diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress')
38 files changed, 856 insertions, 24 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-1000635.js b/deps/v8/test/mjsunit/regress/regress-1000635.js new file mode 100644 index 0000000000..2a02774f99 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-1000635.js @@ -0,0 +1,15 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +// +// Flags: --stress-compaction --detailed-error-stack-trace --gc-interval=1 + +function add(a, b) { + throw new Error(); +} +for (let i = 0; i < 100; ++i) { + try { + add(1, 2); + } catch (e) { + } +} diff --git a/deps/v8/test/mjsunit/regress/regress-7773.js b/deps/v8/test/mjsunit/regress/regress-7773.js index 7930ae9106..6f047711bf 100644 --- a/deps/v8/test/mjsunit/regress/regress-7773.js +++ b/deps/v8/test/mjsunit/regress/regress-7773.js @@ -43,8 +43,8 @@ configurable: true }; - // Anonymous classes do not have a "name" property by default. - assertSame(undefined, Object.getOwnPropertyDescriptor(class {}, 'name')); + // Anonymous classes do have a "name" property by default with a value of ''. + assertEquals(descriptor, Object.getOwnPropertyDescriptor(class {}, 'name')); descriptor.value = 'C'; assertEquals(descriptor, Object.getOwnPropertyDescriptor(class C {}, 'name')); @@ -55,8 +55,9 @@ let b = { __proto__: class {} }; assertSame('', b.__proto__.name); - assertSame( - undefined, Object.getOwnPropertyDescriptor(b.__proto__, 'name')); + descriptor.value = ''; + assertEquals( + descriptor, Object.getOwnPropertyDescriptor(b.__proto__, 'name')); let c = { fn: class F {} }; assertSame('F', c.fn.name); diff --git a/deps/v8/test/mjsunit/regress/regress-8510-2.js b/deps/v8/test/mjsunit/regress/regress-8510-2.js new file mode 100644 index 0000000000..b870a42df0 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-8510-2.js @@ -0,0 +1,38 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --enable-lazy-source-positions + +try { + (function () { + eval(` + function assertLocation() {} + (function foo() { + var x = 1; + assertLocation(); + throw new Error(); + })(); + `); + })(); +} catch (e) { + print(e.stack); +} + +try { + (function () { + var assertLocation = 2; + (function () { + eval(` + function assertLocation() {} + (function foo() { + var x = 1; + assertLocation(); + throw new Error(); + })(); + `); + })(); + })(); +} catch (e) { + print(e.stack); +} diff --git a/deps/v8/test/mjsunit/regress/regress-9546.js b/deps/v8/test/mjsunit/regress/regress-9546.js new file mode 100644 index 0000000000..ecea405e98 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-9546.js @@ -0,0 +1,53 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +// +// Flags: --allow-natives-syntax + +// Sanity checks. +assertEquals(Math.hypot(3, 4), 5); +assertEquals(Math.hypot(1, 2, 3, 4, 5, 27), 28); + +// Regress. +assertEquals(Math.hypot(Infinity, NaN), Infinity); +assertEquals(Math.hypot(NaN, 0), NaN); +assertEquals(Math.hypot(NaN, Infinity), Infinity); +assertEquals(Math.hypot(0, NaN), NaN); +assertEquals(Math.hypot(NaN, 1, 2, 3, 4, 5, 0), NaN); +assertEquals(Math.hypot(NaN, Infinity, 2, 3, 4, 5, 0), Infinity); + +// Verify optimized code works as intended. +function two_hypot(a, b) { + return Math.hypot(a, b); +} + +function six_hypot(a, b, c, d, e, f) { + return Math.hypot(a, b, c, d, e, f); +} + +%PrepareFunctionForOptimization(two_hypot); +two_hypot(1, 2); +two_hypot(3, 4); +two_hypot(5, 6); +%OptimizeFunctionOnNextCall(two_hypot); +assertEquals(two_hypot(3, 4), 5); + +// Regress 2 parameter case. +assertEquals(two_hypot(Infinity, NaN), Infinity); +assertEquals(two_hypot(NaN, 0), NaN); +assertEquals(two_hypot(NaN, Infinity), Infinity); +assertEquals(two_hypot(0, NaN), NaN); + +// Regress many parameters case. +%PrepareFunctionForOptimization(six_hypot); +six_hypot(1, 2, 3, 4, 5, 6); +six_hypot(3, 4, 5, 6, 7, 8); +six_hypot(5, 6, 7, 8, 9, 10); +%OptimizeFunctionOnNextCall(six_hypot); +assertEquals(six_hypot(1, 