diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress')
29 files changed, 415 insertions, 79 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-356053.js b/deps/v8/test/mjsunit/regress/regress-356053.js index 8f0dbdd093..2695c48fd1 100644 --- a/deps/v8/test/mjsunit/regress/regress-356053.js +++ b/deps/v8/test/mjsunit/regress/regress-356053.js @@ -3,7 +3,7 @@ // found in the LICENSE file. // Flags: --noconcurrent-recompilation --expose-gc --allow-natives-syntax +// Flags: --concurrent-recompilation --block-concurrent-recompilation -%SetFlags("--concurrent-recompilation --block-concurrent-recompilation"); gc(); try { %UnblockConcurrentRecompilation(); } catch (e) { } diff --git a/deps/v8/test/mjsunit/regress/regress-357103.js b/deps/v8/test/mjsunit/regress/regress-357103.js index 692729ddb3..c56c8893b3 100644 --- a/deps/v8/test/mjsunit/regress/regress-357103.js +++ b/deps/v8/test/mjsunit/regress/regress-357103.js @@ -4,7 +4,7 @@ // Flags: --allow-natives-syntax -%SetFlags("--gc-interval=1"); +%SetAllocationTimeout(1, 1); var key = "Huckleberry Finn" + "Tom Sawyer"; var o = {}; diff --git a/deps/v8/test/mjsunit/regress/regress-430201.js b/deps/v8/test/mjsunit/regress/regress-430201.js index dfd1346a01..9443d1ddc4 100644 --- a/deps/v8/test/mjsunit/regress/regress-430201.js +++ b/deps/v8/test/mjsunit/regress/regress-430201.js @@ -26,10 +26,10 @@ // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // Flags: --allow-natives-syntax --expose-gc --nostress-incremental-marking +// Flags: --stress-compaction var array_1 = []; -%SetFlags("--stress-compaction"); for (var a = 0; a < 10000; a++) { array_1[a * 100] = 0; } gc(); diff --git a/deps/v8/test/mjsunit/regress/regress-430201b.js b/deps/v8/test/mjsunit/regress/regress-430201b.js index 056504d1d7..7e890b7930 100644 --- a/deps/v8/test/mjsunit/regress/regress-430201b.js +++ b/deps/v8/test/mjsunit/regress/regress-430201b.js @@ -25,12 +25,11 @@ // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -// Flags: --allow-natives-syntax --expose-gc +// Flags: --allow-natives-syntax --expose-gc --stress-compaction (function() { var array_1 = []; - %SetFlags("--stress-compaction"); for (var a = 0; a < 10000; a++) { array_1[a * 100] = 0; } gc(); diff --git a/deps/v8/test/mjsunit/regress/regress-4325.js b/deps/v8/test/mjsunit/regress/regress-4325.js index e88bdd3b08..27d690d579 100644 --- a/deps/v8/test/mjsunit/regress/regress-4325.js +++ b/deps/v8/test/mjsunit/regress/regress-4325.js @@ -23,7 +23,7 @@ i1.p1 = 0.5; // Let Inner.map1 die by migrating i2 to Inner.map2: print(i2.p1); gc(); -// o1.map's descriptor for "inner" is now a cleared WeakCell; +// o1.map's descriptor for "inner" is now a cleared weak reference; // o1.inner's actual map is Inner.map2. // Prepare Inner.map3, deprecating Inner.map2. i2.p2 = 0.5; diff --git a/deps/v8/test/mjsunit/regress/regress-5085.js b/deps/v8/test/mjsunit/regress/regress-5085.js index 0ed034dc2d..167bfa0f44 100644 --- a/deps/v8/test/mjsunit/regress/regress-5085.js +++ b/deps/v8/test/mjsunit/regress/regress-5085.js @@ -4,11 +4,71 @@ // Flags: --allow-natives-syntax +g = async function () { + await 10; +} +assertEquals(undefined, g.prototype) +g(); +assertEquals(undefined, g.prototype) + +gen = function* () { + yield 10; +} +assertTrue(gen.prototype != undefined && gen.prototype != null) +gen() +assertTrue(gen.prototype != undefined && gen.prototype != null) + +async_gen = async function* () { + yield 10; +} +assertTrue(async_gen.prototype != undefined && async_gen.prototype != null) +async_gen() +assertTrue(async_gen.prototype != undefined && async_gen.prototype != null) + function foo(x) { return x instanceof Proxy; } -assertFalse(foo({})); -assertFalse(foo({})); +function test_for_exception() { + caught_exception = false; + try { + foo({}); + } catch (e) { + caught_exception = true; + assertEquals( + 'Function has non-object prototype \'undefined\' in instanceof check', + e.message); + } finally { + assertTrue(caught_exception) + } +} + +test_for_exception(); +test_for_exception(); %OptimizeFunctionOnNextCall(foo); -assertFalse(foo({})); +test_for_exception(); + +Proxy.