Update V8 to r7079 as required by WebKit r80534.
Change-Id: I487c152e485d5a40b68997d7c0d2f1fba5da0834
diff --git a/test/mjsunit/array-concat.js b/test/mjsunit/array-concat.js
index db89f4d..97bd85a 100644
--- a/test/mjsunit/array-concat.js
+++ b/test/mjsunit/array-concat.js
@@ -101,7 +101,6 @@
assertEquals("undefined", typeof(c[-1]));
assertEquals("undefined", typeof(c[0xffffffff]));
assertEquals(c.length, a.length + 1);
-
}
poses = [140, 4000000000];
@@ -193,3 +192,46 @@
assertTrue(i in holey);
}
}
+
+// Polluted prototype from prior tests.
+delete Array.prototype[123];
+
+// Check that concat reads getters in the correct order.
+var arr1 = [,2];
+var arr2 = [1,3];
+var r1 = [].concat(arr1, arr2); // [,2,1,3]
+assertEquals([,2,1,3], r1);
+
+// Make first array change length of second array.
+Object.defineProperty(arr1, 0, {get: function() {
+ arr2.push("X");
+ return undefined;
+ }, configurable: true})
+var r2 = [].concat(arr1, arr2); // [undefined,2,1,3,"X"]
+assertEquals([undefined,2,1,3,"X"], r2);
+
+// Make first array change length of second array massively.
+arr2.length = 2;
+Object.defineProperty(arr1, 0, {get: function() {
+ arr2[500000] = "X";
+ return undefined;
+ }, configurable: true})
+var r3 = [].concat(arr1, arr2); // [undefined,2,1,3,"X"]
+var expected = [undefined,2,1,3];
+expected[500000 + 2] = "X";
+
+assertEquals(expected, r3);
+
+var arr3 = [];
+var trace = [];
+var expectedTrace = []
+function mkGetter(i) { return function() { trace.push(i); }; }
+arr3.length = 10000;
+for (var i = 0; i < 100; i++) {
+ Object.defineProperty(arr3, i * i, {get: mkGetter(i)});
+ expectedTrace[i] = i;
+ expectedTrace[100 + i] = i;
+}
+var r4 = [0].concat(arr3, arr3);
+assertEquals(1 + arr3.length * 2, r4.length);
+assertEquals(expectedTrace, trace);
diff --git a/test/mjsunit/array-join.js b/test/mjsunit/array-join.js
index c66e462..ddd1496 100644
--- a/test/mjsunit/array-join.js
+++ b/test/mjsunit/array-join.js
@@ -27,19 +27,44 @@
// Test that array join calls toString on subarrays.
var a = [[1,2],3,4,[5,6]];
+assertEquals('1,2345,6', a.join(''));
assertEquals('1,2*3*4*5,6', a.join('*'));
+assertEquals('1,2**3**4**5,6', a.join('**'));
+assertEquals('1,2****3****4****5,6', a.join('****'));
+assertEquals('1,2********3********4********5,6', a.join('********'));
+assertEquals('1,2**********3**********4**********5,6', a.join('**********'));
// Create a cycle.
a.push(a);
+assertEquals('1,2345,6', a.join(''));
assertEquals('1,2*3*4*5,6*', a.join('*'));
+assertEquals('1,2**3**4**5,6**', a.join('**'));
+assertEquals('1,2****3****4****5,6****', a.join('****'));
+assertEquals('1,2********3********4********5,6********', a.join('********'));
+assertEquals('1,2**********3**********4**********5,6**********', a.join('**********'));
// Replace array.prototype.toString.
Array.prototype.toString = function() { return "array"; }
+assertEquals('array34arrayarray', a.join(''));
assertEquals('array*3*4*array*array', a.join('*'));
+assertEquals('array**3**4**array**array', a.join('**'));
+assertEquals('array****3****4****array****array', a.join('****'));
+assertEquals('array********3********4********array********array', a.join('********'));
+assertEquals('array**********3**********4**********array**********array', a.join('**********'));
Array.prototype.toString = function() { throw 42; }
+assertThrows("a.join('')");
assertThrows("a.join('*')");
+assertThrows("a.join('**')");
+assertThrows("a.join('****')");
+assertThrows("a.join('********')");
+assertThrows("a.join('**********')");
Array.prototype.toString = function() { return "array"; }
+assertEquals('array34arrayarray', a.join(''));
assertEquals('array*3*4*array*array', a.join('*'));
+assertEquals('array**3**4**array**array', a.join('**'));
+assertEquals('array****3****4****array****array', a.join('****'));
+assertEquals('array********3********4********array********array', a.join('********'));
+assertEquals('array**********3**********4**********array**********array', a.join('**********'));
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/compiler/regress-valueof.js
similarity index 83%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/compiler/regress-valueof.js
index cfe2bd3..7b29b46 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/compiler/regress-valueof.js
@@ -25,14 +25,11 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Flags: --allow-natives-syntax
-__defineSetter__("x", function(){ throw 42; });
+// Test valueof with integer input.
+function f(x) { var y = x + 1; return %_ValueOf(y); }
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
-}
+for (var i=0; i<100000; i++) f(42);
+
+assertEquals(43, f(42));
diff --git a/test/mjsunit/fuzz-natives.js b/test/mjsunit/fuzz-natives.js
index 020e3c0..cefef0a 100644
--- a/test/mjsunit/fuzz-natives.js
+++ b/test/mjsunit/fuzz-natives.js
@@ -118,8 +118,9 @@
"Abort": true,
// Avoid calling the concat operation, because weird lengths
- // may lead to out-of-memory.
+ // may lead to out-of-memory. Ditto for StringBuilderJoin.
"StringBuilderConcat": true,
+ "StringBuilderJoin": true,
// These functions use pseudo-stack-pointers and are not robust
// to unexpected integer values.
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/indexed-value-properties.js
similarity index 69%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/indexed-value-properties.js
index cfe2bd3..92bb896 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/indexed-value-properties.js
@@ -25,14 +25,32 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Test that the Number, String and Boolean prototypes are searched
+// for indexed properties on value objects.
-__defineSetter__("x", function(){ throw 42; });
+function return_one() { return 1; };
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+function test(value) {
+ for (var i = 0; i < 10; i++) {
+ assertEquals(0, (value)[0]);
+ assertEquals(0, (value)["0"]);
+ assertEquals(return_one, (value)[1]);
+ assertEquals(return_one, (value)["1"]);
+ assertEquals(1, (value)[1]());
+ assertEquals(1, (value)["1"]());
+ }
}
+
+Number.prototype[0] = 0;
+Number.prototype[1] = return_one;
+test(0);
+test(0.1);
+
+String.prototype[0] = 0;
+String.prototype[1] = return_one;
+test("");
+
+Boolean.prototype[0] = 0;
+Boolean.prototype[1] = return_one;
+test(true);
+test(false);
diff --git a/test/mjsunit/mjsunit.js b/test/mjsunit/mjsunit.js
index 558282f..fe580f3 100644
--- a/test/mjsunit/mjsunit.js
+++ b/test/mjsunit/mjsunit.js
@@ -104,6 +104,13 @@
}
+function assertSame(expected, found, name_opt) {
+ if (found !== expected) {
+ fail(expected, found, name_opt);
+ }
+}
+
+
function assertEquals(expected, found, name_opt) {
if (!deepEquals(found, expected)) {
fail(expected, found, name_opt);
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 4012799..8f042ce 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -111,24 +111,6 @@
regress/regress-1132: SKIP
##############################################################################
-[ $arch == arm && $crankshaft ]
-
-# Test that currently fails with crankshaft on ARM.
