertTrue(global); -assertTrue(ignoreCase); -assertFalse(multiline); +assertThrows(function() { source }); +assertThrows(function() { global }); +assertThrows(function() { ignoreCase }); +assertThrows(function() { multiline }); assertEquals(0, lastIndex); diff --git a/deps/v8/test/mjsunit/regress/regress-4493-1.js b/deps/v8/test/mjsunit/regress/regress-4493-1.js new file mode 100644 index 0000000000..a24c8b07dc --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-4493-1.js @@ -0,0 +1,16 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function baz(x, f) { return x.length; }; + +function bar(x, y) { + if (y) {} + baz(x, function() { return x; }); +}; + +function foo(x) { bar(x, ''); } +%OptimizeFunctionOnNextCall(foo); +foo(['a']); diff --git a/deps/v8/test/mjsunit/regress/regress-4495.js b/deps/v8/test/mjsunit/regress/regress-4495.js new file mode 100644 index 0000000000..2af5bc2445 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-4495.js @@ -0,0 +1,11 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +function foo(a, s) { a[s] = 35; } +var x = { bilbo: 3 }; +var y = { frodo: 3, bilbo: 'hi' }; +foo(x, "bilbo"); +foo(x, "bilbo"); +// Without the fix for 4495, this will crash on ia32: +foo(y, "bilbo"); diff --git a/deps/v8/test/mjsunit/regress/regress-4507.js b/deps/v8/test/mjsunit/regress/regress-4507.js new file mode 100644 index 0000000000..a3fe5107be --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-4507.js @@ -0,0 +1,19 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function broken(value) { + return Math.floor(value/65536); +} +function toUnsigned(i) { + return i >>> 0; +} +function outer(i) { + return broken(toUnsigned(i)); +} +for (var i = 0; i < 5; i++) outer(0); +broken(0x80000000); // Spice things up with a sprinkling of type feedback. +%OptimizeFunctionOnNextCall(outer); +assertEquals(32768, outer(0x80000000)); diff --git a/deps/v8/test/mjsunit/regress/regress-4515.js b/deps/v8/test/mjsunit/regress/regress-4515.js new file mode 100644 index 0000000000..81610f08a5 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-4515.js @@ -0,0 +1,17 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax --turbo-filter=f + +function f(array) { + return array.length >>> 0; +} + +var a = new Array(); +a[4000000000] = "A"; + +assertEquals(4000000001, f(a)); +assertEquals(4000000001, f(a)); +%OptimizeFunctionOnNextCall(f); +assertEquals(4000000001, f(a)); diff --git a/deps/v8/test/mjsunit/regress/regress-4521.js b/deps/v8/test/mjsunit/regress/regress-4521.js new file mode 100644 index 0000000000..f9bdafcea8 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-4521.js @@ -0,0 +1,20 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +"use strict"; + +class B { + foo() { return 23 } +} + +class C extends B { + bar() { return super[%DeoptimizeFunction(C.prototype.bar), "foo"]() } +} + +assertEquals(23, new C().bar()); +assertEquals(23, new C().bar()); +%OptimizeFunctionOnNextCall(C.prototype.bar); +assertEquals(23, new C().bar()); diff --git a/deps/v8/test/mjsunit/regress/regress-4525.js b/deps/v8/test/mjsunit/regress/regress-4525.js new file mode 100644 index 0000000000..b962dc07ca --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-4525.js @@ -0,0 +1,37 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function receiver() { + return this; +} + +function construct(f) { + "use strict"; + class B {} + class C extends B { + bar() { return super.foo() } + } + B.prototype.foo = f; + return new C(); +} + +function check(x, value, type) { + assertEquals("object", typeof x); + assertInstanceof(x, type); + assertEquals(value, x); +} + +var o = construct(receiver); +check(o.bar.call(123), Object(123), Number); +check(o.bar.call("a"), Object("a"), String); +check(o.bar.call(undefined), this, Object); +check(o.bar.call(null), this, Object); + +%OptimizeFunctionOnNextCall(o.bar); +check(o.bar.call(456), Object(456), Number); +check(o.bar.call("b"), Object("b"), String); +check(o.bar.call(undefined), this, Object); +check(o.bar.call(null), this, Object); diff --git a/deps/v8/test/mjsunit/regress/regress-4534.js b/deps/v8/test/mjsunit/regress/regress-4534.js new file mode 100644 index 0000000000..7042958ad2 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-4534.js @@ -0,0 +1,17 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax --expose-gc + +var dp = Object.defineProperty; +function getter() { return 111; } +function setter(x) { print(222); } +obj1 = {}; +dp(obj1, "golf", { get: getter, configurable: true }); +dp(obj1, "golf", { set: setter, configurable: true }); +gc(); +obj2 = {}; +dp(obj2, "golf", { get: getter, configurable: true }); +dp(obj2, "golf", { set: setter, configurable: true }); +assertTrue(%HaveSameMap(obj1, obj2)); diff --git a/deps/v8/test/mjsunit/regress/regress-536751.js b/deps/v8/test/mjsunit/regress/regress-536751.js new file mode 100644 index 0000000000..b2d19e422a --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-536751.js @@ -0,0 +1,11 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --harmony-sloppy --harmony-sloppy-function --harmony-sloppy-let + +// At some point, this code led to DCHECK errors in debug mode + +for (; false;) function foo() {}; + +for (x in []) function foo() {}; diff --git a/deps/v8/test/mjsunit/regress/regress-542099.js b/deps/v8/test/mjsunit/regress/regress-542099.js new file mode 100644 index 0000000000..f3655da53c --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-542099.js @@ -0,0 +1,18 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --harmony-sloppy --harmony-sloppy-function + +// Previously, this caused a CHECK fail in debug mode +// https://code.google.com/p/chromium/issues/detail?id=542099 + +var foo = {}; +var bar = foo; +for (foo.x in {a: 1}) function foo() { return foo; } +assertEquals("object", typeof bar); +assertEquals("a", bar.x); +assertEquals("function", typeof foo); +assertEquals("function", typeof foo()); +assertSame(foo, foo()); +assertEquals(undefined, foo.x); diff --git a/deps/v8/test/mjsunit/regress/regress-542100.js b/deps/v8/test/mjsunit/regress/regress-542100.js new file mode 100644 index 0000000000..bc03e6f9e2 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-542100.js @@ -0,0 +1,25 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --harmony-sloppy --harmony-sloppy-function + +(function() { + var x = {a: 1} + assertEquals("undefined", typeof f); + with (x) + function f() { return a; } + assertEquals("function", typeof f); + assertEquals(1, f()); + x.a = 2; + assertEquals(2, f()); +})(); + +var y = {b: 1} +assertEquals("undefined", typeof g); +with (y) + function g() { return b; } +assertEquals("function", typeof g); +assertEquals(1, g()); +y.b = 2; +assertEquals(2, g()); diff --git a/deps/v8/test/mjsunit/regress/regress-542823.js b/deps/v8/test/mjsunit/regress/regress-542823.js new file mode 100644 index 0000000000..d9c23396d4 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-542823.js @@ -0,0 +1,12 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +__v_0 = 100000; +__v_1 = new Array(); +for (var __v_2 = 0; __v_2 < __v_0; __v_2++) { + __v_1[__v_2] = 0.5; +} +for (var __v_2 = 0; __v_2 < 10; __v_2++) { + var __v_0 = __v_1 + 0.5; +} diff --git a/deps/v8/test/mjsunit/regress/regress-543994.js b/deps/v8/test/mjsunit/regress/regress-543994.js new file mode 100644 index 0000000000..e0d6010287 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-543994.js @@ -0,0 +1,19 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flass: --allow-natives-syntax --always-opt --gc-interval=163 --stress-compaction + +try { a = f(); +} catch(e) { +} +var i = 0; +function f() { + try { + f(); + } catch(e) { + i++; + []; + } +} +f(); diff --git a/deps/v8/test/mjsunit/regress/regress-552302.js