Merge V8 5.2.361.47 DO NOT MERGE
https://chromium.googlesource.com/v8/v8/+/5.2.361.47
FPIIM-449
Change-Id: Ibec421b85a9b88cb3a432ada642e469fe7e78346
(cherry picked from commit bcf72ee8e3b26f1d0726869c7ddb3921c68b09a8)
diff --git a/test/mjsunit/regress/regress-3315.js b/test/mjsunit/regress/regress-3315.js
deleted file mode 100644
index bfd7df2..0000000
--- a/test/mjsunit/regress/regress-3315.js
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-//
-// Flags: --harmony-object-observe
-
-var indexZeroCallCount = 0;
-var indexOneCallCount = 0;
-var lengthCallCount = 0;
-var acceptList = {
- get 0() {
- indexZeroCallCount++;
- return 'foo';
- },
- get 1() {
- indexOneCallCount++;
- return 'bar';
- },
- get length() {
- lengthCallCount++;
- return 1;
- }
-};
-
-Object.observe({}, function(){}, acceptList);
-assertEquals(1, lengthCallCount);
-assertEquals(1, indexZeroCallCount);
-assertEquals(0, indexOneCallCount);
diff --git a/test/mjsunit/regress/regress-353004.js b/test/mjsunit/regress/regress-353004.js
index 658fd6d..7e1fb7e 100644
--- a/test/mjsunit/regress/regress-353004.js
+++ b/test/mjsunit/regress/regress-353004.js
@@ -41,19 +41,21 @@
var buffer5 = new ArrayBuffer(100 * 1024);
-var buffer6 = buffer5.slice({valueOf : function() {
- %ArrayBufferNeuter(buffer5);
- return 0;
-}}, 100 * 1024 * 1024);
-assertEquals(0, buffer6.byteLength);
+assertThrows(function() {
+ buffer5.slice({valueOf : function() {
+ %ArrayBufferNeuter(buffer5);
+ return 0;
+ }}, 100 * 1024 * 1024);
+}, TypeError);
var buffer7 = new ArrayBuffer(100 * 1024 * 1024);
-var buffer8 = buffer7.slice(0, {valueOf : function() {
- %ArrayBufferNeuter(buffer7);
- return 100 * 1024 * 1024;
-}});
-assertEquals(0, buffer8.byteLength);
+assertThrows(function() {
+ buffer7.slice(0, {valueOf : function() {
+ %ArrayBufferNeuter(buffer7);
+ return 100 * 1024 * 1024;
+ }});
+}, TypeError);
var buffer9 = new ArrayBuffer(1024);
var array9 = new Uint8Array(buffer9);
diff --git a/test/mjsunit/regress/regress-356589.js b/test/mjsunit/regress/regress-356589.js
deleted file mode 100644
index a47f51b..0000000
--- a/test/mjsunit/regress/regress-356589.js
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-// * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-// * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following
-// disclaimer in the documentation and/or other materials provided
-// with the distribution.
-// * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived
-// from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --harmony-object-observe
-
-// This test passes if it does not crash in debug mode
-
-arr = ['a', 'b', 'c', 'd'];
-Object.defineProperty(arr.__proto__, '0', { get: function(){} });
-Object.defineProperty(arr, '2', {get: function(){} });
-Object.observe(arr, function() {});
-arr.length = 2;
diff --git a/test/mjsunit/regress/regress-3926.js b/test/mjsunit/regress/regress-3926.js
index 4720c1b..4d9b298 100644
--- a/test/mjsunit/regress/regress-3926.js
+++ b/test/mjsunit/regress/regress-3926.js
@@ -2,8 +2,6 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --harmony-sloppy --harmony-sloppy-let
-
// See: http://code.google.com/p/v8/issues/detail?id=3926
// Switch statements should disable hole check elimination
diff --git a/test/mjsunit/regress/regress-417709a.js b/test/mjsunit/regress/regress-417709a.js
deleted file mode 100644
index 5500be2..0000000
--- a/test/mjsunit/regress/regress-417709a.js
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-object-observe
-// Flags: --stack-size=100
-
-var a = [];
-
-Object.observe(a, function() {});
-
-function f(a, x) {
- a.length = x;
- f(a, x + 1);
-}
-
-assertThrows(function() { f(a, 1); }, RangeError);
diff --git a/test/mjsunit/regress/regress-417709b.js b/test/mjsunit/regress/regress-417709b.js
deleted file mode 100644
index 4d9572e..0000000
--- a/test/mjsunit/regress/regress-417709b.js
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-object-observe --stack-size=100
-
-var a = [];
-
-Array.observe(a, function() {});
-
-function f(a, x) {
- a.length = x;
- f(a, x + 1);
-}
-
-assertThrows(function() { f(a, 1); }, RangeError);
diff --git a/test/mjsunit/regress/regress-4693.js b/test/mjsunit/regress/regress-4693.js
index 13b4e2b..2c31cd9 100644
--- a/test/mjsunit/regress/regress-4693.js
+++ b/test/mjsunit/regress/regress-4693.js
@@ -2,7 +2,6 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
-// Flags: --harmony-sloppy-function
// In sloppy mode we allow function redeclarations within blocks for webcompat.