-compiler/simple-osr: FAIL
-
-# BUG (1094)
-regress/regress-deopt-gc: SKIP
-
-##############################################################################
-[ $arch == x64 && $crankshaft ]
-
-# BUG (1026) This test is currently flaky.
-compiler/simple-osr: SKIP
-
-# BUG (1094)
-regress/regress-deopt-gc: SKIP
-
-##############################################################################
[ $arch == mips ]
# Skip all tests on MIPS.
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/override-eval-with-non-function.js
similarity index 83%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/override-eval-with-non-function.js
index cfe2bd3..aa93b25 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/override-eval-with-non-function.js
@@ -25,14 +25,12 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// When 'eval' is overridden with a non-function object we should
+// check whether the object is callable.
-__defineSetter__("x", function(){ throw 42; });
-
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+function test() {
+ eval = /foo/;
+ assertEquals("foo", eval("foobar"));
}
+
+test();
diff --git a/test/mjsunit/regexp.js b/test/mjsunit/regexp.js
index 8d776ad..24e1b21 100644
--- a/test/mjsunit/regexp.js
+++ b/test/mjsunit/regexp.js
@@ -676,3 +676,17 @@
assertFalse(re.test("c"));
assertFalse(re.test(""));
+// Valid syntax in ES5.
+re = RegExp("(?:x)*");
+re = RegExp("(x)*");
+
+// Syntax extension relative to ES5, for matching JSC (and ES3).
+// Shouldn't throw.
+re = RegExp("(?=x)*");
+re = RegExp("(?!x)*");
+
+// Should throw. Shouldn't hit asserts in debug mode.
+assertThrows("RegExp('(*)')");
+assertThrows("RegExp('(?:*)')");
+assertThrows("RegExp('(?=*)')");
+assertThrows("RegExp('(?!*)')");
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1145.js
similarity index 64%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1145.js
index cfe2bd3..16d5527 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1145.js
@@ -25,14 +25,30 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Flags: --opt-eagerly --debug-code --lazy
-__defineSetter__("x", function(){ throw 42; });
+// See: http://code.google.com/p/v8/issues/detail?id=1145
+// Should not throw a syntax error exception (change this if we make lazily
+// compiled functions with syntax errors into early errors).
+// Should not hit an assertion in debug mode.
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+// A lazily compiled function with a syntax error that is attempted inlined
+// would set a pending exception that is then ignored (until it triggers
+// an assert).
+// This file must be at least 1024 bytes long to trigger lazy compilation.
+
+function f() { return 1; }
+
+// Must be lazy. Must throw SyntaxError during compilation.
+function fail() { continue; }
+
+function opt_me() {
+ var x = 1;
+ // Do lots of function calls and hope to be optimized.
+ for (var i = 0; i < 1000000; i++) {
+ x = f();
+ }
+ if (x == 0) fail(); // Hope to be inlined during optimization.
}
+
+opt_me();
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1146.js
similarity index 78%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1146.js
index cfe2bd3..e8028ce 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1146.js
@@ -25,14 +25,24 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Test keyed calls with different key types.
+function F() {}
+var a = new F();
+function f(i) { return a[i](); }
-__defineSetter__("x", function(){ throw 42; });
+a.first = function() { return 11; }
+a[0] = function() { return 22; }
+var obj = {};
+a[obj] = function() { return 33; }
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
-}
+// Make object slow-case.
+a.foo = 0;
+delete a.foo;
+// Do multiple calls for IC transitions.
+var b = "first";
+f(b);
+f(b);
+
+assertEquals(11, f(b));
+assertEquals(22, f(0));
+assertEquals(33, f(obj));
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1149.js
similarity index 84%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1149.js
index cfe2bd3..d7a7d1b 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1149.js
@@ -25,14 +25,15 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// We should not try to record duplicate bailout IDs for the 'left-hand
+// side' of a for/in, even if it is a parameter in a function using the
+// arguments object.
-__defineSetter__("x", function(){ throw 42; });
-
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+function f(x) {
+ for (x in arguments) {
+ for (x in arguments) {
+ }
+ }
}
+
+f();
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1151.js
similarity index 68%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1151.js
index cfe2bd3..8d0bca9 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1151.js
@@ -25,14 +25,25 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Test that we do not try to create prototypes on objects that has the,
+// should_have_prototype flag set to false.
-__defineSetter__("x", function(){ throw 42; });
+__defineSetter__.__proto__ = function() {};
+__defineSetter__['prototype']
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
-}
+eval.__proto__ = function () { };
+eval['prototype'] = {};
+
+// Test that we are compatible with Safari on prototypes set locally and
+// on the actual prototype set using __proto__ on objects that has the
+// should_have_prototype set to false.
+function f() { return 42; }
+f.prototype = 43;
+__defineGetter__.__proto__ = f;
+
+// Regression test for not returning undefined.
+assertEquals(__defineGetter__.prototype, 43);
+
+// Regression test for not crashing.
+__defineGetter__.prototype = "foo";
+assertEquals(__defineGetter__.prototype, "foo");
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1156.js
similarity index 80%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1156.js
index cfe2bd3..8ec7f81 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1156.js
@@ -25,14 +25,25 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Flags: --allow-natives-syntax --nouse-inlining
-__defineSetter__("x", function(){ throw 42; });
+// Test that we do not crash we invoke builtins from optimized code that
+// is then deoptimized.
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+function foo(a) {
+ delete a[1];
+ delete a[2];
+ delete a[3];
+ delete a[4];
+ delete a[5];
+ return void 0;
}
+
+function call_and_deopt() {
+ var b = [1,2,3];
+ foo(b);
+ foo(b);
+ %DeoptimizeFunction(foo);
+}
+
+call_and_deopt();
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1160.js
similarity index 71%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1160.js
index cfe2bd3..8e6e29b 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1160.js
@@ -25,14 +25,22 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// See: http://code.google.com/p/v8/issues/detail?id=1160
-__defineSetter__("x", function(){ throw 42; });
+// Array.prototype.join uses a temporary array internally. Verify it
+// does not crash and throws an illegal argument exception instead
+// when keyed store on the array does not work as expected because of
+// the setter on its prototype.
try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
-}
+ var N = 100;
+ var array = Array(N);
+ for (var i = 0; i < N; ++i) {
+ array[i] = i;
+ }
+ Array.prototype.__defineSetter__(32, function() { });
+ // The next line throws. We should make it work even with changed
+ // prototype. See http://code.google.com/p/v8/issues/detail?id=1161
+ array.join(",");
+ assertUnreachable();
+} catch (e) { }
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1166.js
similarity index 84%
rename from test/mjsunit/regress/regress-1105.js
rename to test/mjsunit/regress/regress-1166.js
index cfe2bd3..d75d397 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1166.js
@@ -25,14 +25,11 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Deoptimization after a short-circuit logical operation in an effect
+// context should not see the value of the expression.