2, 3, 4, 5, 27), 28); + +assertEquals(six_hypot(0, 0, 0, 0, 0, 0), 0); +assertEquals(six_hypot(NaN, 1, 2, 3, 4, 5, 0), NaN); +assertEquals(six_hypot(NaN, Infinity, 2, 3, 4, 5, 0), Infinity); +assertEquals(six_hypot(1, 2, 3, 4, 5, NaN), NaN); +assertEquals(six_hypot(Infinity, 2, 3, 4, 5, NaN), Infinity); diff --git a/deps/v8/test/mjsunit/regress/regress-9560.js b/deps/v8/test/mjsunit/regress/regress-9560.js new file mode 100644 index 0000000000..71ad9f1eab --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-9560.js @@ -0,0 +1,9 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var value = 0; + +[{ set prop(v) { value = v } }.prop = 12 ] = [ 1 ] + +assertEquals(1, value); diff --git a/deps/v8/test/mjsunit/regress/regress-988973.js b/deps/v8/test/mjsunit/regress/regress-988973.js new file mode 100644 index 0000000000..29c8ab43de --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-988973.js @@ -0,0 +1,5 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +"".match(/(?:(?=a)b){5}abcde/); diff --git a/deps/v8/test/mjsunit/regress/regress-989914.js b/deps/v8/test/mjsunit/regress/regress-989914.js new file mode 100644 index 0000000000..199fbfdf01 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-989914.js @@ -0,0 +1,12 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --no-lazy --stress-lazy-source-positions + +function foo() { + return () => { + this.test_; + eval(); + } +} diff --git a/deps/v8/test/mjsunit/regress/regress-991133.js b/deps/v8/test/mjsunit/regress/regress-991133.js new file mode 100644 index 0000000000..7857389723 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-991133.js @@ -0,0 +1,176 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --expose-gc --allow-natives-syntax --gc-interval=416 +// Flags: --no-lazy --no-lazy-feedback-allocation --stress-lazy-source-positions + +"use strict"; +function WasmModuleBuilder() {} +(function () { + try { + BigIntPrototypeValueOf = BigInt.prototype.valueOf; + } catch (e) {} + failWithMessage = function failWithMessage(message) { + throw new MjsUnitAssertionError(message); + } + assertSame = function assertSame(expected, found, name_opt) { + if (Object.is(expected, found)) return; + fail(prettyPrinted(expected), found, name_opt); + }; + assertArrayEquals = function assertArrayEquals(expected, found, name_opt) { + var start = ""; + if (name_opt) { + start = name_opt + " - "; + } + assertEquals(expected.length, found.length, start + "array length"); + if (expected.length === found.length) { + for (var i = 0; i < expected.length; ++i) { + assertEquals(expected[i], found[i], + start + "array element at index " + i); + } + } + }; + assertPropertiesEqual = function assertPropertiesEqual(expected, found, + name_opt) { + if (!deepObjectEquals(expected, found)) { + fail(expected, found, name_opt); + } + }; + assertToStringEquals = function assertToStringEquals(expected, found, + name_opt) { + if (expected !== String(found)) { + fail(expected, found, name_opt); + } + }; + assertTrue = function assertTrue(value, name_opt) { + assertEquals(true, value, name_opt); + }; + assertFalse = function assertFalse(value, name_opt) { + assertEquals(false, value, name_opt); + }; + assertNull = function assertNull(value, name_opt) { + if (value !== null) { + fail("null", value, name_opt); + } + }; + assertNotNull = function assertNotNull(value, name_opt) { + if (value === null) { + fail("not null", value, name_opt); + } + }; +})(); + +function getRandomProperty(v, rand) { var properties = Object.getOwnPropertyNames(v); var proto = Object.getPrototypeOf(v); if (proto) { properties = properties.concat(Object.getOwnPropertyNames(proto)); } if (properties.includes("constructor") && v.constructor.hasOwnProperty("__proto__")) { properties = properties.concat(Object.getOwnPropertyNames(v.constructor.