(function() {
diff --git a/test/mjsunit/regress/regress-4908.js b/test/mjsunit/regress/regress-4908.js
new file mode 100644
index 0000000..ec618b3
--- /dev/null
+++ b/test/mjsunit/regress/regress-4908.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --always-opt --no-lazy
+
+(function() { ((s = 17, y = s) => s)() })();
diff --git a/test/mjsunit/regress/regress-4945.js b/test/mjsunit/regress/regress-4945.js
new file mode 100644
index 0000000..8e595e6
--- /dev/null
+++ b/test/mjsunit/regress/regress-4945.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function* g(o) {
+ yield 'x' in o;
+}
+
+assertTrue(g({x: 1}).next().value);
+assertFalse(g({}).next().value);
diff --git a/test/mjsunit/regress/regress-4964.js b/test/mjsunit/regress/regress-4964.js
new file mode 100644
index 0000000..d834708
--- /dev/null
+++ b/test/mjsunit/regress/regress-4964.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Neutered source
+var ab = new ArrayBuffer(10);
+ab.constructor = { get [Symbol.species]() { %ArrayBufferNeuter(ab); return ArrayBuffer; } };
+assertThrows(() => ab.slice(0), TypeError);
+
+// Neutered target
+class NeuteredArrayBuffer extends ArrayBuffer {
+ constructor(...args) {
+ super(...args);
+ %ArrayBufferNeuter(this);
+ }
+}
+
+var ab2 = new ArrayBuffer(10);
+ab2.constructor = NeuteredArrayBuffer;
+assertThrows(() => ab2.slice(0), TypeError);
diff --git a/test/mjsunit/regress/regress-4967.js b/test/mjsunit/regress/regress-4967.js
new file mode 100644
index 0000000..9b36405
--- /dev/null
+++ b/test/mjsunit/regress/regress-4967.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => {
+ new class extends Object {
+ constructor() { (() => delete super[super()])(); }
+ }
+}, ReferenceError);
diff --git a/test/mjsunit/regress/regress-4971.js b/test/mjsunit/regress/regress-4971.js
new file mode 100644
index 0000000..041f6c2
--- /dev/null
+++ b/test/mjsunit/regress/regress-4971.js
@@ -0,0 +1,41 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestDeoptInNamedSuperGetter() {
+ class C { m() { return 23 } }
+ class D extends C { f() { return super.boom() } }
+
+ var should_deoptimize_caller = false;
+ Object.defineProperty(C.prototype, "boom", { get: function() {
+ if (should_deoptimize_caller) %DeoptimizeFunction(D.prototype.f);
+ return this.m
+ }})
+
+ assertEquals(23, new D().f());
+ assertEquals(23, new D().f());
+ %OptimizeFunctionOnNextCall(D.prototype.f);
+ assertEquals(23, new D().f());
+ should_deoptimize_caller = true;
+ assertEquals(23, new D().f());
+})();
+
+(function TestDeoptInKeyedSuperGetter() {
+ class C { m() { return 23 } }
+ class D extends C { f(name) { return super[name]() } }
+
+ var should_deoptimize_caller = false;
+ Object.defineProperty(C.prototype, "boom", { get: function() {
+ if (should_deoptimize_caller) %DeoptimizeFunction(D.prototype.f);
+ return this.m
+ }})
+
+ assertEquals(23, new D().f("boom"));
+ assertEquals(23, new D().f("boom"));
+ %OptimizeFunctionOnNextCall(D.prototype.f);
+ assertEquals(23, new D().f("boom"));
+ should_deoptimize_caller = true;
+ assertEquals(23, new D().f("boom"));
+})();
diff --git a/test/mjsunit/regress/regress-5033.js b/test/mjsunit/regress/regress-5033.js
new file mode 100644
index 0000000..728094f
--- /dev/null
+++ b/test/mjsunit/regress/regress-5033.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var test = function() {
+ var t = Date.now(); // Just any non-constant double value.
+ var o = {
+ ['p']: 1,
+ t
+ };
+};
+
+function caller() {
+ test();
+}
+caller();
+caller();
+%OptimizeFunctionOnNextCall(caller);
+caller();
diff --git a/test/mjsunit/regress/regress-5178.js b/test/mjsunit/regress/regress-5178.js
new file mode 100644
index 0000000..bc0dd11
--- /dev/null
+++ b/test/mjsunit/regress/regress-5178.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => {
+ try { throw {} } catch({a=b, b}) { a+b }
+}, ReferenceError);
diff --git a/test/mjsunit/regress/regress-5199.js b/test/mjsunit/regress/regress-5199.js
new file mode 100644
index 0000000..818e71a
--- /dev/null
+++ b/test/mjsunit/regress/regress-5199.js
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertTrue(/(a[\u1000A])+/i.test('aa'));
diff --git a/test/mjsunit/regress/regress-520029.js b/test/mjsunit/regress/regress-520029.js
index 299dd75..9a1d200 100644
--- a/test/mjsunit/regress/regress-520029.js
+++ b/test/mjsunit/regress/regress-520029.js
@@ -2,8 +2,6 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --harmony-sloppy-let --harmony-sloppy
-
// Test that hoisting a function out of a lexical scope does not
// lead to a parsing error
diff --git a/test/mjsunit/regress/regress-536751.js b/test/mjsunit/regress/regress-536751.js
index 0707e00..a63fae3 100644
--- a/test/mjsunit/regress/regress-536751.js
+++ b/test/mjsunit/regress/regress-536751.js
@@ -2,7 +2,6 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --harmony-sloppy --harmony-sloppy-function --harmony-sloppy-let
// Flags: --no-harmony-restrictive-declarations
// At some point, this code led to DCHECK errors in debug mode
diff --git a/test/mjsunit/regress/regress-542099.js b/test/mjsunit/regress/regress-542099.js
index eef4953..6345fd4 100644
--- a/test/mjsunit/regress/regress-542099.js
+++ b/test/mjsunit/regress/regress-542099.js
@@ -2,7 +2,6 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --harmony-sloppy --harmony-sloppy-function