+function observe(x, y) { return x; }
-__defineSetter__("x", function(){ throw 42; });
+function test(x) { return observe(1, ((false || false), x + 1)); }
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
-}
+for (var i = 0; i < 10000000; ++i) test(0);
+test("a");
diff --git a/test/mjsunit/regress/regress-1167.js b/test/mjsunit/regress/regress-1167.js
new file mode 100644
index 0000000..8437d83
--- /dev/null
+++ b/test/mjsunit/regress/regress-1167.js
@@ -0,0 +1,72 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Deoptimization after a logical not in an effect context should not see a
+// value for the logical not expression.
+function test0(n) {
+ var a = new Array(n);
+ for (var i = 0; i < n; ++i) {
+ // ~ of a non-numeric value is used to trigger deoptimization.
+ a[i] = void(!(delete 'object')) % ~(delete 4);
+ }
+}
+
+// OSR (after deoptimization) is used to observe the stack height mismatch.
+for (var i = 0; i < 5; ++i) {
+ for (var j = 1; j < 12; ++j) {
+ test0(j * 1000);
+ }
+}
+
+
+// Similar test with a different subexpression of unary !.
+function test1(n) {
+ var a = new Array(n);
+ for (var i = 0; i < n; ++i) {
+ a[i] = void(!(- 'object')) % ~(delete 4);
+ }
+}
+
+for (i = 0; i < 5; ++i) {
+ for (j = 1; j < 12; ++j) {
+ test1(j * 1000);
+ }
+}
+
+
+// A similar issue, different subexpression of unary ! (e0 !== e1 is
+// translated into !(e0 == e1)) and different effect context.
+function side_effect() { }
+function observe(x, y) { return x; }
+function test2(x) {
+ return observe(this,
+ (((side_effect.observe <= side_effect.side_effect) !== false),
+ x + 1));
+}
+
+for (var i = 0; i < 1000000; ++i) test2(0);
+test2(test2);
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1170.js
similarity index 63%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1170.js
index cfe2bd3..8a5a9cf 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1170.js
@@ -25,14 +25,42 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+var setter_value = 0;
-__defineSetter__("x", function(){ throw 42; });
+__proto__.__defineSetter__("a", function(v) { setter_value = v; });
+eval("var a = 1");
+assertEquals(1, setter_value);
+assertFalse(hasOwnProperty("a"));
+eval("with({}) { eval('var a = 2') }");
+assertEquals(2, setter_value);
+assertFalse(hasOwnProperty("a"));
+
+// Function declarations are treated specially to match Safari. We do
+// not call setters for them.
+eval("function a() {}");
+assertTrue(hasOwnProperty("a"));
+
+__proto__.__defineSetter__("b", function(v) { assertUnreachable(); });
try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+ eval("const b = 23");
+ assertUnreachable();
+} catch(e) {
+ assertTrue(/TypeError/.test(e));
}
+try {
+ eval("with({}) { eval('const b = 23') }");
+ assertUnreachable();
+} catch(e) {
+ assertTrue(/TypeError/.test(e));
+}
+
+__proto__.__defineSetter__("c", function(v) { throw 42; });
+try {
+ eval("var c = 1");
+ assertUnreachable();
+} catch(e) {
+ assertEquals(42, e);
+ assertFalse(hasOwnProperty("c"));
+}
+
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1172-bis.js
similarity index 84%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1172-bis.js
index cfe2bd3..e8d5c81 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1172-bis.js
@@ -25,14 +25,13 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Verifies that exception thrown from JS accessors when attempting a call
+// are properly treated.
-__defineSetter__("x", function(){ throw 42; });
-
+Object.prototype.__defineGetter__(0, function() { throw 42; });
try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+ Object[0]();
+ assertUnreachable();
+} catch(e) {
+ assertEquals(42, e);
}
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1172.js
similarity index 78%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1172.js
index cfe2bd3..f5ef67b 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1172.js
@@ -25,14 +25,15 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Check that 'constructor' property is forcefully installed on
+// function's prototype even in the presence of JS accessors.
-__defineSetter__("x", function(){ throw 42; });
+// Note: no setters would lead to runtime exception if we ever attempt
+// to use JS accessors to set 'constructor' property.
+Object.prototype.__defineGetter__('constructor', function() { throw 42; });
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
-}
+function f() {}
+assertSame(f, f.prototype.constructor);
+
+var o = new f();
+assertSame(f, o.constructor);
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1174.js
similarity index 82%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1174.js
index cfe2bd3..7c014bf 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1174.js
@@ -25,14 +25,19 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Flags: --allow-natives-syntax
-__defineSetter__("x", function(){ throw 42; });
+// Test that we do not crash when doing deoptimization of a function that has
+// reloc info that only take up 1 byte per call (like KeyedStoreIC).
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+function Regular() {
+ this[0] >>= 0;
+ this[1] ^= 1;
}
+
+function foo() {
+ var regular = new Regular();
+ %DeoptimizeFunction(Regular);
+}
+
+foo();
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1176.js
similarity index 84%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1176.js
index cfe2bd3..58eda1b 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1176.js
@@ -25,14 +25,9 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
-
-__defineSetter__("x", function(){ throw 42; });
-
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+"use strict";
+function strict_delete_this() {
+ // "delete this" is allowed in strict mode.
+ delete this;
}
+strict_delete_this();
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1181.js
similarity index 74%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1181.js
index cfe2bd3..d45a0be 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1181.js
@@ -25,14 +25,30 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// The first count times, test is called with an integer argument and
+// crankshaft produces code for int32 representation. Test that the
+// implementation correctly deoptimizes.
-__defineSetter__("x", function(){ throw 42; });
+// Flags: --allow-natives-syntax
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+function test(x) {
+ var xp = x * 1 - 1;
+ return xp;
}
+
+
+function check(count) {
+ %DeoptimizeFunction(test);
+ var i;
+ for(var x=0; x < count; x++){
+ for(var y=0; y < count; y++){
+ i = test(x / 100);
+ }
+ }
+ assertEquals((count - 1) / 100, i + 1);
+}
+
+
+check(150);
+check(200);
+check(350);
\ No newline at end of file
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1184.js
similarity index 70%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1184.js
index cfe2bd3..0bb1b3c 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1184.js
@@ -25,14 +25,23 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Test the case when finally clause throws another exception (stack overflow)
+// which goes through some try/catch block---we need to clear v8::TryCatch
+// catcher as it doesn't catch original exception any more.