b/deps/v8/test/mjsunit/regress/regress-552302.js new file mode 100644 index 0000000000..d4a1f2448e --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-552302.js @@ -0,0 +1,7 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +// +// Flags: --harmony-destructuring --allow-natives-syntax + +assertThrows('var %OptimizeFunctionOnNextCall()', SyntaxError); diff --git a/deps/v8/test/mjsunit/regress/regress-95113.js b/deps/v8/test/mjsunit/regress/regress-95113.js index 468bff84c2..aa526ae0b9 100644 --- a/deps/v8/test/mjsunit/regress/regress-95113.js +++ b/deps/v8/test/mjsunit/regress/regress-95113.js @@ -31,8 +31,8 @@ function get_double_array() { var a = new Array(100000); var i = 0; while (!%HasFastDoubleElements(a)) { - a[i] = i; - i += 0.5; + a[i] = i + 0.1; + i += 1; } assertTrue(%HasFastDoubleElements(a)); a.length = 1; diff --git a/deps/v8/test/mjsunit/regress/regress-95920.js b/deps/v8/test/mjsunit/regress/regress-95920.js index 20e73fbc40..5584965561 100644 --- a/deps/v8/test/mjsunit/regress/regress-95920.js +++ b/deps/v8/test/mjsunit/regress/regress-95920.js @@ -28,31 +28,23 @@ // Tests that objects with external arrays cannot be sealed or have their // properties redefined. -(function() { - assertThrows(function() { - [0].every(function(){ Object.seal((new Int8Array(42))); }); - assertUnreable(); - }, TypeError) -})(); +Object.preventExtensions(new Int8Array(42)); +Object.seal(new Int8Array(42)); -(function() { - assertThrows(function() { - [0].every(function(){ Object.freeze((new Int8Array(42))); }); - assertUnreable(); - }, TypeError) -})(); +// No elements, so should succeed. +Object.freeze(new Int8Array(0)); -(function() { - assertThrows(function() { - [0].every(function(){ Object.preventExtensions((new Int8Array(42))); }); - assertUnreable(); - }, TypeError) -})(); +var o = new Int8Array(42); +assertThrows(function() { + Object.freeze(o); + assertUnreable(); + }, TypeError); -(function() { - assertThrows(function() { - Object.defineProperty(new Int8Array(42), "1", - { writable: false, value: "1" }); - assertUnreable(); - }) -})(); +// Freeze should still have managed to preventExtensions o. +assertFalse(Object.isExtensible(o)); + +assertThrows(function() { + Object.defineProperty(new Int8Array(42), "1", + { writable: false, value: "1" }); + assertUnreable(); + }); diff --git a/deps/v8/test/mjsunit/regress/regress-arguments-slice.js b/deps/v8/test/mjsunit/regress/regress-arguments-slice.js new file mode 100644 index 0000000000..f7cd8c6ec8 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-arguments-slice.js @@ -0,0 +1,8 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +function f() { return arguments; } +var o = f(); +o.length = -100; +Array.prototype.slice.call(o); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-119800.js b/deps/v8/test/mjsunit/regress/regress-crbug-119800.js new file mode 100644 index 0000000000..1641cac686 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-119800.js @@ -0,0 +1,37 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --expose-debug-as debug + +function f() { + 1; + 2; + 3; +} + +var Debug = debug.Debug; +var exception = null; +var breaks = []; + +function listener(event, exec_state, event_data, data) { + if (event != Debug.DebugEvent.Break) return; + try { + Debug.debuggerFlags().breakPointsActive.setValue(false); + breaks.push(exec_state.frame().sourceLineText().trimLeft()); + exec_state.prepareStep(Debug.StepAction.StepIn, 1); + } catch (e) { + exception = e; + } +} + +Debug.setListener(listener); +Debug.setBreakPoint(f, 0, 0); + +f(); + +Debug.setListener(null); +Debug.debuggerFlags().breakPointsActive.setValue(true); + +assertNull(exception); +assertEquals(breaks, ["1;", "2;", "3;", "}", "Debug.setListener(null);"]); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-401915.js b/deps/v8/test/mjsunit/regress/regress-crbug-401915.js index 67ea19158e..9786313227 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-401915.