// Flags: --no-harmony-restrictive-declarations
// Previously, this caused a CHECK fail in debug mode
diff --git a/test/mjsunit/regress/regress-542100.js b/test/mjsunit/regress/regress-542100.js
index 70fb5dc..c16e628 100644
--- a/test/mjsunit/regress/regress-542100.js
+++ b/test/mjsunit/regress/regress-542100.js
@@ -2,7 +2,6 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --harmony-sloppy --harmony-sloppy-function
// Flags: --no-harmony-restrictive-declarations
(function() {
diff --git a/test/mjsunit/regress/regress-585041.js b/test/mjsunit/regress/regress-585041.js
new file mode 100644
index 0000000..c072ed2
--- /dev/null
+++ b/test/mjsunit/regress/regress-585041.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(arr, i) {
+ arr[i] = 50;
+}
+
+function boom(dummy) {
+ var arr = new Array(10);
+ f(arr, 10);
+ if (dummy) {
+ f(arr, -2147483648);
+ }
+}
+
+boom(false);
+%OptimizeFunctionOnNextCall(boom);
+boom(false);
diff --git a/test/mjsunit/regress/regress-592352.js b/test/mjsunit/regress/regress-592352.js
new file mode 100644
index 0000000..f3477c0
--- /dev/null
+++ b/test/mjsunit/regress/regress-592352.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --allow-natives-syntax
+
+function __f_76() {
+ "use asm";
+ function __f_72() {
+ %OptimizeFunctionOnNextCall();
+ }
+ return {__f_72:__f_72};
+}
+
+try {
+ Wasm.instantiateModuleFromAsm( __f_76.toString());
+ assertTrue(false);
+} catch (e) {
+ print("Caught: " + e);
+}
diff --git a/test/mjsunit/regress/regress-599068-func-bindings.js b/test/mjsunit/regress/regress-599068-func-bindings.js
new file mode 100644
index 0000000..887c000
--- /dev/null
+++ b/test/mjsunit/regress/regress-599068-func-bindings.js
@@ -0,0 +1,45 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Tests function bindings are correctly handled in ignition.
+(function f() {
+ function assignSloppy() {
+ f = 0;
+ }
+ assertDoesNotThrow(assignSloppy);
+
+ function assignStrict() {
+ 'use strict';
+ f = 0;
+ }
+ assertThrows(assignStrict, TypeError);
+
+ function assignStrictLookup() {
+ eval("'use strict'; f = 1;");
+ }
+ assertThrows(assignStrictLookup, TypeError);
+})();
+
+// Tests for compound assignments which are handled differently
+// in crankshaft.
+(function f() {
+ function assignSloppy() {
+ f += "x";
+ }
+ assertDoesNotThrow(assignSloppy);
+ assertDoesNotThrow(assignSloppy);
+ %OptimizeFunctionOnNextCall(assignSloppy);
+ assertDoesNotThrow(assignSloppy);
+
+ function assignStrict() {
+ 'use strict';
+ f += "x";
+ }
+ assertThrows(assignStrict, TypeError);
+ assertThrows(assignStrict, TypeError);
+ %OptimizeFunctionOnNextCall(assignStrict);
+ assertThrows(assignStrict, TypeError);
+})();
diff --git a/test/mjsunit/regress/regress-599717.js b/test/mjsunit/regress/regress-599717.js
new file mode 100644
index 0000000..2cfd7fc
--- /dev/null
+++ b/test/mjsunit/regress/regress-599717.js
@@ -0,0 +1,25 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+function __f_61(stdlib, buffer) {
+ "use asm";
+ var __v_14 = new stdlib.Float64Array(buffer);
+ function __f_74() {
+ var __v_35 = 6.0;
+ __v_14[2] = __v_35 + 1.0;
+ }
+ return {__f_74: __f_74};
+}
+var ok = false;
+try {
+ var __v_12 = new ArrayBuffer(2147483648);
+ ok = true;
+} catch (e) {
+ // Can happen on 32 bit systems.
+}
+if (ok) {
+ var module = Wasm.instantiateModuleFromAsm( __f_61.toString(), null, __v_12);
+}
diff --git a/test/mjsunit/regress/regress-599719.js b/test/mjsunit/regress/regress-599719.js
new file mode 100644
index 0000000..579fa1f
--- /dev/null
+++ b/test/mjsunit/regress/regress-599719.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-wasm
+
+function __f_7() {
+ %DeoptimizeFunction(__f_5);
+}
+function __f_8(global, env) {
+ "use asm";
+ var __f_7 = env.__f_7;
+ function __f_9(i4, i5) {
+ i4 = i4 | 0;
+ i5 = i5 | 0;
+ __f_7();
+ }
+ return {'__f_9': __f_9}
+}
+function __f_5() {
+ var __v_5 = Wasm.instantiateModuleFromAsm( __f_8.toString(), {'__f_7': __f_7});
+ __v_5.__f_9(0, 0, 0);
+}
+__f_5();
diff --git a/test/mjsunit/regress/regress-605470.js b/test/mjsunit/regress/regress-605470.js
new file mode 100644
index 0000000..722e8ae
--- /dev/null
+++ b/test/mjsunit/regress/regress-605470.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition
+
+function function_with_m_args(m) {
+ var source = '(function f() { return; })(';
+ for (var arg = 0; arg < m ; arg++) {
+ if (arg != 0) source += ',';
+ source += arg;
+ }
+ source += ')';
+ return eval(source);
+}
+
+function_with_m_args(0x7FFF);
diff --git a/test/mjsunit/regress/regress-605488.js b/test/mjsunit/regress/regress-605488.js
new file mode 100644
index 0000000..03e6a38
--- /dev/null
+++ b/test/mjsunit/regress/regress-605488.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+try {
+ Wasm.instantiateModuleFromAsm("");
+ assertTrue(false);
+} catch (e) {
+ print("Caught: " + e);
+}
diff --git a/test/mjsunit/regress/regress-606021.js b/test/mjsunit/regress/regress-606021.js
new file mode 100644
index 0000000..54b283e
--- /dev/null
+++ b/test/mjsunit/regress/regress-606021.js
@@ -0,0 +1,32 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ return function(c) {
+ var double_var = [3.0, 3.5][0];
+ var literal = c ? [1, double_var] : [double_var, 3.5];
+ return literal[0];
+ };
+}
+
+var f1 = foo();
+var f2 = foo();
+
+// Both closures point to full code.