__proto__.prototype = Function.prototype; +assertTrue((() => {}) instanceof Proxy); + +assertEquals( + new Proxy({}, { + get(o, s) { + return s + } + }).test, + 'test'); + +Proxy.__proto__ = { + prototype: {b: 2}, + a: 1 +}; +assertEquals(Proxy.prototype, {b: 2}); + +(function testProxyCreationContext() { + let realm = Realm.create(); + let p1 = new Proxy({}, {}); + let p2 = Realm.eval(realm, "new Proxy({}, {})"); + assertEquals(0, Realm.owner(p1)); + assertEquals(1, Realm.owner(p2)); +})(); diff --git a/deps/v8/test/mjsunit/regress/regress-599414-array-concat-fast-path.js b/deps/v8/test/mjsunit/regress/regress-599414-array-concat-fast-path.js index 3819233f99..9febb6545d 100644 --- a/deps/v8/test/mjsunit/regress/regress-599414-array-concat-fast-path.js +++ b/deps/v8/test/mjsunit/regress/regress-599414-array-concat-fast-path.js @@ -7,5 +7,5 @@ var a = largeArray; assertThrows(() => { for (;;) { - a = a.concat(a, a, a, a, a, a); + a = a.concat(a, a, a, a, a); }}, RangeError); diff --git a/deps/v8/test/mjsunit/regress/regress-6700.js b/deps/v8/test/mjsunit/regress/regress-6700.js index 342cac485e..c20cefd02c 100644 --- a/deps/v8/test/mjsunit/regress/regress-6700.js +++ b/deps/v8/test/mjsunit/regress/regress-6700.js @@ -4,6 +4,8 @@ // Flags: --allow-natives-syntax +let kMinHeapSize = 4096; + (function TestLeftRight() { function Module(stdlib, foreign, heap) { "use asm"; @@ -14,7 +16,7 @@ } return { f:f } } - var buffer = new ArrayBuffer(1024); + var buffer = new ArrayBuffer(kMinHeapSize); var module = new Module(this, {}, buffer); assertTrue(%IsAsmWasmCode(Module)); new Int32Array(buffer)[42] = 23; @@ -31,7 +33,7 @@ } return { f:f } } - var buffer = new ArrayBuffer(1024); + var buffer = new ArrayBuffer(kMinHeapSize); var module = new Module(this, {}, buffer) assertTrue(%IsAsmWasmCode(Module)); new Int32Array(buffer)[42 >> 4] = 23; @@ -48,7 +50,7 @@ } return { f:f } } - var buffer = new ArrayBuffer(1024); + var buffer = new ArrayBuffer(kMinHeapSize); var module = new Module(this, {}, buffer) assertFalse(%IsAsmWasmCode(Module)); new Int32Array(buffer)[42 & 0xfc] = 23; @@ -65,7 +67,7 @@ } return { f:f } } - var buffer = new ArrayBuffer(1024); + var buffer = new ArrayBuffer(kMinHeapSize); var module = new Module(this, {}, buffer) assertFalse(%IsAsmWasmCode(Module)); new Int32Array(buffer)[42 >> 3] = 23; @@ -82,7 +84,7 @@ } return { f:f } } - var buffer = new ArrayBuffer(1024); + var buffer = new ArrayBuffer(kMinHeapSize); var module = new Module(this, {}, buffer) assertFalse(%IsAsmWasmCode(Module)); new Int32Array(buffer)[42 << 2] = 23; diff --git a/deps/v8/test/mjsunit/regress/regress-685.js b/deps/v8/test/mjsunit/regress/regress-685.js deleted file mode 100644 index d77d61b8fb..0000000000 --- a/deps/v8/test/mjsunit/regress/regress-685.js +++ /dev/null @@ -1,43 +0,0 @@ -// Copyright 2010 the V8 project authors. All rights reserved. -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are -// met: -// -// * Redistributions of source code must retain the above copyright -// notice, this list of conditions and the following