__proto__)); } if (properties.length == 0) { return "0"; } return properties[rand % properties.length]; } + + +var __v_11 = { Float32Array() {}, Uint8Array() {} }; +var __v_17 = {}; +try { +} catch(e) { print("Caught: " + e); } +function __f_0(){ +} +function __f_3(a, b) { + (a | 0) + (b | 0); + return a; +} +function __f_23(expected, __f_20, ffi) { +} +try { +(function() { + function __f_12(__v_11, foreign, buffer) { + "use asm"; + var __v_18 = new __v_11.Uint8Array(buffer); + var __v_8 = new __v_9.Int32Array(buffer); + function __f_24(__v_23, __v_28) { + __v_23 = __v_23 | 0; + __v_28 = __v_28 | 0; + __v_16[__v_23 >> 2] = __v_28; + } + function __f_19(__v_23, __v_28) { + __v_21 = __v_19 | 0; + __v_28 = __v_28 | 0; + __v_18[__v_23 | 0] = __v_28; + } + function __f_10(__v_23) { + __v_0 = __v_10 | 0; + return __v_18[__v_23] | 0; + gc(); + } + function __f_13(__v_23) { + __v_23 = __v_17 | 0; + return __v_18[__v_16[__v_23 >> 2] | 0] | 0; + } + return {__f_10: __f_10, __f_13: __f_13, __f_24: __f_24, __f_19: __f_19}; + } + var __v_15 = new ArrayBuffer(__v_17); + var __v_13 = eval('(' + __f_3.toString() + ')'); + var __v_26 = __v_13(__v_11, null, __v_15); + var __v_27 = { __f_10() {} }; + __f_3(__v_13); + assertNotEquals(123, __v_27.__f_10(20)); + assertNotEquals(42, __v_27.__f_10(21)); + assertNotEquals(77, __v_27.__f_10(22)); + __v_26.__p_711994219 = __v_26[getRandomProperty(__v_26, 711994219)]; + __v_26.__defineGetter__(getRandomProperty(__v_26, 477679072), function() { gc(); __v_16[getRandomProperty(__v_16, 1106800630)] = __v_1[getRandomProperty(__v_1, 1151799043)]; return __v_26.__p_711994219; }); + assertNotEquals(123, __v_27.__f_10(0)); + assertNotEquals(42, __v_27.__f_10(4)); + assertNotEquals(77, __v_27.__f_10(8)); +})(); +} catch(e) { print("Caught: " + e); } +function __f_18(__v_11, foreign, heap) { + "use asm"; + var __v_12 = new __v_11.Float32Array(heap); + var __v_14 = __v_11.Math.fround; + function __f_20() { + var __v_21 = 1.23; + __v_12[0] = __v_21; + return +__v_12[0]; + } + return {__f_14: __f_20}; +} +try { +__f_23(Math.fround(1.23), __f_3); +} catch(e) { print("Caught: " + e); } +try { +} catch(e) { print("Caught: " + e); } +function __f_25( + imported_module_name, imported_function_name) { + var __v_11 = new WasmModuleBuilder(); + var __v_25 = new WasmModuleBuilder(); + let imp = i => i + 3; +} +try { +__f_25('mod', 'foo'); +__f_25('mod', '☺☺happy☺☺'); +__f_25('☺☺happy☺☺', 'foo'); +__f_25('☺☺happy☺☺', '☼+☃=☹'); +} catch(e) { print("Caught: " + e); } +function __f_26( + internal_name_mul, exported_name_mul, internal_name_add, + exported_name_add) { + var __v_25 = new WasmModuleBuilder(); +} +try { +__f_26('☺☺mul☺☺', 'mul', '☺☺add☺☺', 'add'); +__f_26('☺☺mul☺☺', '☺☺mul☺☺', '☺☺add☺☺', '☺☺add☺☺'); +(function __f_27() { + var __v_25 = new WasmModuleBuilder(); + __v_25.addFunction('three snowmen: ☃☃☃').addBody([]).exportFunc(); + assertThrows( () => __v_25.instantiate(), WebAssembly.CompileError, /Compiling function #0:"three snowmen: ☃☃☃" failed: /); +}); +(function __f_28() { + var __v_25 = new WasmModuleBuilder(); + __v_25.addImport('three snowmen: ☃☃☃', 'foo'); + assertThrows( () => __v_25.instantiate({}), TypeError, /WebAssembly.Instance\(\): Import #0 module="three snowmen: ☃☃☃" error: /); +}); +(function __f_29() { + __v_25.__defineGetter__(getRandomProperty(__v_25, 539246294), function() { gc(); return __f_21; }); + var __v_25 = new WasmModuleBuilder(); + __v_25.addImport('mod', 'three snowmen: ☃☃☃'); + assertThrows( + () => __v_14.instantiate({mod: {}}), WebAssembly.LinkError, + 'WebAssembly.Instance\(\): Import #0 module="mod" function="three ' + + 'snowmen: ☃☃☃" error: function import requires a callable'); +}); +} catch(e) { print("Caught: " + e); } diff --git a/deps/v8/test/mjsunit/regress/regress-992389.js b/deps/v8/test/mjsunit/regress/regress-992389.js new file mode 100644 index 0000000000..66fa9696f6 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-992389.js @@ -0,0 +1,14 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --jitless --gc-interval=12 --stack-size=50 + +__f_0(); +function __f_0() { + try { + __f_0(); + } catch(e) { + "b".replace(/(b)/g, function() { return "c"; }); + } +} diff --git a/deps/v8/test/mjsunit/regress/regress-996234.js b/deps/v8/test/mjsunit/regress/regress-996234.js new file mode 100644 index 0000000000..e68ef7de3e --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-996234.js @@ -0,0 +1,18 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --regexp-tier-up --print-code --trace-regexp-bytecodes + +// Test printing of regexp code and bytecode when tiering up from the +// interpreter to the compiler. +function __f_13544(__v_62631) { + __v_62631.replace(/\s/g); +} + +__f_13544("No"); + +let re = /^.$/; +re.test("a"); +re.test("3"); +re.test("π"); diff --git a/deps/v8/test/mjsunit/regress/regress-996751.js b/deps/v8/test/mjsunit/regress/regress-996751.js new file mode 100644 index 0000000000..71a4e329b1 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-996751.js @@ -0,0 +1,26 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +// +// Flags: --stress-lazy-source-positions + +eval(` + eval(""); + (function f() { + // This undefined should always be known to be the global undefined value, + // even though there is a sloppy eval call inside the top eval scope. + return undefined; + })(); +`); + +// The above logic should work through multiple layers of eval nesting. +eval(` + eval(\` + eval(\\\` + eval(""); + (function f() { + return undefined; + })(); + \\\`); + \`); +`); diff --git a/deps/v8/test/mjsunit/regress/regress-bind-deoptimize.js b/deps/v8/test/mjsunit/regress/regress-bind-deoptimize.js new file mode 100644 index 0000000000..a01d150d69 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-bind-deoptimize.js @@ -0,0 +1,24 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax --opt --no-always-opt + +(function() { + function bla(x) { + return this[x]; + } + + function foo(f) { + return bla.bind(f())(0); + }; + + %PrepareFunctionForOptimization(foo); + foo(() => { return [true]; }); + foo(() => { return [true]; }); + %OptimizeFunctionOnNextCall(foo); + foo(() => { return [true]; }); + assertOptimized(foo); + foo(() => { bla.a = 1; return [true]; }); + assertUnoptimized(foo); +})(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1000094.js b/deps/v8/test/mjsunit/regress/regress-crbug-1000094.js new file mode 100644 index 0000000000..40f6799c4e --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1000094.js @@ -0,0 +1,15 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --enable-lazy-source-positions --stress-lazy-source-positions + +var f = (( {a: b} = { + a() { + return b; + } +}) => b)()(); + +// b should get assigned to the inner function a, which then ends up returning +// itself. +assertEquals(f, f()); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1000170.js b/deps/v8/test/mjsunit/regress/regress-crbug-1000170.js new file mode 100644 index 0000000000..41975c7a72 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1000170.js @@ -0,0 +1,10 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +// +// Flags: --no-lazy --stress-lazy-source-positions --enable-lazy-source-positions + +(function a() { + function b() { a(); } + function c() { eval(); } +})(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-109362.js b/deps/v8/test/mjsunit/regress/regress-crbug-109362.js index cf7cd4e5fa..54bae56a1a 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-109362.