+f1(false);
+f2(false);
+
+// Optimize f1, but don't initialize the [1, double_var] literal.
+%OptimizeFunctionOnNextCall(f1);
+f1(false);
+
+// Initialize the [1, double_var] literal, and transition the boilerplate to
+// double.
+f2(true);
+
+// Trick crankshaft into writing double_var at the wrong position.
+var l = f1(true);
+assertEquals(1, l);
diff --git a/test/mjsunit/regress/regress-608630.js b/test/mjsunit/regress/regress-608630.js
new file mode 100644
index 0000000..a0f3c43
--- /dev/null
+++ b/test/mjsunit/regress/regress-608630.js
@@ -0,0 +1,69 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+var __v_5 = {};
+var __v_35 = {};
+var __v_44 = {};
+var __v_43 = {};
+
+try {
+__v_1 = 1;
+__v_2 = {
+ get: function() { return function() {} },
+ has() { return true },
+ getOwnPropertyDescriptor: function() {
+ if (__v_1-- == 0) throw "please die";
+ return {value: function() {}, configurable: true};
+ }
+};
+__v_3 = new Proxy({}, __v_2);
+__v_30 = Object.create(__v_35);
+with (__v_5) { f() }
+} catch(e) { print("Caught: " + e); }
+
+function __f_1(asmfunc, expect) {
+ var __v_1 = asmfunc.toString();
+ var __v_2 = __v_1.replace(new RegExp("use asm"), "");
+ var __v_39 = {Math: Math};
+ var __v_4 = eval("(" + __v_2 + ")")(__v_3);
+ print("Testing " + asmfunc.name + " (js)...");
+ __v_44.valueOf = __v_43;
+ expect(__v_4);
+ print("Testing " + asmfunc.name + " (asm.js)...");
+ var __v_5 = asmfunc(__v_3);
+ expect(__v_5);
+ print("Testing " + asmfunc.name + " (wasm)...");
+ var __v_6 = Wasm.instantiateModuleFromAsm(__v_1, __v_3);
+ expect(__v_6);
+}
+function __f_2() {
+ "use asm";
+ function __f_3() { return 0; }
+ function __f_4() { return 1; }
+ function __f_5() { return 4; }
+ function __f_6() { return 64; }
+ function __f_7() { return 137; }
+ function __f_8() { return 128; }
+ function __f_9() { return -1; }
+ function __f_10() { return 1000; }
+ function __f_11() { return 2000000; }
+ function __f_12() { return 2147483647; }
+ return {__f_3: __f_3, __f_4: __f_4, __f_5: __f_5, __f_6: __f_6, __f_7: __f_7, __f_8: __f_8,
+ __f_9: __f_9, __f_10: __f_10, __f_11, __f_12: __f_12};
+}
+try {
+__f_1(__f_2, function(module) {
+ assertEquals(0, module.__f_3());
+ assertEquals(1, module.__f_4());
+ assertEquals(4, module.__f_5());
+ assertEquals(64, module.__f_6());
+ assertEquals(128, module.__f_8());
+ assertEquals(-1, module.__f_9());
+ assertEquals(1000, module.__f_10());
+ assertEquals(2000000, module.__f_11());
+ assertEquals(2147483647, module.__f_12());
+});
+} catch(e) { print("Caught: " + e); }
diff --git a/test/mjsunit/regress/regress-610633.js b/test/mjsunit/regress/regress-610633.js
new file mode 100644
index 0000000..8ee0e7e
--- /dev/null
+++ b/test/mjsunit/regress/regress-610633.js
@@ -0,0 +1,40 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function getLength(a) {
+ return a.length;
+}
+
+function getByteLength(a) {
+ return a.byteLength;
+}
+
+function getByteOffset(a) {
+ return a.byteOffset;
+}
+
+var a = new Uint8Array([1, 2, 3]);
+getLength(a);
+getLength(a);
+
+Object.defineProperty(a.__proto__, 'length', {value: 42});
+
+assertEquals(42, getLength(a));
+assertEquals(42, a.length);
+
+getByteLength(a);
+getByteLength(a);
+
+Object.defineProperty(a.__proto__, 'byteLength', {value: 42});
+
+assertEquals(42, getByteLength(a));
+assertEquals(42, a.byteLength);
+
+getByteOffset(a);
+getByteOffset(a);
+
+Object.defineProperty(a.__proto__, 'byteOffset', {value: 42});
+
+assertEquals(42, getByteOffset(a));
+assertEquals(42, a.byteOffset);
diff --git a/test/mjsunit/regress/regress-616386.js b/test/mjsunit/regress/regress-616386.js
new file mode 100644
index 0000000..d462ab7
--- /dev/null
+++ b/test/mjsunit/regress/regress-616386.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy
+
+assertEquals(0, ((y = (function(a2) { bbbb = a2 }), bbbb = eval('1')) => {y(0); return bbbb})())
+assertEquals(0, (({y = (function(a2) { bbbb = a2 }), bbbb = eval('1')} = {}) => {y(0); return bbbb})())
+assertEquals(0, (function (y = (function(a2) { bbbb = a2 }), bbbb = eval('1')) {y(0); return bbbb})())
+assertEquals(0, (function ({y = (function(a2) { bbbb = a2 }), bbbb = eval('1')} = {}) {y(0); return bbbb})())
diff --git a/test/mjsunit/regress/regress-619382.js b/test/mjsunit/regress/regress-619382.js
new file mode 100644
index 0000000..971318a
--- /dev/null
+++ b/test/mjsunit/regress/regress-619382.js
@@ -0,0 +1,35 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// // Use of this source code is governed by a BSD-style license that can be
+// // found in the LICENSE file.