-__defineSetter__("x", function(){ throw 42; });
-
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
-}
+o = {};
+o.__defineGetter__('foo', function() { throw 42; });
+function f() {
+ try {
+ // throw below sets up Top::thread_local_.catcher_...
+ throw 42;
+ } finally {
+ // ...JS accessor traverses v8 runtime/JS boundary and
+ // when coming back from JS to v8 runtime, retraverses
+ // stack with catcher set while processing exception
+ // which is not caught by external try catch.
+ try { o.foo; } catch(e) { };
+ return;
+ }
+};
+f();
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1207.js
similarity index 84%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1207.js
index cfe2bd3..102178a 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1207.js
@@ -25,14 +25,11 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
-
-__defineSetter__("x", function(){ throw 42; });
-
+// Test throwing an exception from instanceof.
try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+var object = { };
+function fib(n) {
+ var f0 = (object instanceof encodeURI)('#2: var x = 1; x <= 1 === true'), f1 = 1;
}
+fib(75);
+} catch (o) { }
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1209.js
similarity index 84%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1209.js
index cfe2bd3..c017fb5 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1209.js
@@ -25,14 +25,10 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
-
-__defineSetter__("x", function(){ throw 42; });
-
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+function crashMe(n) {
+ var nasty = [];
+ while (n--)
+ nasty.push("a" + 0);
+ return Function.apply(null, nasty);
}
+crashMe(64 + 1).length;
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1210.js
similarity index 72%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1210.js
index cfe2bd3..9c708a5 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1210.js
@@ -25,14 +25,24 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Deoptimization of the key expression in an arguments access should see
+// the arguments object as the value of the receiver.
-__defineSetter__("x", function(){ throw 42; });
+var a = 0;
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+function observe(x, y) { return x; }
+
+function side_effect(x) { a = x; }
+
+function test() {
+ // We will trigger deoptimization of 'a + 0' which should bail out to
+ // immediately after the call to 'side_effect' (i.e., still in the key
+ // subexpression of the arguments access).
+ return observe(a, arguments[side_effect(a), a + 0]);
}
+
+// Run enough to optimize assuming global 'a' is a smi.
+for (var i = 0; i < 1000000; ++i) test(0);
+
+a = "hello";
+test(0);
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1213.js
similarity index 83%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1213.js
index cfe2bd3..d66e3ce 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1213.js
@@ -25,14 +25,19 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// Test that we do not allow overwriting a global property with a
+// redeclaration that makes the property configurable (and hence
+// deletable).
-__defineSetter__("x", function(){ throw 42; });
+var x = 0;
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
+function TestGlobal() {
+ for (var i = 0; i < 2; i++) {
+ x = x + 1;
+ }
+ this.eval('function x() {};');
+ delete this['x'];
}
+
+TestGlobal();
+TestGlobal();
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-1218.js
similarity index 84%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-1218.js
index cfe2bd3..dd036ed 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-1218.js
@@ -25,14 +25,5 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
-
-__defineSetter__("x", function(){ throw 42; });
-
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
-}
+// Builtin functions should not have prototype objects.
+assertFalse(Error.prototype.toString.hasOwnProperty("prototype"));
diff --git a/test/mjsunit/regress/regress-1105.js b/test/mjsunit/regress/regress-crbug-72736.js
similarity index 80%
copy from test/mjsunit/regress/regress-1105.js
copy to test/mjsunit/regress/regress-crbug-72736.js
index cfe2bd3..4b4b145 100644
--- a/test/mjsunit/regress/regress-1105.js
+++ b/test/mjsunit/regress/regress-crbug-72736.js
@@ -25,14 +25,13 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// This should properly catch the exception from the setter triggered
-// by the loaded file, and it should not fail an assertion in debug mode.
+// See http://crbug.com/72736
-__defineSetter__("x", function(){ throw 42; });
+// This tests that Object.defineProperty actually allows to change the value of
+// a non-writable property if configurable is true.
-try {
- this.eval('function x(){}');
- assertUnreachable();
-} catch (e) {
- assertEquals(42, e);
-}
+var obj = {};
+Object.defineProperty(obj, 'foo', { value: 10, configurable: true });
+assertEquals(obj.foo, 10);
+Object.defineProperty(obj, 'foo', { value: 20, configurable: true });
+assertEquals(obj.foo, 20);
diff --git a/test/mjsunit/strict-mode.js b/test/mjsunit/strict-mode.js
index 6b775fc..69be19c 100644
--- a/test/mjsunit/strict-mode.js
+++ b/test/mjsunit/strict-mode.js
@@ -169,13 +169,20 @@
CheckStrictMode("var x = { '1234' : 1, '2345' : 2, 1234 : 3 };", SyntaxError);
CheckStrictMode("var x = { 3.14 : 1, 2.71 : 2, 3.14 : 3 };", SyntaxError);
CheckStrictMode("var x = { 3.14 : 1, '3.14' : 2 };", SyntaxError);
-CheckStrictMode("var x = { 123: 1, 123.00000000000000000000000000000000000000000000000000000000000000000001 : 2 }", SyntaxError);
+CheckStrictMode("var x = { \
+ 123: 1, \
+ 123.00000000000000000000000000000000000000000000000000000000000000000001: 2 \
+}", SyntaxError);
// Non-conflicting data properties.
(function StrictModeNonDuplicate() {
"use strict";
var x = { 123 : 1, "0123" : 2 };
- var x = { 123: 1, '123.00000000000000000000000000000000000000000000000000000000000000000001' : 2 }
+ var x = {
+ 123: 1,
+ '123.00000000000000000000000000000000000000000000000000000000000000000001':
+ 2
+ };
})();
// Two getters (non-strict)
@@ -214,23 +221,32 @@
CheckStrictMode("function strict() { eval = undefined; }", SyntaxError);
CheckStrictMode("function strict() { arguments = undefined; }", SyntaxError);
CheckStrictMode("function strict() { print(eval = undefined); }", SyntaxError);
-CheckStrictMode("function strict() { print(arguments = undefined); }", SyntaxError);
+CheckStrictMode("function strict() { print(arguments = undefined); }",
+ SyntaxError);
CheckStrictMode("function strict() { var x = eval = undefined; }", SyntaxError);
-CheckStrictMode("function strict() { var x = arguments = undefined; }", SyntaxError);
+CheckStrictMode("function strict() { var x = arguments = undefined; }",
+ SyntaxError);
// Compound assignment to eval or arguments
CheckStrictMode("function strict() { eval *= undefined; }", SyntaxError);
CheckStrictMode("function strict() { arguments /= undefined; }", SyntaxError);
CheckStrictMode("function strict() { print(eval %= undefined); }", SyntaxError);
-CheckStrictMode("function strict() { print(arguments %= undefined); }", SyntaxError);
-CheckStrictMode("function strict() { var x = eval += undefined; }", SyntaxError);
-CheckStrictMode("function strict() { var x = arguments -= undefined; }", SyntaxError);
+CheckStrictMode("function strict() { print(arguments %= undefined); }",
+ SyntaxError);
+CheckStrictMode("function strict() { var x = eval += undefined; }",
+ SyntaxError);
+CheckStrictMode("function strict() { var x = arguments -= undefined; }",
+ SyntaxError);
CheckStrictMode("function strict() { eval <<= undefined; }", SyntaxError);
CheckStrictMode("function strict() { arguments >>= undefined; }", SyntaxError);
-CheckStrictMode("function strict() { print(eval >>>= undefined); }", SyntaxError);
-CheckStrictMode("function strict() { print(arguments &= undefined); }", SyntaxError);
-CheckStrictMode("function strict() { var x = eval ^= undefined; }", SyntaxError);
-CheckStrictMode("function strict() { var x = arguments |= undefined; }", SyntaxError);
+CheckStrictMode("function strict() { print(eval >>>= undefined); }",
+ SyntaxError);
+CheckStrictMode("function strict() { print(arguments &= undefined); }",
+ SyntaxError);
+CheckStrictMode("function strict() { var x = eval ^= undefined; }",
+ SyntaxError);
+CheckStrictMode("function strict() { var x = arguments |= undefined; }",
+ SyntaxError);
// Postfix increment with eval or arguments
CheckStrictMode("function strict() { eval++; }", SyntaxError);
@@ -264,6 +280,37 @@
CheckStrictMode("function strict() { var x = --eval; }", SyntaxError);
CheckStrictMode("function strict() { var x = --arguments; }", SyntaxError);
+// Use of const in strict mode is disallowed in anticipation of ES Harmony.