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-109362.js @@ -19,7 +19,7 @@ function test(expectation, f) { 1 + reference_error //@ sourceURL=evaltest }) */ -test("3:5", new Function( +test("1:5", new Function( '1 + reference_error //@ sourceURL=evaltest')); /* (function(x @@ -28,7 +28,7 @@ test("3:5", new Function( 1 + reference_error //@ sourceURL=evaltest }) */ -test("4:6", new Function( +test("2:6", new Function( 'x', '\n 1 + reference_error //@ sourceURL=evaltest')); /* (function(x @@ -40,7 +40,7 @@ test("4:6", new Function( 1 + reference_error //@ sourceURL=evaltest }) */ -test("7:6", new Function( +test("5:6", new Function( 'x\n\n', "z//\n", "y", '\n 1 + reference_error //@ sourceURL=evaltest')); /* (function(x/\*,z// @@ -49,7 +49,7 @@ test("7:6", new Function( 1 + reference_error //@ sourceURL=evaltest }) */ -test("4:5", new Function( +test("2:5", new Function( 'x/*', "z//\n", "y*/", '1 + reference_error //@ sourceURL=evaltest')); /* (function () { diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-734051.js b/deps/v8/test/mjsunit/regress/regress-crbug-734051.js index 2655db08a7..7d8aa9cb85 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-734051.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-734051.js @@ -2,14 +2,14 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -function TestMutableHeapNumberLiteral() { +function TestHeapNumberLiteral() { var data = { a: 0, b: 0 }; data.a += 0.1; assertEquals(0.1, data.a); assertEquals(0, data.b); }; -TestMutableHeapNumberLiteral(); -TestMutableHeapNumberLiteral(); -TestMutableHeapNumberLiteral(); -TestMutableHeapNumberLiteral(); -TestMutableHeapNumberLiteral(); +TestHeapNumberLiteral(); +TestHeapNumberLiteral(); +TestHeapNumberLiteral(); +TestHeapNumberLiteral(); +TestHeapNumberLiteral(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-918301.js b/deps/v8/test/mjsunit/regress/regress-crbug-918301.js new file mode 100644 index 0000000000..a93ec3e9df --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-918301.js @@ -0,0 +1,5 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +assertThrows(() => Object.getOwnPropertyDescriptors(Array(1e9).join('c')), RangeError); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-980183.js b/deps/v8/test/mjsunit/regress/regress-crbug-980183.js new file mode 100644 index 0000000000..f4b4f5cfce --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-980183.js @@ -0,0 +1,39 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function f() { + const o = {}; + // The order of the following operations is significant + o.a = 0; + o[1024] = 1; // An offset of >=1024 is required + delete o.a; + o.b = 2; + return o.b; +} +%PrepareFunctionForOptimization(f); +f(); +f(); +%OptimizeFunctionOnNextCall(f); +f(); + + +function g(o) { + o.b = 2; +} +function h() { + const o = {}; + o.a = 0; + o[1024] = 1; + delete o.a; + g(o); + assertEquals(o.b, 2); +} +%NeverOptimizeFunction(g); +%PrepareFunctionForOptimization(h); +h(); +h(); +%OptimizeFunctionOnNextCall(h); +h(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-980422.js b/deps/v8/test/mjsunit/regress/regress-crbug-980422.js new file mode 100644 index 0000000000..93ea619afa --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-980422.js @@ -0,0 +1,29 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --enable-lazy-source-positions --stress-lazy-source-positions +(function () { + ((d, e = d) => { + return d * e; + })(); +})(); + +try { + (function () { + ((d, e = f, f = d) => { + // Won't get here as the initializers will cause a ReferenceError + })(); + })(); + assertUnreachable(); +} catch (ex) { + assertInstanceof(ex, ReferenceError); + // Not using assertThrows because we need to access ex.stack to force + // collection of source positions. + print(ex.stack); +} + +// Check that spreads in arrow functions work +(function () { + ((...args) => args)(); +})(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-981701.js b/deps/v8/test/mjsunit/regress/regress-crbug-981701.js new file mode 100644 index 0000000000..f38591b600 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-981701.js @@ -0,0 +1,6 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --throws --enable-lazy-source-positions --stress-lazy-source-positions +((...{a: [b, ...{b: [] = b, a: c}] = b}) => b)(-2); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-986187.js b/deps/v8/test/mjsunit/regress/regress-crbug-986187.js new file mode 100644 index 0000000000..6fd2ccb5bf --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-986187.js @@ -0,0 +1,14 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --expose-gc + +var obj = {} +obj.