+//
+// // Flags: --expose-gc --always-opt
+
+(function __f_9() {
+})();
+function __f_16(ctor_desc) {
+ var __v_22 = 5;
+ var __v_25 = [];
+ gc(); gc(); gc();
+ for (var __v_18 = 0; __v_18 < __v_22; __v_18++) {
+ __v_25[__v_18] = ctor_desc.ctor.apply();
+ }
+}
+var __v_28 = [
+ {
+ ctor: function(__v_27) { return {a: __v_27}; },
+ args: function() { return [1.5 + __v_18]; } },
+ {
+ ctor: function(__v_27) { var __v_21 = []; __v_21[1] = __v_27; __v_21[200000] = __v_27; return __v_21; },
+ args: function() { return [1.5 + __v_18]; } },
+ {
+ ctor: function() {
+ } }
+];
+var __v_26 = [
+ {
+ }];
+ __v_26.forEach(function(__v_16) {
+ __v_28.forEach(function(ctor) {
+ __f_16(ctor);
+ });
+ });
diff --git a/test/mjsunit/regress/regress-620553.js b/test/mjsunit/regress/regress-620553.js
new file mode 100644
index 0000000..461b9bb
--- /dev/null
+++ b/test/mjsunit/regress/regress-620553.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var o0 = [];
+var o1 = [];
+var cnt = 0;
+o1.__defineGetter__(0, function() {
+ if (cnt++ > 2) return;
+ o0.shift();
+ gc();
+ o0.push(0);
+ o0.concat(o1);
+});
+o1[0];
diff --git a/test/mjsunit/regress/regress-621869.js b/test/mjsunit/regress/regress-621869.js
new file mode 100644
index 0000000..db34064
--- /dev/null
+++ b/test/mjsunit/regress/regress-621869.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var o0 = [];
+var o1 = [];
+var cnt = 0;
+var only_scavenge = true;
+o1.__defineGetter__(0, function() {
+ if (cnt++ > 2) return;
+ o0.shift();
+ gc(only_scavenge);
+ o0.push((64));
+ o0.concat(o1);
+});
+o1[0];
diff --git a/test/mjsunit/regress/regress-674753.js b/test/mjsunit/regress/regress-674753.js
index b3704ea..d8a504a 100644
--- a/test/mjsunit/regress/regress-674753.js
+++ b/test/mjsunit/regress/regress-674753.js
@@ -25,62 +25,138 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Flags: --allow-natives-syntax
+
+var undetectable = %GetUndetectable();
+
// Number
assertTrue(typeof 0 == 'number');
assertTrue(typeof 0 === 'number');
+assertFalse(typeof 0 != 'number');
+assertFalse(typeof 0 !== 'number');
assertTrue(typeof 1.2 == 'number');
assertTrue(typeof 1.2 === 'number');
+assertFalse(typeof 1.2 != 'number');
+assertFalse(typeof 1.2 !== 'number');
+assertTrue(typeof 'x' != 'number');
+assertTrue(typeof 'x' !== 'number');
assertFalse(typeof 'x' == 'number');
assertFalse(typeof 'x' === 'number');
+assertTrue(typeof Object() != 'number');
+assertTrue(typeof Object() !== 'number');
+assertFalse(typeof Object() == 'number');
+assertFalse(typeof Object() === 'number');
// String
assertTrue(typeof 'x' == 'string');
assertTrue(typeof 'x' === 'string');
+assertFalse(typeof 'x' != 'string');
+assertFalse(typeof 'x' !== 'string');
assertTrue(typeof ('x' + 'x') == 'string');
assertTrue(typeof ('x' + 'x') === 'string');
+assertFalse(typeof ('x' + 'x') != 'string');
+assertFalse(typeof ('x' + 'x') !== 'string');
+assertTrue(typeof 1 != 'string');
+assertTrue(typeof 1 !== 'string');
assertFalse(typeof 1 == 'string');
assertFalse(typeof 1 === 'string');
+assertTrue(typeof Object() != 'string');
+assertTrue(typeof Object() !== 'string');
assertFalse(typeof Object() == 'string');
assertFalse(typeof Object() === 'string');
// Boolean
assertTrue(typeof true == 'boolean');
assertTrue(typeof true === 'boolean');
+assertFalse(typeof true != 'boolean');
+assertFalse(typeof true !== 'boolean');
assertTrue(typeof false == 'boolean');
assertTrue(typeof false === 'boolean');
+assertFalse(typeof false != 'boolean');
+assertFalse(typeof false !== 'boolean');
+assertTrue(typeof 1 != 'boolean');
+assertTrue(typeof 1 !== 'boolean');
assertFalse(typeof 1 == 'boolean');
assertFalse(typeof 1 === 'boolean');
+assertTrue(typeof 'x' != 'boolean');
+assertTrue(typeof 'x' !== 'boolean');
+assertFalse(typeof 'x' == 'boolean');
+assertFalse(typeof 'x' === 'boolean');
+assertTrue(typeof Object() != 'boolean');
+assertTrue(typeof Object() !== 'boolean');
assertFalse(typeof Object() == 'boolean');
assertFalse(typeof Object() === 'boolean');
// Undefined
assertTrue(typeof void 0 == 'undefined');
assertTrue(typeof void 0 === 'undefined');
+assertFalse(typeof void 0 != 'undefined');
+assertFalse(typeof void 0 !== 'undefined');
+assertTrue(typeof 1 != 'undefined');
+assertTrue(typeof 1 !== 'undefined');
assertFalse(typeof 1 == 'undefined');
assertFalse(typeof 1 === 'undefined');
+assertTrue(typeof null != 'undefined');
+assertTrue(typeof null !== 'undefined');
+assertFalse(typeof null == 'undefined');
+assertFalse(typeof null === 'undefined');
+assertTrue(typeof Object() != 'undefined');
+assertTrue(typeof Object() !== 'undefined');
assertFalse(typeof Object() == 'undefined');
assertFalse(typeof Object() === 'undefined');
+assertTrue(typeof undetectable == 'undefined');
+assertTrue(typeof undetectable === 'undefined');
+assertFalse(typeof undetectable != 'undefined');
+assertFalse(typeof undetectable !== 'undefined');
// Function