+CheckStrictMode("const x = 0;", SyntaxError);
+CheckStrictMode("for (const x = 0; false;) {}", SyntaxError);
+CheckStrictMode("function strict() { const x = 0; }", SyntaxError);
+
+// Strict mode only allows functions in SourceElements
+CheckStrictMode("if (true) { function invalid() {} }", SyntaxError);
+CheckStrictMode("for (;false;) { function invalid() {} }", SyntaxError);
+CheckStrictMode("{ function invalid() {} }", SyntaxError);
+CheckStrictMode("try { function invalid() {} } catch(e) {}", SyntaxError);
+CheckStrictMode("try { } catch(e) { function invalid() {} }", SyntaxError);
+CheckStrictMode("function outer() {{ function invalid() {} }}", SyntaxError);
+
+// Delete of an unqualified identifier
+CheckStrictMode("delete unqualified;", SyntaxError);
+CheckStrictMode("function strict() { delete unqualified; }", SyntaxError);
+CheckStrictMode("function function_name() { delete function_name; }",
+ SyntaxError);
+CheckStrictMode("function strict(parameter) { delete parameter; }",
+ SyntaxError);
+CheckStrictMode("function strict() { var variable; delete variable; }",
+ SyntaxError);
+CheckStrictMode("var variable; delete variable;", SyntaxError);
+
+(function TestStrictDelete() {
+ "use strict";
+ // "delete this" is allowed in strict mode and should work.
+ function strict_delete() { delete this; }
+ strict_delete();
+})();
+
// Prefix unary operators other than delete, ++, -- are valid in strict mode
(function StrictModeUnaryOperators() {
"use strict";
@@ -318,17 +365,22 @@
// Function names and arguments when the body is strict
assertThrows("function " + word + " () { 'use strict'; }", SyntaxError);
assertThrows("function foo (" + word + ") 'use strict'; {}", SyntaxError);
- assertThrows("function foo (" + word + ", " + word + ") { 'use strict'; }", SyntaxError);
+ assertThrows("function foo (" + word + ", " + word + ") { 'use strict'; }",
+ SyntaxError);
assertThrows("function foo (a, " + word + ") { 'use strict'; }", SyntaxError);
assertThrows("function foo (" + word + ", a) { 'use strict'; }", SyntaxError);
- assertThrows("function foo (a, " + word + ", b) { 'use strict'; }", SyntaxError);
- assertThrows("var foo = function (" + word + ") { 'use strict'; }", SyntaxError);
+ assertThrows("function foo (a, " + word + ", b) { 'use strict'; }",
+ SyntaxError);
+ assertThrows("var foo = function (" + word + ") { 'use strict'; }",
+ SyntaxError);
// get/set when the body is strict
eval("var x = { get " + word + " () { 'use strict'; } };");
eval("var x = { set " + word + " (value) { 'use strict'; } };");
- assertThrows("var x = { get foo(" + word + ") { 'use strict'; } };", SyntaxError);
- assertThrows("var x = { set foo(" + word + ") { 'use strict'; } };", SyntaxError);
+ assertThrows("var x = { get foo(" + word + ") { 'use strict'; } };",
+ SyntaxError);
+ assertThrows("var x = { set foo(" + word + ") { 'use strict'; } };",
+ SyntaxError);
}
for (var i = 0; i < future_reserved_words.length; i++) {
@@ -374,3 +426,534 @@
repeat(10, function() { testAssignToUndefined(true); });
possibly_undefined_variable_for_strict_mode_test = undefined;
repeat(10, function() { testAssignToUndefined(false); });
+
+(function testDeleteNonConfigurable() {
+ function delete_property(o) {
+ "use strict";
+ delete o.property;
+ }
+ function delete_element(o, i) {
+ "use strict";
+ delete o[i];
+ }
+
+ var object = {};
+
+ Object.defineProperty(object, "property", { value: "property_value" });
+ Object.defineProperty(object, "1", { value: "one" });
+ Object.defineProperty(object, 7, { value: "seven" });
+ Object.defineProperty(object, 3.14, { value: "pi" });
+
+ assertThrows(function() { delete_property(object); }, TypeError);
+ assertEquals(object.property, "property_value");
+ assertThrows(function() { delete_element(object, "1"); }, TypeError);
+ assertThrows(function() { delete_element(object, 1); }, TypeError);
+ assertEquals(object[1], "one");
+ assertThrows(function() { delete_element(object, "7"); }, TypeError);
+ assertThrows(function() { delete_element(object, 7); }, TypeError);
+ assertEquals(object[7], "seven");
+ assertThrows(function() { delete_element(object, "3.14"); }, TypeError);
+ assertThrows(function() { delete_element(object, 3.14); }, TypeError);
+ assertEquals(object[3.14], "pi");
+})();
+
+// Not transforming this in Function.call and Function.apply.
+(function testThisTransformCallApply() {
+ function non_strict() {
+ return this;
+ }
+ function strict() {
+ "use strict";
+ return this;
+ }
+
+ var global_object = (function() { return this; })();
+ var object = {};
+
+ // Non-strict call.
+ assertTrue(non_strict.call(null) === global_object);
+ assertTrue(non_strict.call(undefined) === global_object);
+ assertEquals(typeof non_strict.call(7), "object");
+ assertEquals(typeof non_strict.call("Hello"), "object");
+ assertTrue(non_strict.call(object) === object);
+
+ // Non-strict apply.
+ assertTrue(non_strict.apply(null) === global_object);
+ assertTrue(non_strict.apply(undefined) === global_object);
+ assertEquals(typeof non_strict.apply(7), "object");
+ assertEquals(typeof non_strict.apply("Hello"), "object");
+ assertTrue(non_strict.apply(object) === object);
+
+ // Strict call.