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-401915.js @@ -10,7 +10,7 @@ Debug.setBreakOnException(); try { try { - %DebugPushPromise(new Promise(function() {}), function() {}); + %DebugPushPromise(new Promise(function() {}), function() {}, function() {}); } catch (e) { } throw new Error(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-405922.js b/deps/v8/test/mjsunit/regress/regress-crbug-405922.js index 9f76a862db..a38ac86912 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-405922.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-405922.js @@ -18,7 +18,7 @@ function listener(event, exec_state, event_data, data) { Debug.setListener(listener); function f(x) { - if (x > 0) %_CallFunction(null, x-1, f); + if (x > 0) %_Call(f, null, x-1); } debugger; diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-465298.js b/deps/v8/test/mjsunit/regress/regress-crbug-465298.js index 0b2827b0d2..0c5ab56c7a 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-465298.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-465298.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --noturbo-osr --expose-debug-as debug +// Flags: --noturbo-osr --noturbo-inlining --expose-debug-as debug var stdlib = this; var buffer = new ArrayBuffer(64 * 1024); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-485410.js b/deps/v8/test/mjsunit/regress/regress-crbug-485410.js index 55c9c43dbf..bb11c82908 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-485410.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-485410.js @@ -11,7 +11,7 @@ function ToHeapNumber(i) { } for (var i = 0; i < 3; i++) ToHeapNumber(i); %OptimizeFunctionOnNextCall(ToHeapNumber); -assertFalse(%IsSmi(ToHeapNumber(1))); +ToHeapNumber(1); function Fail(a, i, v) { a[i] = v; diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-538086.js b/deps/v8/test/mjsunit/regress/regress-crbug-538086.js new file mode 100644 index 0000000000..537cbda5fc --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-538086.js @@ -0,0 +1,6 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +this[1]++; +for (var x in this) {}; diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-542101.js b/deps/v8/test/mjsunit/regress/regress-crbug-542101.js new file mode 100644 index 0000000000..1a4c2b37ce --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-542101.js @@ -0,0 +1,10 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +(function() { + Error.prototype.toString.call({ + get name() { return { __proto__: this }; }, + get message() { } + }); +})(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-545364.js b/deps/v8/test/mjsunit/regress/regress-crbug-545364.js new file mode 100644 index 0000000000..4fe99d0133 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-545364.js @@ -0,0 +1,11 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +(function() { + "use asm"; + return function(x) { + for (var i = 0; i < 100000; ++i) {} + return x; + } +})()(this + "i"); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-546968.js b/deps/v8/test/mjsunit/regress/regress-crbug-546968.js new file mode 100644 index 0000000000..51f20c4204 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-546968.js @@ -0,0 +1,14 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax --harmony-do-expressions + +function f() { + print( + do { + for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); } + } + ); +} +f(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-548580.js b/deps/v8/test/mjsunit/regress/regress-crbug-548580.js new file mode 100644 index 0000000000..4a2f5e152f --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-548580.js @@ -0,0 +1,17 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --harmony-regexps + +function store(v) { + var re = /(?=[d#.])