From 61553ccdda8008ceb04d7c19ed0890459aa48c58 Mon Sep 17 00:00:00 2001 From: Ryan Dahl Date: Wed, 29 Jun 2011 12:49:17 +0200 Subject: Upgrade V8 to 3.1.8.25 --- .../v8/test/mjsunit/execScript-case-insensitive.js | 34 ------------- deps/v8/test/mjsunit/function-names.js | 2 +- deps/v8/test/mjsunit/regress/regress-1122.js | 33 ++++++++---- deps/v8/test/mjsunit/regress/regress-1257.js | 58 ++++++++++++++++++++++ deps/v8/test/mjsunit/regress/regress-1341167.js | 33 ------------ deps/v8/test/mjsunit/regress/regress-1401.js | 45 +++++++++++++++++ deps/v8/test/mjsunit/regress/regress-1403.js | 36 ++++++++++++++ deps/v8/test/mjsunit/regress/splice-missing-wb.js | 56 +++++++++++++++++++++ 8 files changed, 219 insertions(+), 78 deletions(-) delete mode 100644 deps/v8/test/mjsunit/execScript-case-insensitive.js create mode 100644 deps/v8/test/mjsunit/regress/regress-1257.js delete mode 100644 deps/v8/test/mjsunit/regress/regress-1341167.js create mode 100644 deps/v8/test/mjsunit/regress/regress-1401.js create mode 100644 deps/v8/test/mjsunit/regress/regress-1403.js create mode 100644 deps/v8/test/mjsunit/regress/splice-missing-wb.js (limited to 'deps/v8/test/mjsunit') diff --git a/deps/v8/test/mjsunit/execScript-case-insensitive.js b/deps/v8/test/mjsunit/execScript-case-insensitive.js deleted file mode 100644 index 468d65747e..0000000000 --- a/deps/v8/test/mjsunit/execScript-case-insensitive.js +++ /dev/null @@ -1,34 +0,0 @@ -// Copyright 2008 the V8 project authors. All rights reserved. -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are -// met: -// -// * Redistributions of source code must retain the above copyright -// notice, this list of conditions and the following disclaimer. -// * Redistributions in binary form must reproduce the above -// copyright notice, this list of conditions and the following -// disclaimer in the documentation and/or other materials provided -// with the distribution. -// * Neither the name of Google Inc. nor the names of its -// contributors may be used to endorse or promote products derived -// from this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -var x = 0; -execScript('x = 1', 'javascript'); -assertEquals(1, x); - -execScript('x = 2', 'JavaScript'); -assertEquals(2, x); - diff --git a/deps/v8/test/mjsunit/function-names.js b/deps/v8/test/mjsunit/function-names.js index c083f18f5d..5ed0b794e8 100644 --- a/deps/v8/test/mjsunit/function-names.js +++ b/deps/v8/test/mjsunit/function-names.js @@ -128,6 +128,6 @@ var globalFunctions = [ "encodeURI", "encodeURIComponent", "Error", "TypeError", "RangeError", "SyntaxError", "ReferenceError", "EvalError", "URIError", "isNaN", "isFinite", "parseInt", "parseFloat", - "eval", "execScript"]; + "eval"]; TestFunctionNames(this, globalFunctions); diff --git a/deps/v8/test/mjsunit/regress/regress-1122.js b/deps/v8/test/mjsunit/regress/regress-1122.js index 7dc9b248a3..815511d18e 100644 --- a/deps/v8/test/mjsunit/regress/regress-1122.js +++ b/deps/v8/test/mjsunit/regress/regress-1122.js @@ -25,12 +25,14 @@ // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -// Test that we can handle functions with up to 32766 arguments, and that -// functions with more arguments throw an exception. +// Test that we can handle function calls with up to 32766 arguments, and +// that function calls with more arguments throw an exception. Apply a +// similar limit to the number of function parameters. -// See http://code.google.com/p/v8/issues/detail?id=1122. +// See http://code.google.com/p/v8/issues/detail?id=1122 and +// http://code.google.com/p/v8/issues/detail?id=1413. -function function_with_n_args(n) { +function function_with_n_params_and_m_args(n, m) { test_prefix = 'prefix '; test_suffix = ' suffix'; var source = 'test_prefix + (function f('; @@ -39,7 +41,7 @@ function function_with_n_args(n) { source += 'arg' + arg; } source += ') { return arg' + (n - n % 2) / 2 + '; })('; - for (var arg = 0; arg < n ; arg++) { + for (var arg = 0; arg < m ; arg++) { if (arg != 0) source += ','; source += arg; } @@ -47,9 +49,20 @@ function function_with_n_args(n) { return eval(source); } -assertEquals('prefix 4000 suffix', function_with_n_args(8000)); -assertEquals('prefix 9000 suffix', function_with_n_args(18000)); -assertEquals('prefix 16000 suffix', function_with_n_args(32000)); +assertEquals('prefix 4000 suffix', + function_with_n_params_and_m_args(8000, 8000)); +assertEquals('prefix 3000 suffix', + function_with_n_params_and_m_args(6000, 8000)); +assertEquals('prefix 5000 suffix', + function_with_n_params_and_m_args(10000, 8000)); +assertEquals('prefix 9000 suffix', + function_with_n_params_and_m_args(18000, 