+ assertTrue(strict.call(null) === null);
+ assertTrue(strict.call(undefined) === undefined);
+ assertEquals(typeof strict.call(7), "number");
+ assertEquals(typeof strict.call("Hello"), "string");
+ assertTrue(strict.call(object) === object);
+
+ // Strict apply.
+ assertTrue(strict.apply(null) === null);
+ assertTrue(strict.apply(undefined) === undefined);
+ assertEquals(typeof strict.apply(7), "number");
+ assertEquals(typeof strict.apply("Hello"), "string");
+ assertTrue(strict.apply(object) === object);
+})();
+
+(function testThisTransform() {
+ try {
+ function strict() {
+ "use strict";
+ return typeof(this);
+ }
+ function nonstrict() {
+ return typeof(this);
+ }
+
+ // Concat to avoid symbol.
+ var strict_name = "str" + "ict";
+ var nonstrict_name = "non" + "str" + "ict";
+ var strict_number = 17;
+ var nonstrict_number = 19;
+ var strict_name_get = "str" + "ict" + "get";
+ var nonstrict_name_get = "non" + "str" + "ict" + "get"
+ var strict_number_get = 23;
+ var nonstrict_number_get = 29;
+
+ function install(t) {
+ t.prototype.strict = strict;
+ t.prototype.nonstrict = nonstrict;
+ t.prototype[strict_number] = strict;
+ t.prototype[nonstrict_number] = nonstrict;
+ Object.defineProperty(t.prototype, strict_name_get,
+ { get: function() { return strict; },
+ configurable: true });
+ Object.defineProperty(t.prototype, nonstrict_name_get,
+ { get: function() { return nonstrict; },
+ configurable: true });
+ Object.defineProperty(t.prototype, strict_number_get,
+ { get: function() { return strict; },
+ configurable: true });
+ Object.defineProperty(t.prototype, nonstrict_number_get,
+ { get: function() { return nonstrict; },
+ configurable: true });
+ }
+
+ function cleanup(t) {
+ delete t.prototype.strict;
+ delete t.prototype.nonstrict;
+ delete t.prototype[strict_number];
+ delete t.prototype[nonstrict_number];
+ delete t.prototype[strict_name_get];
+ delete t.prototype[nonstrict_name_get];
+ delete t.prototype[strict_number_get];
+ delete t.prototype[nonstrict_number_get];
+ }
+
+ // Set up fakes
+ install(String);
+ install(Number);
+ install(Boolean)
+
+ function callStrict(o) {
+ return o.strict();
+ }
+ function callNonStrict(o) {
+ return o.nonstrict();
+ }
+ function callKeyedStrict(o) {
+ return o[strict_name]();
+ }
+ function callKeyedNonStrict(o) {
+ return o[nonstrict_name]();
+ }
+ function callIndexedStrict(o) {
+ return o[strict_number]();
+ }
+ function callIndexedNonStrict(o) {
+ return o[nonstrict_number]();
+ }
+ function callStrictGet(o) {
+ return o.strictget();
+ }
+ function callNonStrictGet(o) {
+ return o.nonstrictget();
+ }
+ function callKeyedStrictGet(o) {
+ return o[strict_name_get]();
+ }
+ function callKeyedNonStrictGet(o) {
+ return o[nonstrict_name_get]();
+ }
+ function callIndexedStrictGet(o) {
+ return o[strict_number_get]();
+ }
+ function callIndexedNonStrictGet(o) {
+ return o[nonstrict_number_get]();
+ }
+
+ for (var i = 0; i < 10; i ++) {
+ assertEquals(("hello").strict(), "string");
+ assertEquals(("hello").nonstrict(), "object");
+ assertEquals(("hello")[strict_name](), "string");
+ assertEquals(("hello")[nonstrict_name](), "object");
+ assertEquals(("hello")[strict_number](), "string");
+ assertEquals(("hello")[nonstrict_number](), "object");
+
+ assertEquals((10 + i).strict(), "number");
+ assertEquals((10 + i).nonstrict(), "object");
+ assertEquals((10 + i)[strict_name](), "number");
+ assertEquals((10 + i)[nonstrict_name](), "object");
+ assertEquals((10 + i)[strict_number](), "number");
+ assertEquals((10 + i)[nonstrict_number](), "object");
+
+ assertEquals((true).strict(), "boolean");
+ assertEquals((true).nonstrict(), "object");
+ assertEquals((true)[strict_name](), "boolean");
+ assertEquals((true)[nonstrict_name](), "object");
+ assertEquals((true)[strict_number](), "boolean");
+ assertEquals((true)[nonstrict_number](), "object");
+
+ assertEquals((false).strict(), "boolean");
+ assertEquals((false).nonstrict(), "object");
+ assertEquals((false)[strict_name](), "boolean");
+ assertEquals((false)[nonstrict_name](), "object");
+ assertEquals((false)[strict_number](), "boolean");
+ assertEquals((false)[nonstrict_number](), "object");
+
+ assertEquals(callStrict("howdy"), "string");
+ assertEquals(callNonStrict("howdy"), "object");
+ assertEquals(callKeyedStrict("howdy"), "string");
+ assertEquals(callKeyedNonStrict("howdy"), "object");
+ assertEquals(callIndexedStrict("howdy"), "string");
+ assertEquals(callIndexedNonStrict("howdy"), "object");
+
+ assertEquals(callStrict(17 + i), "number");
+ assertEquals(callNonStrict(17 + i), "object");
+ assertEquals(callKeyedStrict(17 + i), "number");
+ assertEquals(callKeyedNonStrict(17 + i), "object");
+ assertEquals(callIndexedStrict(17 + i), "number");
+ assertEquals(callIndexedNonStrict(17 + i), "object");
+
+ assertEquals(callStrict(true), "boolean");
+ assertEquals(callNonStrict(true), "object");
+ assertEquals(callKeyedStrict(true), "boolean");
+ assertEquals(callKeyedNonStrict(true), "object");
+ assertEquals(callIndexedStrict(true), "boolean");
+ assertEquals(callIndexedNonStrict(true), "object");
+
+ assertEquals(callStrict(false), "boolean");
+ assertEquals(callNonStrict(false), "object");
+ assertEquals(callKeyedStrict(false), "boolean");
+ assertEquals(callKeyedNonStrict(false), "object");
+ assertEquals(callIndexedStrict(false), "boolean");