__proto__ = null; +Object.defineProperty(obj, "prop", { + set: gc +}); +for (var i = 0; i < 100 ; ++i) { + obj["prop"] = 0; +} diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-987205.js b/deps/v8/test/mjsunit/regress/regress-crbug-987205.js new file mode 100644 index 0000000000..51903919e4 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-987205.js @@ -0,0 +1,68 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function f(x) { + // This used to generate two distinct stores to #undefined, violating the load + // elimination invariant that there are no two store to the same const field: + var obj1 = { + [undefined]: 1, + 'undefined': 1 + }; + // This one cannot be discharged statically: + var obj2 = { + [undefined]: x, + 'undefined': 1 + }; + // Some more variations that exercise AllocateFastLiteral: + var obj3 = { + 'undefined': 1, + [undefined]: x + }; + var obj4 = { + 'undefined': x, + [undefined]: 1 + }; + assertEquals(obj1.undefined, 1); + assertEquals(obj2.undefined, 1); + assertEquals(obj3.undefined, x); + assertEquals(obj4.undefined, 1); +} + +%PrepareFunctionForOptimization(f); +f(1); +f(1); +%OptimizeFunctionOnNextCall(f); +f(2); + + +function g(x) { + var obj1 = { + [undefined]: 1, + [undefined]: 1 + }; + var obj2 = { + [undefined]: 1, + [undefined]: x + }; + var obj3 = { + [undefined]: x, + [undefined]: 1 + }; + var obj4 = { + [undefined]: x, + [undefined]: x + }; + assertEquals(obj1.undefined, 1); + assertEquals(obj2.undefined, x); + assertEquals(obj3.undefined, 1); + assertEquals(obj4.undefined, x); +} + +%PrepareFunctionForOptimization(g); +g(1); +g(1); +%OptimizeFunctionOnNextCall(g); +g(2); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-988304.js b/deps/v8/test/mjsunit/regress/regress-crbug-988304.js new file mode 100644 index 0000000000..a9ceec4d59 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-988304.js @@ -0,0 +1,14 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --enable-lazy-source-positions --stress-lazy-source-positions + +(function() { + ((x = 1) => { + function foo() { + x; + } + return x; + })(); +})(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-990582.js b/deps/v8/test/mjsunit/regress/regress-crbug-990582.js new file mode 100644 index 0000000000..e78775fdbb --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-990582.js @@ -0,0 +1,19 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --invoke-weak-callbacks --budget-for-feedback-vector-allocation=0 + +__v_0 = 0; +function __f_0() { + try { + __f_0(); + } catch(e) { + if (__v_0 < 50) { + __v_0++; +/()/g, new []; + } + } +} + __f_0(); +Realm.shared = this; diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-992914.js b/deps/v8/test/mjsunit/regress/regress-crbug-992914.js new file mode 100644 index 0000000000..31d0e76c34 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-992914.js @@ -0,0 +1,59 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function mainFreeze() { + const v2 = {foo:1.1}; + Object.freeze(v2); + const v12 = {foo:2.2}; + Object.preventExtensions(v12); + Object.freeze(v12); + const v18 = {foo:Object}; + v12.__proto__ = 0; + v2[5] = 1; +} +mainFreeze(); + +function mainSeal() { + const v2 = {foo:1.1}; + Object.seal(v2); + const v12 = {foo:2.2}; + Object.preventExtensions(v12); + Object.seal(v12); + const v18 = {foo:Object}; + v12.