assertTrue(typeof Object == 'function');
assertTrue(typeof Object === 'function');
+assertFalse(typeof Object != 'function');
+assertFalse(typeof Object !== 'function');
+assertTrue(typeof 1 != 'function');
+assertTrue(typeof 1 !== 'function');
assertFalse(typeof 1 == 'function');
assertFalse(typeof 1 === 'function');
+assertTrue(typeof Object() != 'function');
+assertTrue(typeof Object() !== 'function');
assertFalse(typeof Object() == 'function');
assertFalse(typeof Object() === 'function');
+assertTrue(typeof undetectable != 'function');
+assertTrue(typeof undetectable !== 'function');
+assertFalse(typeof undetectable == 'function');
+assertFalse(typeof undetectable === 'function');
// Object
assertTrue(typeof Object() == 'object');
assertTrue(typeof Object() === 'object');
+assertFalse(typeof Object() != 'object');
+assertFalse(typeof Object() !== 'object');
assertTrue(typeof new String('x') == 'object');
assertTrue(typeof new String('x') === 'object');
+assertFalse(typeof new String('x') != 'object');
+assertFalse(typeof new String('x') !== 'object');
assertTrue(typeof ['x'] == 'object');
assertTrue(typeof ['x'] === 'object');
+assertFalse(typeof ['x'] != 'object');
+assertFalse(typeof ['x'] !== 'object');
assertTrue(typeof null == 'object');
assertTrue(typeof null === 'object');
+assertFalse(typeof null != 'object');
+assertFalse(typeof null !== 'object');
+assertTrue(typeof 1 != 'object');
+assertTrue(typeof 1 !== 'object');
assertFalse(typeof 1 == 'object');
assertFalse(typeof 1 === 'object');
+assertTrue(typeof 'x' != 'object');
+assertTrue(typeof 'x' !== 'object');
assertFalse(typeof 'x' == 'object'); // bug #674753
assertFalse(typeof 'x' === 'object');
+assertTrue(typeof Object != 'object');
+assertTrue(typeof Object !== 'object');
assertFalse(typeof Object == 'object');
assertFalse(typeof Object === 'object');
+assertTrue(typeof undetectable != 'object');
+assertTrue(typeof undetectable !== 'object');
+assertFalse(typeof undetectable == 'object');
+assertFalse(typeof undetectable === 'object');
diff --git a/test/mjsunit/regress/regress-crbug-119800.js b/test/mjsunit/regress/regress-crbug-119800.js
index 3946fbb..85f28a7 100644
--- a/test/mjsunit/regress/regress-crbug-119800.js
+++ b/test/mjsunit/regress/regress-crbug-119800.js
@@ -5,9 +5,9 @@
// Flags: --expose-debug-as debug
function f() {
- 1;
- 2;
- 3;
+ print(1);
+ print(2);
+ print(3);
}
var Debug = debug.Debug;
@@ -34,4 +34,5 @@
Debug.debuggerFlags().breakPointsActive.setValue(true);
assertNull(exception);
-assertEquals(breaks, ["1;", "2;", "3;", "}", "Debug.setListener(null);"]);
+assertEquals(breaks, ["print(1);", "print(2);", "print(3);", "}",
+ "Debug.setListener(null);"]);
diff --git a/test/mjsunit/regress/regress-crbug-451770.js b/test/mjsunit/regress/regress-crbug-451770.js
index 770c807..b4f088d 100644
--- a/test/mjsunit/regress/regress-crbug-451770.js
+++ b/test/mjsunit/regress/regress-crbug-451770.js
@@ -2,8 +2,6 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --harmony-sloppy
-
assertThrows(function f() {
var t = { toString: function() { throw new Error(); } };
var o = { [t]: 23 };
diff --git a/test/mjsunit/regress/regress-crbug-480807.js b/test/mjsunit/regress/regress-crbug-480807.js
index c273f20..a1448d6 100644
--- a/test/mjsunit/regress/regress-crbug-480807.js
+++ b/test/mjsunit/regress/regress-crbug-480807.js
@@ -2,7 +2,7 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --allow-natives-syntax --use-osr --turbo-osr --noalways-opt
+// Flags: --allow-natives-syntax --use-osr --noalways-opt
function foo() {
var c = 0;
diff --git a/test/mjsunit/regress/regress-crbug-582048.js b/test/mjsunit/regress/regress-crbug-582048.js
new file mode 100644
index 0000000..6d98f48
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-582048.js
@@ -0,0 +1,31 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+var Debug = debug.Debug;
+
+function listener(event, exec_state, event_data, data) {
+ if (event != Debug.DebugEvent.Break) return;
+ try {
+ var frame_count = exec_state.frameCount();
+ for (var i = 0; i < frame_count; i++) {
+ var frame = exec_state.frame(i);
+ var scope_count = frame.scopeCount();
+ for (var j = 0; j < scope_count; j++) {
+ var scope = frame.scope(j);
+ assertTrue(scope.scopeObject().property('').isUndefined());
+ }
+ }
+ } catch (e) {
+ print(e, e.stack);
+ exception = e;
+ }
+}
+
+Debug.setListener(listener);
+
+(function(a = 1) { debugger; })();
+
+Debug.setListener(null);
diff --git a/test/mjsunit/regress/regress-crbug-600257.js b/test/mjsunit/regress/regress-crbug-600257.js
new file mode 100644
index 0000000..87bd2e3
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-600257.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+(function rec() {
+ try {
+ rec();
+ } catch (e) {
+ /{/;
+ }
+})();
diff --git a/test/mjsunit/regress/regress-crbug-602184.js b/test/mjsunit/regress/regress-crbug-602184.js
new file mode 100644