+ assertEquals(callIndexedNonStrict(false), "object");
+
+ // All of the above, with getters
+ assertEquals(("hello").strictget(), "string");
+ assertEquals(("hello").nonstrictget(), "object");
+ assertEquals(("hello")[strict_name_get](), "string");
+ assertEquals(("hello")[nonstrict_name_get](), "object");
+ assertEquals(("hello")[strict_number_get](), "string");
+ assertEquals(("hello")[nonstrict_number_get](), "object");
+
+ assertEquals((10 + i).strictget(), "number");
+ assertEquals((10 + i).nonstrictget(), "object");
+ assertEquals((10 + i)[strict_name_get](), "number");
+ assertEquals((10 + i)[nonstrict_name_get](), "object");
+ assertEquals((10 + i)[strict_number_get](), "number");
+ assertEquals((10 + i)[nonstrict_number_get](), "object");
+
+ assertEquals((true).strictget(), "boolean");
+ assertEquals((true).nonstrictget(), "object");
+ assertEquals((true)[strict_name_get](), "boolean");
+ assertEquals((true)[nonstrict_name_get](), "object");
+ assertEquals((true)[strict_number_get](), "boolean");
+ assertEquals((true)[nonstrict_number_get](), "object");
+
+ assertEquals((false).strictget(), "boolean");
+ assertEquals((false).nonstrictget(), "object");
+ assertEquals((false)[strict_name_get](), "boolean");
+ assertEquals((false)[nonstrict_name_get](), "object");
+ assertEquals((false)[strict_number_get](), "boolean");
+ assertEquals((false)[nonstrict_number_get](), "object");
+
+ assertEquals(callStrictGet("howdy"), "string");
+ assertEquals(callNonStrictGet("howdy"), "object");
+ assertEquals(callKeyedStrictGet("howdy"), "string");
+ assertEquals(callKeyedNonStrictGet("howdy"), "object");
+ assertEquals(callIndexedStrictGet("howdy"), "string");
+ assertEquals(callIndexedNonStrictGet("howdy"), "object");
+
+ assertEquals(callStrictGet(17 + i), "number");
+ assertEquals(callNonStrictGet(17 + i), "object");
+ assertEquals(callKeyedStrictGet(17 + i), "number");
+ assertEquals(callKeyedNonStrictGet(17 + i), "object");
+ assertEquals(callIndexedStrictGet(17 + i), "number");
+ assertEquals(callIndexedNonStrictGet(17 + i), "object");
+
+ assertEquals(callStrictGet(true), "boolean");
+ assertEquals(callNonStrictGet(true), "object");
+ assertEquals(callKeyedStrictGet(true), "boolean");
+ assertEquals(callKeyedNonStrictGet(true), "object");
+ assertEquals(callIndexedStrictGet(true), "boolean");
+ assertEquals(callIndexedNonStrictGet(true), "object");
+
+ assertEquals(callStrictGet(false), "boolean");
+ assertEquals(callNonStrictGet(false), "object");
+ assertEquals(callKeyedStrictGet(false), "boolean");
+ assertEquals(callKeyedNonStrictGet(false), "object");
+ assertEquals(callIndexedStrictGet(false), "boolean");
+ assertEquals(callIndexedNonStrictGet(false), "object");
+
+ }
+ } finally {
+ // Cleanup
+ cleanup(String);
+ cleanup(Number);
+ cleanup(Boolean);
+ }
+})();
+
+
+(function ObjectEnvironment() {
+ var o = {};
+ Object.defineProperty(o, "foo", { value: "FOO", writable: false });
+ assertThrows(
+ function () {
+ with (o) {
+ (function() {
+ "use strict";
+ foo = "Hello";
+ })();
+ }
+ },
+ TypeError);
+})();
+
+
+(function TestSetPropertyWithoutSetter() {
+ var o = { get foo() { return "Yey"; } };
+ assertThrows(
+ function broken() {
+ "use strict";
+ o.foo = (0xBADBAD00 >> 1);
+ },
+ TypeError);
+})();
+
+
+(function TestSetPropertyNonConfigurable() {
+ var frozen = Object.freeze({});
+ var sealed = Object.seal({});
+
+ function strict(o) {
+ "use strict";
+ o.property = "value";
+ }
+
+ assertThrows(function() { strict(frozen); }, TypeError);
+ assertThrows(function() { strict(sealed); }, TypeError);
+})();
+
+
+(function TestAssignmentToReadOnlyProperty() {
+ "use strict";
+
+ var o = {};
+ Object.defineProperty(o, "property", { value: 7 });
+
+ assertThrows(function() { o.property = "new value"; }, TypeError);
+ assertThrows(function() { o.property += 10; }, TypeError);
+ assertThrows(function() { o.property -= 10; }, TypeError);
+ assertThrows(function() { o.property *= 10; }, TypeError);
+ assertThrows(function() { o.property /= 10; }, TypeError);
+ assertThrows(function() { o.property++; }, TypeError);
+ assertThrows(function() { o.property--; }, TypeError);
+ assertThrows(function() { ++o.property; }, TypeError);
+ assertThrows(function() { --o.property; }, TypeError);
+
+ var name = "prop" + "erty"; // to avoid symbol path.
+ assertThrows(function() { o[name] = "new value"; }, TypeError);
+ assertThrows(function() { o[name] += 10; }, TypeError);
+ assertThrows(function() { o[name] -= 10; }, TypeError);
+ assertThrows(function() { o[name] *= 10; }, TypeError);
+ assertThrows(function() { o[name] /= 10; }, TypeError);
+ assertThrows(function() { o[name]++; }, TypeError);
+ assertThrows(function() { o[name]--; }, TypeError);
+ assertThrows(function() { ++o[name]; }, TypeError);
+ assertThrows(function() { --o[name]; }, TypeError);
+
+ assertEquals(o.property, 7);
+})();
+
+
+(function TestAssignmentToReadOnlyLoop() {
+ var name = "prop" + "erty"; // to avoid symbol path.
+ var o = {};
+ Object.defineProperty(o, "property", { value: 7 });
+
+ function strict(o, name) {
+ "use strict";
+ o[name] = "new value";
+ }
+
+ for (var i = 0; i < 10; i ++) {
+ try {
+ strict(o, name);
+ assertUnreachable();
+ } catch(e) {
+ assertInstanceof(e, TypeError);
+ }
+ }
+})();
+
+
+// Specialized KeyedStoreIC experiencing miss.