__proto__ = 0; + v2[5] = 1; +} +mainSeal(); + +function testSeal() { + a = new RangeError(null, null, null); + a.toFixed = () => {}; + e = Object.seal(a); + a = new RangeError(null, null, null); + a.toFixed = () => {}; + k = Object.preventExtensions(a); + l = Object.seal(a); + a.toFixed = () => {}; + assertThrows(() => { + Array.prototype.unshift.call(l, false, Infinity); + }, TypeError); +} +testSeal(); + +function testFreeze() { + a = new RangeError(null, null, null); + a.toFixed = () => {}; + e = Object.freeze(a); + a = new RangeError(null, null, null); + a.toFixed = () => {}; + k = Object.preventExtensions(a); + l = Object.freeze(a); + a.toFixed = () => {}; + assertThrows(() => { + Array.prototype.unshift.call(l, false, Infinity); + }, TypeError); +} +testFreeze(); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-993980.js b/deps/v8/test/mjsunit/regress/regress-crbug-993980.js new file mode 100644 index 0000000000..aea4eeb83e --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-993980.js @@ -0,0 +1,20 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +(function () { + // generate some sample data + let data = new Array(1600).fill(null).map((e, i) => ({ + invariantKey: 'v', + ['randomKey' + i]: 'w', + + })); + + // use json parser + data = JSON.parse(JSON.stringify(data)) + + // look for undefined values + for (const t of data) { + assertFalse(Object.keys(t).some(k => !t[k])); + } +})() diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-994041.js b/deps/v8/test/mjsunit/regress/regress-crbug-994041.js new file mode 100644 index 0000000000..396cfa2c1e --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-994041.js @@ -0,0 +1,9 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +v0 = Array().join(); +RegExp.prototype.__defineSetter__(0, function() { +}) +v24 = v0.search(); +assertEquals(v24, 0); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-994719.js b/deps/v8/test/mjsunit/regress/regress-crbug-994719.js new file mode 100644 index 0000000000..72a9819331 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-994719.js @@ -0,0 +1,12 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --no-lazy --enable-lazy-source-positions --stress-lazy-source-positions + +class C extends Object { + constructor() { + () => this; + super(); + } +} diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-997056.js b/deps/v8/test/mjsunit/regress/regress-crbug-997056.js new file mode 100644 index 0000000000..02e2772ddb --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-997056.js @@ -0,0 +1,12 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +for (let i = 0; i < 4; ++i) { + var obj1 = { + get [obj1]() {}, + ...obj2, + }; + var obj2 = { [obj1]: 0 }; + print(obj2); +} diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-997057.js b/deps/v8/test/mjsunit/regress/regress-crbug-997057.js new file mode 100644 index 0000000000..8f90b5e05c --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-997057.js @@ -0,0 +1,31 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --no-lazy-feedback-allocation + +arr0 = []; + +var obj = {}; + +Array.prototype[12] = 10; +arr0 = []; +Array.prototype[0] = 153; + +for (var elem in arr0) { + obj.length = { + toString: function () { + } + }; +} + +function baz() { + obj.length, arr0.length; +} + +var arr = [{}, [], {}]; +for (var i in arr) { + baz(); + for (var j = 0; j < 100000; j++) { + } +} diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-997320.js b/deps/v8/test/mjsunit/regress/regress-crbug-997320.js new file mode 100644 index 0000000000..5f8dd56200 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-997320.js @@ -0,0 +1,8 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --no-lazy --stress-lazy-source-positions +// Flags: --enable-lazy-source-positions + +async(a, b = a) => {}; diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-999450.js b/deps/v8/test/mjsunit/regress/regress-crbug-999450.js new file mode 100644 index 0000000000..6d005007b5 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-999450.js @@ -0,0 +1,10 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +// +// Flags: --no-lazy --stress-lazy-source-positions --enable-lazy-source-positions + +(function foo() { + foo = null; + () => foo; +}) diff --git a/deps/v8/test/mjsunit/regress/regress-inlining-printing.js b/deps/v8/test/mjsunit/regress/regress-inlining-printing.js new file mode 