disclaimer. -// * Redistributions in binary form must reproduce the above -// copyright notice, this list of conditions and the following -// disclaimer in the documentation and/or other materials provided -// with the distribution. -// * Neither the name of Google Inc. nor the names of its -// contributors may be used to endorse or promote products derived -// from this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -// Regression test for http://code.google.com/p/v8/issues/detail?id=685. -// -// Test that keyed load IC generic stub uses unsigned comparison for -// for the length field of arrays. -// -// The test passes if it does not crash. - -function test() { - var N = 0xFFFFFFFF; - var a = []; - a[N - 1] = 0; - a[N - 2] = 1; - a.reverse(); -} - -test(); diff --git a/deps/v8/test/mjsunit/regress/regress-7716.js b/deps/v8/test/mjsunit/regress/regress-7716.js index ac891ceec5..8ce83678d9 100644 --- a/deps/v8/test/mjsunit/regress/regress-7716.js +++ b/deps/v8/test/mjsunit/regress/regress-7716.js @@ -10,22 +10,22 @@ for (let i = 0; i < 100000; i++) { proxy = new Proxy(proxy, {}); } -// We get a stack overflow in all cases except for Reflect.apply, which here -// happens to run in constant space: Call jumps into CallProxy and CallProxy -// jumps into the next Call. -assertDoesNotThrow(() => Reflect.apply(proxy, {}, [])); -assertThrows(() => Reflect.construct(proxy, []), RangeError); -assertThrows(() => Reflect.defineProperty(proxy, "x", {}), RangeError); -assertThrows(() => Reflect.deleteProperty(proxy, "x"), RangeError); -assertThrows(() => Reflect.get(proxy, "x"), RangeError); -assertThrows(() => Reflect.getOwnPropertyDescriptor(proxy, "x"), RangeError); -assertThrows(() => Reflect.getPrototypeOf(proxy), RangeError); -assertThrows(() => Reflect.has(proxy, "x"), RangeError); -assertThrows(() => Reflect.isExtensible(proxy), RangeError); -assertThrows(() => Reflect.ownKeys(proxy), RangeError); -assertThrows(() => Reflect.preventExtensions(proxy), RangeError); -assertThrows(() => Reflect.setPrototypeOf(proxy, {}), RangeError); -assertThrows(() => Reflect.set(proxy, "x", {}), RangeError); +// Ensure these nested calls don't segfault. They may not all throw exceptions +// depending on whether the compiler is able to perform tail call optimization +// on the affected routines. +try { Reflect.apply(proxy, {}, []) } catch(_) {} +try { Reflect.construct(proxy, []) } catch(_) {} +try { Reflect.defineProperty(proxy, "x", {}) } catch(_) {} +try { Reflect.deleteProperty(proxy, "x") } catch(_) {} +try { Reflect.get(proxy, "x") } catch(_) {} +try { Reflect.getOwnPropertyDescriptor(proxy, "x") } catch(_) {} +try { Reflect.getPrototypeOf(proxy) } catch(_) {} +try { Reflect.has(proxy, "x") } catch(_) {} +try { Reflect.isExtensible(proxy) } catch(_) {} +try { Reflect.ownKeys(proxy) } catch(_) {} +try { Reflect.preventExtensions(proxy) } catch(_) {} +try { Reflect.setPrototypeOf(proxy, {}) } catch(_) {} +try { Reflect.set(proxy, "x", {}) } catch(_) {} // Recursive handler. diff --git a/deps/v8/test/mjsunit/regress/regress-797581.js b/deps/v8/test/mjsunit/regress/regress-797581.js index 17ac0ea50d..eb87e67128 100644 --- a/deps/v8/test/mjsunit/regress/regress-797581.js +++ b/deps/v8/test/mjsunit/regress/regress-797581.js @@ -3,6 +3,11 @@ // found in the LICENSE file. // Flags: --allow-natives-syntax --harmony-dynamic-import +// Resources: test/mjsunit/regress/modules-skip-regress-797581-1.js +// Resources: test/mjsunit/regress/modules-skip-regress-797581-2.js +// Resources: test/mjsunit/regress/modules-skip-regress-797581-3.js +// Resources: test/mjsunit/regress/modules-skip-regress-797581-4.js +// Resources: test/mjsunit/regress/modules-skip-regress-797581-5.js function TryToLoadModule(filename, expect_error, token) { let caught_error; diff --git a/deps/v8/test/mjsunit/regress/regress-8033.js b/deps/v8/test/mjsunit/regress/regress-8033.js new file mode 100644 index 0000000000..437ca2a0a6 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-8033.js @@ -0,0 +1,45 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +assertThrows("foo: if (true) do { continue foo } while (false)", SyntaxError); +assertThrows("foo: if (true) while (false) { continue foo }", SyntaxError); +assertThrows("foo: if (true) for (; false; ) { continue foo }", SyntaxError); +assertThrows("foo: if (true) for (let x of []) { continue foo }", SyntaxError); +assertThrows("foo: if (true) for (let x in []) { continue foo }", SyntaxError); + +assertThrows("foo: if (true) { do { continue foo } while (false) }", SyntaxError); +assertThrows("foo: if (true) { while (false) { continue foo } }", SyntaxError); +assertThrows("foo: if (true) { for (; false; ) { continue foo } }", SyntaxError); +assertThrows("foo: if (true) { for (let x of []) { continue foo } }", SyntaxError); +assertThrows("foo: if (true) { for (let x in []) { continue foo } }", SyntaxError); + +assertThrows("foo: goo: if (true) do { continue foo } while (false)", SyntaxError); +assertThrows("foo: goo: if (true) while (false) { continue foo }", SyntaxError); +assertThrows("foo: goo: if (true) for (; false; ) { continue foo }", SyntaxError); +assertThrows("foo: goo: if (true) for (let x of []) { continue foo }", SyntaxError); +assertThrows("foo: goo: if (true) for (let x in []) { continue foo }", SyntaxError); + +assertThrows("foo: goo: if (true) { do { continue foo } while (false) }", SyntaxError); +assertThrows("foo: goo: if (true) { while (false) { continue foo } }", SyntaxError); +assertThrows("foo: goo: if (true) { for (; false; ) { continue foo } }", SyntaxError); +assertThrows("foo: goo: if (true) { for (let x of []) { continue foo } }", SyntaxError); +assertThrows("foo: goo: if (true) { for (let x in []) { continue foo } }", SyntaxError); + +assertDoesNotThrow("if (true) foo: goo: do { continue foo } while (false)"); +assertDoesNotThrow("if (true) foo: goo: while (false) { continue foo }"); +assertDoesNotThrow("if (true) foo: goo: for (; false; ) { continue foo }"); +assertDoesNotThrow("if (true) foo: goo: for (let x of []) { continue foo }"); +assertDoesNotThrow("if (true) foo: goo: for (let x in []) { continue foo }"); + +assertThrows("if (true) foo: goo: { do { continue foo } while (false) }", SyntaxError); +assertThrows("if (true) foo: goo: { while (false) { continue foo } }", SyntaxError); +assertThrows("if (true) foo: goo: { for (; false; ) { continue foo } }", SyntaxError); +assertThrows("if (true) foo: goo: { for (let x of []) { continue foo } }", SyntaxError); +assertThrows("if (true) foo: goo: { for (let x in []) { continue foo } }", SyntaxError); + +assertDoesNotThrow("if (true) { foo: goo: do { continue foo } while (false) }"); +assertDoesNotThrow("if (true) { foo: goo: while (false) { continue foo } }"); +assertDoesNotThrow("if (true) { foo: goo: for (; false; ) { continue foo } }"); +assertDoesNotThrow("if (true) { foo: goo: for (let x of []) { continue foo } }"); +assertDoesNotThrow("if (true) { foo: goo: for (let x in []) { continue foo } }"); diff --git a/deps/v8/test/mjsunit/regress/regress-865310.js b/deps/v8/test/mjsunit/regress/regress-865310.js new file mode 100644 index 0000000000..57f976991a --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-865310.js @@ -0,0 +1,20 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +check = function() { + assertEquals(null, check.caller); +} + +var obj = {}; +obj.valueOf = check; + +function f() { + Number(obj); +} + +f(); +%OptimizeFunctionOnNextCall(f); +f(); diff --git a/deps/v8/test/mjsunit/regress/regress-869735.js b/deps/v8/test/mjsunit/regress/regress-869735.js new file mode 100644 index 0000000000..dfa7b8385b --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-869735.js @@ -0,0 +1,14 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function f() { + return arguments.length; +} + +var a = []; +%OptimizeFunctionOnNextCall(f); +a.length = 81832; +f(...a); diff --git a/deps/v8/test/mjsunit/regress/regress-875493.js b/deps/v8/test/mjsunit/regress/regress-875493.js new file mode 100644 index 0000000000..81fbac4319 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-875493.js @@ -0,0 +1,20 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function test() { + const re = /./y; + re.lastIndex = 3; + const str = 'fg'; + return re[Symbol.replace](str, '$'); +} + +%SetForceSlowPath(false); +const fast = test(); +%SetForceSlowPath(true); +const slow = test(); +%SetForceSlowPath(false); + +assertEquals(slow, fast); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-380671.js b/deps/v8/test/mjsunit/regress/regress-crbug-380671.js index 3b03064eb9..e2909e0a43 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-380671.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-380671.js @@ -10,4 +10,5 @@ assertEquals(0xc0000000, buffer.byteLength); // mock allocator would allow us to allocate more than the physical memory // available on 32bit platforms, leaving the internal counters in an invalid // state. +buffer = null; gc(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-759327.js b/deps/v8/test/mjsunit/regress/regress-crbug-759327.js index 9b422176b8..4aed8a456a 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-759327.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-759327.js @@ -13,7 +13,7 @@ function Module(stdlib, env, heap) { return { f: f }; } function instantiate() { - var buffer = new ArrayBuffer(0); + var buffer = new ArrayBuffer(4096); Module(this, {}, buffer).f(); try {} finally {} gc(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-807096.js b/deps/v8/test/mjsunit/regress/regress-crbug-807096.js index 845120db6a..c503fdad97 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-807096.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-807096.js @@ -4,6 +4,8 @@ // // Flags: --allow-natives-syntax --no-lazy +load('test/mjsunit/test-async.js'); + // For regression testing, it's important that these functions are: // 1) toplevel // 2) arrow functions with single-expression bodies diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-830565.js b/deps/v8/test/mjsunit/regress/regress-crbug-830565.js index ee2c3bdaca..00f49bb9ff 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-830565.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-830565.js @@ -4,6 +4,8 @@ // Flags: --allow-natives-syntax +load('test/mjsunit/test-async.js'); + testAsync(assert => { assert.plan(1); const error = new TypeError('Throwing'); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-865312.js b/deps/v8/test/mjsunit/regress/regress-crbug-865312.js new file mode 100644 index 0000000000..8df1bd92d2 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-865312.js @@ -0,0 +1,34 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +const intArrayConstructors = [ + Uint8Array, + Int8Array, + Uint16Array, + Int16Array, + Uint32Array, + Int32Array, + Uint8ClampedArray +]; + +const floatArrayConstructors = [ + Float32Array, + Float64Array +]; + +const typedArrayConstructors = [...intArrayConstructors, + ...floatArrayConstructors]; + +for (let constructor of typedArrayConstructors) { + // Shadowing the length of a TypedArray should work for Array.p.fill, + // but not crash it. + let array = new constructor([2, 2]); + assertEquals(2, array.length); + + Object.defineProperty(array, 'length', {value: 5}); + Array.prototype.fill.call(array, 5); + + assertArrayEquals([5, 5], [array[0], array[1]]); + assertEquals(undefined, array[2]); +} diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-865892.js b/deps/v8/test/mjsunit/regress/regress-crbug-865892.js new file mode 100644 index 0000000000..f2d2f6ff71 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-865892.js @@ -0,0 +1,20 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --expose-async-hooks + +let ah = async_hooks.createHook( +{ + init(asyncId, type) { + if (type !== 'PROMISE') { return; } + assertThrows('asyncIds.push(asyncId);'); + } +}); +ah.enable(); + +async function foo() { + let x = { toString() { return 'modules-skip-1.js' } }; + assertThrows('await import(x);'); +} +foo(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-866315.js b/deps/v8/test/mjsunit/regress/regress-crbug-866315.js new file mode 100644 index 0000000000..4eb032d78e --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-866315.js @@ -0,0 +1,12 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --expose-async-hooks + +let num = 42; +let ah = async_hooks.createHook({}); + +num.__proto__.__proto__ = ah; +assertThrows('num.enable()'); +assertThrows('num.disable()'); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-871886.js b/deps/v8/test/mjsunit/regress/regress-crbug-871886.js new file mode 100644 index 0000000000..011443145b --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-871886.js @@ -0,0 +1,11 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +let arr = [1.5, 2.5]; +arr.slice(0, + { valueOf: function () { + arr.length = 0; + return 2; + } + }); diff --git a/deps/v8/test/mjsunit/regress/regress-set-flags-stress-compact.js b/deps/v8/test/mjsunit/regress/regress-set-flags-stress-compact.js index 5bc59a7e11..f86148659f 100644 --- a/deps/v8/test/mjsunit/regress/regress-set-flags-stress-compact.js +++ b/deps/v8/test/mjsunit/regress/regress-set-flags-stress-compact.js @@ -2,9 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax - -%SetFlags("--gc-interval=164 --stress-compaction"); +// Flags: --allow-natives-syntax --gc-interval=164 --stress-compaction var a = []; for (var i = 0; i < 10000; i++) { a[i * 100] = 0; } diff --git a/deps/v8/test/mjsunit/regress/regress-v8-8070.js b/deps/v8/test/mjsunit/regress/regress-v8-8070.js new file mode 100644 index 0000000000..a75230da1f --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-v8-8070.js @@ -0,0 +1,23 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function bar(iterator) { + for (const entry of iterator) {} +} + +%NeverOptimizeFunction(bar); + +function foo(a) { + const iterator = a.values(); + bar(iterator); + return iterator.next().done; +} + +const a = [1, 2, 3]; +assertTrue(foo(a)); +assertTrue(foo(a)); +%OptimizeFunctionOnNextCall(foo); +assertTrue(foo(a)); diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-776677.js b/deps/v8/test/mjsunit/regress/wasm/regress-776677.js index 1b2357dcf2..87bf8fac7e 100644 --- a/deps/v8/test/mjsunit/regress/wasm/regress-776677.js +++ b/deps/v8/test/mjsunit/regress/wasm/regress-776677.js @@ -16,7 +16,7 @@ function module(stdlib,foreign,buffer) { var global = {Uint32Array:Uint32Array}; var env = {}; -memory = new WebAssembly.Memory({initial:200}); +memory = new WebAssembly.Memory({initial:128}); var buffer = memory.buffer; evil_f = module(global,env,buffer); diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-8059.js b/deps/v8/test/mjsunit/regress/wasm/regress-8059.js new file mode 100644 index 0000000000..5c421c4ee4 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/wasm/regress-8059.js @@ -0,0 +1,42 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --no-wasm-disable-structured-cloning + +load("test/mjsunit/wasm/wasm-constants.js"); +load("test/mjsunit/wasm/wasm-module-builder.js"); + +(function TestPostModule() { + let builder = new WasmModuleBuilder(); + builder.addFunction("add", kSig_i_ii) + .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Add]) + .exportFunc(); + + let module = builder.toModule(); + + let workerScript = ` + onmessage = function(module) { + try { + let instance = new WebAssembly.Instance(module); + let result = instance.exports.add(40, 2); + postMessage(result); + } catch(e) { + postMessage('ERROR: ' + e); + } + } + `; + + let realm = Realm.create(); + Realm.shared = { m:module, s:workerScript }; + + let realmScript = ` + let worker = new Worker(Realm.shared.s); + worker.postMessage(Realm.shared.m); + let message = worker.getMessage(); + worker.terminate(); + message; + `; + let message = Realm.eval(realm, realmScript); + assertEquals(42, message); +})(); diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-873600.js b/deps/v8/test/mjsunit/regress/wasm/regress-873600.js new file mode 100644 index 0000000000..b3f2d739a2 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/wasm/regress-873600.js @@ -0,0 +1,50 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +(function DoTest() { + + var stdlib = this; + try { + var buffer = new ArrayBuffer((2097120) * 1024); + } catch (e) { + // Out of memory: soft pass because 2GiB is actually a lot! + print("OOM: soft pass"); + return; + } + var foreign = {} + + var m = (function Module(stdlib, foreign, heap) { + "use asm"; + var MEM16 = new stdlib.Int16Array(heap); + function load(i) { + i = i|0; + i = MEM16[i >> 1]|0; + return i | 0; + } + function store(i, v) { + i = i|0; + v = v|0; + MEM16[i >> 1] = v; + } + function load8(i) { + i = i|0; + i = MEM16[i + 8 >> 1]|0; + return i | 0; + } + function store8(i, v) { + i = i|0; + v = v|0; + MEM16[i + 8 >> 1] = v; + } + return { load: load, store: store, load8: load8, store8: store8 }; + })(stdlib, foreign, buffer); + + assertEquals(0, m.load(-8)); + assertEquals(0, m.load8(-16)); + m.store(2014, 2, 30, 1, 0); + assertEquals(0, m.load8(-8)); + m.store8(-8, 99); + assertEquals(99, m.load(0)); + assertEquals(99, m.load8(-8)); +})(); diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-875556.js b/deps/v8/test/mjsunit/regress/wasm/regress-875556.js new file mode 100644 index 0000000000..e1ea426f87 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/wasm/regress-875556.js @@ -0,0 +1,19 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +// Flags: --expose-wasm --experimental-wasm-mv + +load('test/mjsunit/wasm/wasm-constants.js'); +load('test/mjsunit/wasm/wasm-module-builder.js'); + +(function() { + const builder = new WasmModuleBuilder(); + // Generate function 1 (out of 2). + sig1 = makeSig([kWasmI32], []); + builder.addFunction("main", sig1).addBodyWithEnd([ + // signature: v_i + // body: + kExprBlock, + ]); + assertThrows(function() { builder.instantiate(); }, WebAssembly.CompileError); +})(); |