index 0000000..c7d793b
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-602184.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(test, a) {
+ var v;
+ if (test) {
+ v = v|0;
+ }
+ a[v] = 1;
+}
+var v = new String();
+f(false, v);
+f(false, v);
+
+v = new Int32Array(10);
+f(true, v);
diff --git a/test/mjsunit/regress/regress-crbug-602595.js b/test/mjsunit/regress/regress-crbug-602595.js
new file mode 100644
index 0000000..7f6d478
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-602595.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function f(a) { return [a] }
+
+assertEquals([23], f(23));
+assertEquals([42], f(42));
+%OptimizeFunctionOnNextCall(f);
+assertEquals([65], f(65));
diff --git a/test/mjsunit/regress/regress-crbug-603463.js b/test/mjsunit/regress/regress-crbug-603463.js
new file mode 100644
index 0000000..20bfae6
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-603463.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function load(a, i) {
+ return a[i];
+}
+
+function f() {
+ return load(new Proxy({}, {}), undefined);
+}
+
+f();
+f();
+load([11, 22, 33], 0);
+f();
diff --git a/test/mjsunit/regress/regress-crbug-604299.js b/test/mjsunit/regress/regress-crbug-604299.js
new file mode 100644
index 0000000..9908f2d
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-604299.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Array.prototype.__defineSetter__(0,function(value){});
+
+if (this.Intl) {
+ var o = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Katmandu'})
+}
diff --git a/test/mjsunit/regress/regress-crbug-605060.js b/test/mjsunit/regress/regress-crbug-605060.js
new file mode 100644
index 0000000..d2dc79a
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-605060.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Array.prototype.__defineGetter__('map', function(){});
+Array.prototype.__defineGetter__('map', function(){});
+Array.prototype.__defineGetter__('map', function(){});
+assertTrue(%HasFastProperties(Array.prototype));
diff --git a/test/mjsunit/regress/regress-crbug-605581.js b/test/mjsunit/regress/regress-crbug-605581.js
new file mode 100644
index 0000000..0f1daab
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-605581.js
@@ -0,0 +1,28 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+var Debug = debug.Debug;
+var exception = null;
+
+function listener(event, exec_state, event_data, data) {
+ if (event != Debug.DebugEvent.Break) return;
+ try {
+ assertThrows(() => exec_state.frame(0).evaluate("bar.baz"), ReferenceError);
+ } catch (e) {
+ exception = e;
+ }
+}
+
+Debug.setListener(listener);
+
+(function() {
+ debugger; // bar is still in TDZ at this point.
+ let bar = 1;
+ (x => bar); // force bar to be context-allocated.
+})();
+
+Debug.setListener(null);
+assertNull(exception);
diff --git a/test/mjsunit/regress/regress-crbug-605862.js b/test/mjsunit/regress/regress-crbug-605862.js
new file mode 100644
index 0000000..3124c06
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-605862.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-unicode-regexps
+
+/[]*1/u.exec("\u1234");
+/[^\u0000-\u{10ffff}]*1/u.exec("\u1234");
diff --git a/test/mjsunit/regress/regress-crbug-608279.js b/test/mjsunit/regress/regress-crbug-608279.js
new file mode 100644
index 0000000..22c69f2
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-608279.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --always-opt --no-lazy
+
+function __f_38() {
+ try {
+ throw 0;
+ } catch (e) {
+ eval();
+ var __v_38 = { a: 'hest' };
+ __v_38.m = function () { return __v_38.a; };
+ }
+ return __v_38;
+}
+var __v_40 = __f_38();
+__v_40.m();
diff --git a/test/mjsunit/regress/regress-crbug-609029.js b/test/mjsunit/regress/regress-crbug-609029.js
new file mode 100644
index 0000000..bd77de2
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-609029.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt --function-context-specialization --gc-interval=14
+// Flags: --turbo-filter=match --verify-heap
+"xxx".match();
diff --git a/test/mjsunit/regress/regress-crbug-609046.js b/test/mjsunit/regress/regress-crbug-609046.js
new file mode 100644
index 0000000..10b63af
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-609046.js
@@ -0,0 +1,36 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+// Test that hidden scopes are correctly walked in the scope chain.
+
+var Debug = debug.Debug;
+var exception = null;
+var delegate = null;
+var done = false;
+
+function listener(event, exec_state, event_data, data) {
+ if (event != Debug.DebugEvent.Break) return;
+ try {
+ assertEquals([ debug.ScopeType.Block,
+ debug.ScopeType.Script,
+ debug.ScopeType.Global ],
+ exec_state.frame(0).allScopes().map(s => s.scopeType()));
+ done = true;
+ } catch (e) {
+ exception = e;
+ }
+}
+
+Debug.setListener(listener);
+
+for(let a = 0; a < 3; a++) {
+ debugger;
+ eval(); // Force context-allocation of everything.