+(function testKeyedStoreICStrict() {
+ var o = [9,8,7,6,5,4,3,2,1];
+
+ function test(o, i, v) {
+ "use strict";
+ o[i] = v;
+ }
+
+ for (var i = 0; i < 10; i ++) {
+ test(o, 5, 17); // start specialized for smi indices
+ assertEquals(o[5], 17);
+ test(o, "a", 19);
+ assertEquals(o["a"], 19);
+ test(o, "5", 29);
+ assertEquals(o[5], 29);
+ test(o, 100000, 31);
+ assertEquals(o[100000], 31);
+ }
+})();
+
+
+(function TestSetElementWithoutSetter() {
+ "use strict";
+
+ var o = { };
+ Object.defineProperty(o, 0, { get : function() { } });
+
+ var zero_smi = 0;
+ var zero_number = new Number(0);
+ var zero_symbol = "0";
+ var zero_string = "-0-".substring(1,2);
+
+ assertThrows(function() { o[zero_smi] = "new value"; }, TypeError);
+ assertThrows(function() { o[zero_number] = "new value"; }, TypeError);
+ assertThrows(function() { o[zero_symbol] = "new value"; }, TypeError);
+ assertThrows(function() { o[zero_string] = "new value"; }, TypeError);
+})();
+
+
+(function TestSetElementNonConfigurable() {
+ "use strict";
+ var frozen = Object.freeze({});
+ var sealed = Object.seal({});
+
+ var zero_number = 0;
+ var zero_symbol = "0";
+ var zero_string = "-0-".substring(1,2);
+
+ assertThrows(function() { frozen[zero_number] = "value"; }, TypeError);
+ assertThrows(function() { sealed[zero_number] = "value"; }, TypeError);
+ assertThrows(function() { frozen[zero_symbol] = "value"; }, TypeError);
+ assertThrows(function() { sealed[zero_symbol] = "value"; }, TypeError);
+ assertThrows(function() { frozen[zero_string] = "value"; }, TypeError);
+ assertThrows(function() { sealed[zero_string] = "value"; }, TypeError);
+})();
+
+
+(function TestAssignmentToReadOnlyElement() {
+ "use strict";
+
+ var o = {};
+ Object.defineProperty(o, 7, { value: 17 });
+
+ var seven_smi = 7;
+ var seven_number = new Number(7);
+ var seven_symbol = "7";
+ var seven_string = "-7-".substring(1,2);
+
+ // Index with number.
+ assertThrows(function() { o[seven_smi] = "value"; }, TypeError);
+ assertThrows(function() { o[seven_smi] += 10; }, TypeError);
+ assertThrows(function() { o[seven_smi] -= 10; }, TypeError);
+ assertThrows(function() { o[seven_smi] *= 10; }, TypeError);
+ assertThrows(function() { o[seven_smi] /= 10; }, TypeError);
+ assertThrows(function() { o[seven_smi]++; }, TypeError);
+ assertThrows(function() { o[seven_smi]--; }, TypeError);
+ assertThrows(function() { ++o[seven_smi]; }, TypeError);
+ assertThrows(function() { --o[seven_smi]; }, TypeError);
+
+ assertThrows(function() { o[seven_number] = "value"; }, TypeError);
+ assertThrows(function() { o[seven_number] += 10; }, TypeError);
+ assertThrows(function() { o[seven_number] -= 10; }, TypeError);
+ assertThrows(function() { o[seven_number] *= 10; }, TypeError);
+ assertThrows(function() { o[seven_number] /= 10; }, TypeError);
+ assertThrows(function() { o[seven_number]++; }, TypeError);
+ assertThrows(function() { o[seven_number]--; }, TypeError);
+ assertThrows(function() { ++o[seven_number]; }, TypeError);
+ assertThrows(function() { --o[seven_number]; }, TypeError);
+
+ assertThrows(function() { o[seven_symbol] = "value"; }, TypeError);
+ assertThrows(function() { o[seven_symbol] += 10; }, TypeError);
+ assertThrows(function() { o[seven_symbol] -= 10; }, TypeError);
+ assertThrows(function() { o[seven_symbol] *= 10; }, TypeError);
+ assertThrows(function() { o[seven_symbol] /= 10; }, TypeError);
+ assertThrows(function() { o[seven_symbol]++; }, TypeError);
+ assertThrows(function() { o[seven_symbol]--; }, TypeError);
+ assertThrows(function() { ++o[seven_symbol]; }, TypeError);
+ assertThrows(function() { --o[seven_symbol]; }, TypeError);
+
+ assertThrows(function() { o[seven_string] = "value"; }, TypeError);
+ assertThrows(function() { o[seven_string] += 10; }, TypeError);
+ assertThrows(function() { o[seven_string] -= 10; }, TypeError);
+ assertThrows(function() { o[seven_string] *= 10; }, TypeError);
+ assertThrows(function() { o[seven_string] /= 10; }, TypeError);
+ assertThrows(function() { o[seven_string]++; }, TypeError);
+ assertThrows(function() { o[seven_string]--; }, TypeError);
+ assertThrows(function() { ++o[seven_string]; }, TypeError);
+ assertThrows(function() { --o[seven_string]; }, TypeError);
+
+ assertEquals(o[seven_number], 17);
+ assertEquals(o[seven_symbol], 17);
+ assertEquals(o[seven_string], 17);
+})();
+
+
+(function TestAssignmentToReadOnlyLoop() {
+ "use strict";
+
+ var o = {};
+ Object.defineProperty(o, 7, { value: 17 });
+
+ var seven_smi = 7;
+ var seven_number = new Number(7);
+ var seven_symbol = "7";
+ var seven_string = "-7-".substring(1,2);
+
+ for (var i = 0; i < 10; i ++) {
+ assertThrows(function() { o[seven_smi] = "value" }, TypeError);
+ assertThrows(function() { o[seven_number] = "value" }, TypeError);
+ assertThrows(function() { o[seven_symbol] = "value" }, TypeError);
+ assertThrows(function() { o[seven_string] = "value" }, TypeError);
+ }
+
+ assertEquals(o[7], 17);
+})();
+
+
+(function TestAssignmentToStringLength() {
+ "use strict";
+
+ var str_val = "string";
+ var str_obj = new String(str_val);
+ var str_cat = str_val + str_val + str_obj;
+
+ assertThrows(function() { str_val.length = 1; }, TypeError);
+ assertThrows(function() { str_obj.length = 1; }, TypeError);
+ assertThrows(function() { str_cat.length = 1; }, TypeError);
+})();
diff --git a/test/mjsunit/tools/tickprocessor-test-func-info.log b/test/mjsunit/tools/tickprocessor-test-func-info.log
index 29a12f6..755fbb2 100644
--- a/test/mjsunit/tools/tickprocessor-test-func-info.log
+++ b/test/mjsunit/tools/tickprocessor-test-func-info.log
@@ -3,11 +3,9 @@
shared-library,"ffffe000-fffff000",0xffffe000,0xfffff000
profiler,"begin",1
code-creation,Stub,0x424260,348,"CompareStub_GE"
-code-creation,LazyCompile,0x2a8100,18535,"DrawQube 3d-cube.js:188"
-function-creation,0x2d11b8,0x2a8100
-code-creation,LazyCompile,0x480100,3908,"DrawLine 3d-cube.js:17"
-function-creation,0x2d0f7c,0x480100
-tick,0x424284,0xbfffeea0,0x2d0f7c,0,0x2aaaa5
-tick,0x42429f,0xbfffed88,0x2d0f7c,0,0x2aacb4
+code-creation,LazyCompile,0x2a8100,18535,"DrawQube 3d-cube.js:188",0xf43abcac,
+code-creation,LazyCompile,0x480100,3908,"DrawLine 3d-cube.js:17",0xf43abc50,
+tick,0x424284,0xbfffeea0,0x480600,0,0x2aaaa5
+tick,0x42429f,0xbfffed88,0x480600,0,0x2aacb4
tick,0x48063d,0xbfffec7c,0x2d0f7c,0,0x2aaec6
profiler,"end"