/; + re.a = v; + return re; +} + +var re1 = store(undefined); +var re2 = store(42); + +assertEquals(re1.a, undefined); +assertEquals(re2.a, 42); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-549162.js b/deps/v8/test/mjsunit/regress/regress-crbug-549162.js new file mode 100644 index 0000000000..072bdd52d9 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-549162.js @@ -0,0 +1,11 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var s = Symbol("foo"); +var __v_13 = {} +Object.defineProperty( __v_13, s, {value: {}, enumerable: true}); +for (var __v_14 in __v_13) {} +__v_13 = {} +Object.defineProperty( __v_13, s, {value: {}, enumerable: true}); +var __v_14 = Object.create(Object.prototype, __v_13) diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-552304.js b/deps/v8/test/mjsunit/regress/regress-crbug-552304.js new file mode 100644 index 0000000000..fa3baa34c1 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-552304.js @@ -0,0 +1,11 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +(function() { + "use asm"; + return function() { + for (var i = 0; i < 100000; delete unresolved_name) {++i} + return 0; + } +})()(this + "i"); diff --git a/deps/v8/test/mjsunit/regress/regress-function-constructor-receiver.js b/deps/v8/test/mjsunit/regress/regress-function-constructor-receiver.js index f345435ade..5d713803be 100644 --- a/deps/v8/test/mjsunit/regress/regress-function-constructor-receiver.js +++ b/deps/v8/test/mjsunit/regress/regress-function-constructor-receiver.js @@ -10,8 +10,8 @@ try { new Function({toString:0,valueOf:0}); } catch (e) { threw = true; - // Ensure that the receiver during "new Function" is the global proxy. - assertEquals(this, e.stack[0].getThis()); + // Ensure that the receiver during "new Function" is the undefined value. + assertEquals(undefined, e.stack[0].getThis()); } assertTrue(threw); diff --git a/deps/v8/test/mjsunit/regress/regress-460937.js b/deps/v8/test/mjsunit/regress/regress-inline-class-constructor.js index cd57f93328..1d77176758 100644 --- a/deps/v8/test/mjsunit/regress/regress-460937.js +++ b/deps/v8/test/mjsunit/regress/regress-inline-class-constructor.js @@ -4,16 +4,25 @@ // Flags: --allow-natives-syntax -function f() { - var a = new Array(100000); - var i = 0; - while (!%HasFastDoubleElements(a)) { - a[i] = i; - i += 0.1; +"use strict"; + +var B = class extends Int32Array { } + +function f(b) { + if (b) { + null instanceof B; } - a[1] = 1.5; } f(); +f(); +f(); %OptimizeFunctionOnNextCall(f); f(); + +function f2() { + return new B(); +} + +%OptimizeFunctionOnNextCall(f2); +f2(); diff --git a/deps/v8/test/mjsunit/regress/string-fromcharcode-sideeffect.js b/deps/v8/test/mjsunit/regress/string-fromcharcode-sideeffect.js new file mode 100644 index 0000000000..432ba2c38d --- /dev/null +++ b/deps/v8/test/mjsunit/regress/string-fromcharcode-sideeffect.js @@ -0,0 +1,8 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var counter = 0; +var a = { valueOf: function() { counter++; return 0x100; } }; +assertEquals("A\u0100\u0100\u0100", String.fromCharCode(65, a, a, a)); +assertEquals(3, counter); diff --git a/deps/v8/test/mjsunit/regress/typed-array-lifetime.js b/deps/v8/test/mjsunit/regress/typed-array-lifetime.js new file mode 100644 index 0000000000..db9a216531 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/typed-array-lifetime.js @@ -0,0 +1,26 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +// +// Flags: --allow-natives-syntax --typed-array-max-size-in-heap=1 + +var foo = (function () { + var y = 0; + return function foo(x) { + // Needs to be an external array. + var a = new Float64Array(32); + a[0] = 42; + y = x + 0.1; // This has to allocate. + return a[0]; + } +})(); + +foo(1); +foo(1); +%OptimizeFunctionOnNextCall(foo); +foo(1); +// Try to force a GC during allocation in above marked line. +for (var i = 0; i < 20; ++i) { + %SetAllocationTimeout(i, i, false); + assertEquals(42, foo(2)); +} |