+}
+
+Debug.setListener(null);
+assertNull(exception);
+assertTrue(done);
diff --git a/test/mjsunit/regress/regress-crbug-610207.js b/test/mjsunit/regress/regress-crbug-610207.js
new file mode 100644
index 0000000..4396a56
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-610207.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = function(exception, frames) {
+ return frames[0].getEvalOrigin();
+}
+
+try {
+ Realm.eval(0, "throw new Error('boom');");
+} catch(e) {
+ print(e.stack);
+}
diff --git a/test/mjsunit/regress/regress-crbug-610228.js b/test/mjsunit/regress/regress-crbug-610228.js
deleted file mode 100644
index ca077d5..0000000
--- a/test/mjsunit/regress/regress-crbug-610228.js
+++ /dev/null
@@ -1,11 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-function foo() { return JSON.stringify({a: 0.1}); }
-assertEquals('{"a":0.1}', foo());
-assertEquals('{"a":0.1}', foo());
-%OptimizeFunctionOnNextCall(foo);
-assertEquals('{"a":0.1}', foo());
diff --git a/test/mjsunit/regress/regress-crbug-612142.js b/test/mjsunit/regress/regress-crbug-612142.js
new file mode 100644
index 0000000..de2dc8d
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-612142.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var thrower = {[Symbol.toPrimitive]: function(e) { throw e }};
+try {
+ for (var i = 0; i < 10; i++) { }
+ for (var i = 0.5; i < 100000; ++i) { }
+ for (var i = 16 | 0 || 0 || this || 1; i;) { String.fromCharCode(thrower); }
+} catch (e) { }
diff --git a/test/mjsunit/regress/regress-crbug-617524.js b/test/mjsunit/regress/regress-crbug-617524.js
new file mode 100644
index 0000000..b32eeef
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-617524.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --always-opt
+
+function f(a,b,c) {
+ a.a = b;
+ a[1] = c;
+ return a;
+}
+
+f(new Array(5),.5,0);
+var o1 = f(new Array(5),0,.5);
+gc();
+var o2 = f(new Array(5),0,0);
+var o3 = f(new Array(5),0);
+assertEquals(0, o3.a);
diff --git a/test/mjsunit/regress/regress-crbug-620119.js b/test/mjsunit/regress/regress-crbug-620119.js
new file mode 100644
index 0000000..cbe5a78
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-620119.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy
+
+assertEquals(0, ((x, {[(x = function() { y = 0 }, "foo")]: y = eval(1)}) => { x(); return y })(42, {}));
+assertEquals(0, (function (x, {[(x = function() { y = 0 }, "foo")]: y = eval(1)}) { x(); return y })(42, {}));
diff --git a/test/mjsunit/regress/regress-object-assign-deprecated-2.js b/test/mjsunit/regress/regress-object-assign-deprecated-2.js
new file mode 100644
index 0000000..89693de
--- /dev/null
+++ b/test/mjsunit/regress/regress-object-assign-deprecated-2.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = {a:1, b:2};
+Object.defineProperty(x, "c", {set(v) {}})
+var y = {get c() { return {a:1, b:2.5} }};
+Object.assign(x, y, x);
diff --git a/test/mjsunit/regress/regress-object-assign-deprecated.js b/test/mjsunit/regress/regress-object-assign-deprecated.js
new file mode 100644
index 0000000..d2e60f9
--- /dev/null
+++ b/test/mjsunit/regress/regress-object-assign-deprecated.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = {a:1, b:2};
+var y = {a:1, b:2.5};
+Object.assign(x, x);
diff --git a/test/mjsunit/regress/regress-observe-map-cache.js b/test/mjsunit/regress/regress-observe-map-cache.js
deleted file mode 100644
index c71759c..0000000
--- a/test/mjsunit/regress/regress-observe-map-cache.js
+++ /dev/null
@@ -1,15 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-object-observe
-// Flags: --allow-natives-syntax --enable-slow-asserts
-
-function f() {
- var x = new Array(0);
- x[-1] = -1;
- Object.observe(x, function() { });
-}
-
-f();
-f();
diff --git a/test/mjsunit/regress/regress-opt-typeof-null.js b/test/mjsunit/regress/regress-opt-typeof-null.js
new file mode 100644
index 0000000..e4721a1
--- /dev/null
+++ b/test/mjsunit/regress/regress-opt-typeof-null.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ return typeof null === "object";
+};
+
+%OptimizeFunctionOnNextCall(f);
+assertTrue(f());
diff --git a/test/mjsunit/regress/regress-recurse-patch-binary-op.js b/test/mjsunit/regress/regress-recurse-patch-binary-op.js
new file mode 100644
index 0000000..842cc79
--- /dev/null
+++ b/test/mjsunit/regress/regress-recurse-patch-binary-op.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var i = 0
+function valueOf() {
+ while (true) return i++ < 4 ? 1 + this : 2
+}
+
+1 + ({valueOf})
diff --git a/test/mjsunit/regress/regress-v8-5009.js b/test/mjsunit/regress/regress-v8-5009.js
new file mode 100644
index 0000000..f499548
--- /dev/null
+++ b/test/mjsunit/regress/regress-v8-5009.js
@@ -0,0 +1,61 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function fn1() {
+}
+
+function fn2() {
+}
+
+function fn3() {
+}
+
+function create(id) {
+ // Just some `FunctionTemplate` to hang on
+ var o = new version();
+
+ o.id = id;
+ o[0] = null;
+
+ return o;
+}
+
+function setM1(o) {
+ o.m1 = fn1;
+}
+
+function setM2(o) {
+ o.m2 = fn2;
+}
+
+function setAltM2(o) {
+ // Failing StoreIC happens here
+ o.m2 = fn3;
+}
+
+function setAltM1(o) {
+ o.m1 = null;
+}
+
+function test(o) {
+ o.m2();
+ o.m1();
+}
+
+var p0 = create(0);
+var p1 = create(1);
+var p2 = create(2);
+
+setM1(p0);
+setM1(p1);
+setM1(p2);
+
+setM2(p0);
+setAltM2(p0);
+setAltM1(p0);
+
+setAltM2(p1);
+
+setAltM2(p2);
+test(p2);