100644 index 0000000000..9a574ad308 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-inlining-printing.js @@ -0,0 +1,24 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax --trace-turbo-inlining +// Flags: --max-inlined-bytecode-size-small=0 + +function f() {} +function g() {} +function h() {} + +function test(n) { + h; + (n == 0 ? f : (n > 0 ? g : h))(); +} + +%EnsureFeedbackVectorForFunction(f); +%EnsureFeedbackVectorForFunction(g); + +%PrepareFunctionForOptimization(test); +test(0); +test(1); +%OptimizeFunctionOnNextCall(test); +test(0); diff --git a/deps/v8/test/mjsunit/regress/regress-unlink-closures-on-deopt.js b/deps/v8/test/mjsunit/regress/regress-unlink-closures-on-deopt.js index 2b34159c14..c2e6212eb1 100644 --- a/deps/v8/test/mjsunit/regress/regress-unlink-closures-on-deopt.js +++ b/deps/v8/test/mjsunit/regress/regress-unlink-closures-on-deopt.js @@ -14,7 +14,6 @@ function foo() { let g1 = foo(); let g2 = foo(); %PrepareFunctionForOptimization(g1); -%PrepareFunctionForOptimization(g2); g1({ f : 1}); g1({ f : 2}); @@ -22,9 +21,10 @@ g2({ f : 2}); g2({ f : 2}); %OptimizeFunctionOnNextCall(g1); -%OptimizeFunctionOnNextCall(g2); - g1({ f : 1}); + +%PrepareFunctionForOptimization(g2); +%OptimizeFunctionOnNextCall(g2); g2({ f : 2}); g1({}); diff --git a/deps/v8/test/mjsunit/regress/regress-v8-9511.js b/deps/v8/test/mjsunit/regress/regress-v8-9511.js new file mode 100644 index 0000000000..b2bff41611 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-v8-9511.js @@ -0,0 +1,11 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var f = function() { return 1; }; + +(function func1() { + eval("var f = function canary(s) { return 2; }"); +})(); + +assertEquals(f(), 1); diff --git a/deps/v8/test/mjsunit/regress/regress-v8-9656.js b/deps/v8/test/mjsunit/regress/regress-v8-9656.js new file mode 100644 index 0000000000..98779b18f9 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-v8-9656.js @@ -0,0 +1,14 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax +// Files: test/mjsunit/code-coverage-utils.js + +%DebugToggleBlockCoverage(true); + +try { + throw new Error(); +} catch (e) { + e.stack; +} diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-8505.js b/deps/v8/test/mjsunit/regress/wasm/regress-8505.js index 0488723e4f..b1fdedfc93 100644 --- a/deps/v8/test/mjsunit/regress/wasm/regress-8505.js +++ b/deps/v8/test/mjsunit/regress/wasm/regress-8505.js @@ -150,18 +150,18 @@ function assertBinop(name, math_func, wasm_func) { } let stdlib = this; -function Module_exp(stdlib) { +function Module_pow(stdlib) { "use asm"; - var Stdlib = stdlib.Math.exp; + var Stdlib = stdlib.Math.pow; - function NAME(a, b) { + function pow(a, b) { a = +a; b = +b; return +Stdlib(a, b); } - return {exp: exp}; + return {pow: pow}; } function wasmBinop(name, sig) { @@ -181,8 +181,8 @@ function wasmBinop(name, sig) { } function asmBinop(name) { - let instance = Module_exp(stdlib); - assertTrue(%IsAsmWasmCode(Module_exp)); + let instance = Module_pow(stdlib); + assertTrue(%IsAsmWasmCode(Module_pow)); let asm_func = instance[name]; if (typeof asm_func != "function") throw "asm[" + full_name + "] not found"; @@ -190,7 +190,7 @@ function asmBinop(name) { } (function TestF64() { - let name = 'exp'; + let name = 'pow'; let math_func = Math[name]; let wasm_func = wasmBinop(name, kSig_d_dd); diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-crbug-1002388.js b/deps/v8/test/mjsunit/regress/wasm/regress-crbug-1002388.js new file mode 100644 index 0000000000..7ad066a666 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/wasm/regress-crbug-1002388.js @@ -0,0 +1,12 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --experimental-wasm-type-reflection + +(function TestTableSetAndGetFunction() { + let func = new WebAssembly.Function({ parameters: [], results: [] }, x => x); + let table = new WebAssembly.Table({ element: "anyfunc", initial: 1 }); + table.set(0, func); + table.get(0); +})(); |