18000)); +assertEquals('prefix 16000 suffix', + function_with_n_params_and_m_args(32000, 32000)); +assertEquals('prefix undefined suffix', + function_with_n_params_and_m_args(32000, 10000)); -assertThrows("function_with_n_args(35000)"); -assertThrows("function_with_n_args(100000)"); +assertThrows("function_with_n_params_and_m_args(35000, 35000)"); +assertThrows("function_with_n_params_and_m_args(100000, 100000)"); +assertThrows("function_with_n_params_and_m_args(35000, 30000)"); +assertThrows("function_with_n_params_and_m_args(30000, 35000)"); diff --git a/deps/v8/test/mjsunit/regress/regress-1257.js b/deps/v8/test/mjsunit/regress/regress-1257.js new file mode 100644 index 0000000000..c20fb86068 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-1257.js @@ -0,0 +1,58 @@ +// Copyright 2011 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +function g(y) { assertEquals(y, 12); } + +var X = 0; + +function foo () { + var cnt = 0; + var l = -1; + var x = 0; + while (1) switch (l) { + case -1: + var y = x + 12; + l = 0; + break; + case 0: + // Loop for to hit OSR. + if (cnt++ < 10000000) { + l = 0; + break; + } else { + l = 1; + break; + } + case 1: + // This case will contain deoptimization + // because it has no type feedback. + g(y); + return; + }; +} + +foo(); diff --git a/deps/v8/test/mjsunit/regress/regress-1341167.js b/deps/v8/test/mjsunit/regress/regress-1341167.js deleted file mode 100644 index 194a7b886a..0000000000 --- a/deps/v8/test/mjsunit/regress/regress-1341167.js +++ /dev/null @@ -1,33 +0,0 @@ -// Copyright 2008 the V8 project authors. All rights reserved. -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are -// met: -// -// * Redistributions of source code must retain the above copyright -// notice, this list of conditions and the following disclaimer. -// * Redistributions in binary form must reproduce the above -// copyright notice, this list of conditions and the following -// disclaimer in the documentation and/or other materials provided -// with the distribution. -// * Neither the name of Google Inc. nor the names of its -// contributors may be used to endorse or promote products derived -// from this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -// Make sure that 'this' is bound to the global object when using -// execScript. - -var result; -execScript("result = this"); -assertTrue(result === this); diff --git a/deps/v8/test/mjsunit/regress/regress-1401.js b/deps/v8/test/mjsunit/regress/regress-1401.js new file mode 100644 index 0000000000..33eb0677eb --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-1401.js @@ -0,0 +1,45 @@ +// Copyright 2011 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +// See: http://code.google.com/p/v8/issues/detail?id=1401 + +var bottom = 0; +var sizes = new Array(); + +for (i = 0; i < 10; i++) { + sizes[i] = 0; +} + +function foo() { + var size = bottom + 1 + 10; + var t = (sizes[++bottom] = size); + return t; +} + +for (i = 0; i < 5; i++) { + assertEquals(i + 11, foo()); +} diff --git a/deps/v8/test/mjsunit/regress/regress-1403.js b/deps/v8/test/mjsunit/regress/regress-1403.js new file mode 100644 index 0000000000..f2520ccbc9 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-1403.js @@ -0,0 +1,36 @@ +// Copyright 2011 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +// See: http://code.google.com/p/v8/issues/detail?id=1403 + +a = []; +Object.prototype.__proto__ = { __proto__: null }; +a.shift(); + +a = []; +Array.prototype.__proto__ = { __proto__: null }; +a.shift(); diff --git a/deps/v8/test/mjsunit/regress/splice-missing-wb.js b/deps/v8/test/mjsunit/regress/splice-missing-wb.js new file mode 100644 index 0000000000..5ff0d81e8b --- /dev/null +++ b/deps/v8/test/mjsunit/regress/splice-missing-wb.js @@ -0,0 +1,56 @@ +// Copyright 2011 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +// Flags: --expose-gc + +// Create array large enough to span several page regions. +var a = new Array(500); + +// Fill it with values. +for (var i = 0; i < a.length; i++) a[i] = {idx:i}; + +// Force it into oldspace. +gc(); +gc(); + +// Array should be in old space now. Store young object into array. +// Region will be marked. +a[0] = {idx:0}; + +// Delete elements a[2] .. a[201]. Internally we will use +// trimming of backing store. a[0] a[1] will be moved to +// memory location previously occupied by a[200] a[201]. +a.splice(2, 200); + +// Force gc and heap verification. +gc(); + +// Try accessing a[0].idx. It will segfault if write-barrier was accidentally +// omitted. +assertEquals(0, a[0].idx); +assertEquals(1, a[1].idx); +assertEquals(202, a[2].idx); -- cgit v1.2.1