Issue: https://crbug.com/796427
Commit: [builtins] Add Object#toLocaleString stack check
Date(Commit): Thu, 21 Dec 2017 07:52:04 -0600
Code Review : https://chromium-review.googlesource.com/838854
Regress : test\mjsunit\regress\regress-796427.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --stack-size=150
assertThrows(() => "" + { toString: Object.prototype.toLocaleString }, RangeError);
Commit: [heap] Remove --heap-stats.
Date(Commit): Wed, 20 Dec 2017 12:57:03 +0100
Code Review : https://chromium-review.googlesource.com/836593
Regress : test\mjsunit\regress\regress-2646.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
var expectedItemsCount = 10000,
itemSize = 5,
heap = new ArrayBuffer(expectedItemsCount * itemSize * 8),
storage = [];
for (var i = 0; i < expectedItemsCount; i++) {
storage.push(new Float64Array(heap, 0, itemSize));
}
Commit: [builtins] abort FrameFunctionIterator::next if frame summary empty
Date(Commit): Mon, 18 Dec 2017 16:13:46 -0500
Code Review : https://chromium-review.googlesource.com/833266
Regress : test\mjsunit\es8\regress\regress-794744.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Object.getOwnPropertyDescriptors loads %FunctionPrototype%.caller, an
// accessor property which inspects the current callstack. Verify that this
// callstack iteration doesn't crash when there are no JS frames on the stack.
Promise.resolve(function () {}).then(Object.getOwnPropertyDescriptors);
Issue: https://crbug.com/795922
Commit: [ignition] Move object/array literal init to bytecode gen
Date(Commit): Tue, 19 Dec 2017 12:58:07 +0000
Code Review : https://chromium-review.googlesource.com/833882
Regress : test\mjsunit\regress\regress-crbug-795922.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows(
// Should throw a syntax error, but not crash.
"({ __proto__: null, __proto__: 1 })",
SyntaxError
);
Commit: [parser] Fix NaryOperation positions.
Date(Commit): Tue, 12 Dec 2017 10:26:31 +0100
Code Review : https://chromium-review.googlesource.com/822093
Regress : test\mjsunit\regress\regress-crbug-791256.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Original repro. A DCHECK used to fire.
(function* (name = (eval(foo), foo, prototype)) { });
// Simpler repro.
(function (name = (foo, bar, baz) ) { });
// A test which uses the value of the n-ary operation.
(function (param = (0, 1, 2)) { assertEquals(2, param); })();
Issue: https://crbug.com/791345
Commit: Fix OOB access in Array.prototype.slice
Date(Commit): Mon, 4 Dec 2017 21:43:05 +0100
Code Review : https://chromium-review.googlesource.com/806097
Regress : test\mjsunit\regress\regress-791345.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function(a) {
var len = 0x80000000;
arguments.length = len;
Array.prototype.slice.call(arguments, len - 1, len);
}('a'));
(function(a) {
var len = 0x40000000;
arguments.length = len;
Array.prototype.slice.call(arguments, len - 1, len);
}('a'));
Issue: https://crbug.com/791245
Commit: [turbofan] Temporarily disable write barrier elimination for stores of small integers.
Date(Commit): Tue, 5 Dec 2017 14:56:48 +0100
Code Review : https://chromium-review.googlesource.com/808866
Regress : test\mjsunit\compiler\regress-791245.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
var a, b; // Global variables that will end up with number map.
for (var i = 0; i < 100000; i++) {
b = 1;
a = i + -0; // -0 is a number, so this will make "a" a heap object.
b = a;
}
assertTrue(a === b);
gc();
assertTrue(a === b);
Commit: [parser] Fix func numbering inside for in.
Date(Commit): Fri, 1 Dec 2017 13:45:50 +0100
Code Review : https://chromium-review.googlesource.com/803217
Regress : test\mjsunit\regress\regress-crbug-789764.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Original repro (used to crash):
_v3 = ({ _v7 = (function outer() {
for ([...[]][function inner() {}] in []) {
}
})} = {}) => {
};
_v3();
// Smaller repro (used to crash):
a = (b = !function outer() { for (function inner() {}.foo in []) {} }) => {};
a();
Issue: https://crbug.com/v8/5546
Commit: Remove always-on --harmony-template-escapes flag
Date(Commit): Fri, 17 Nov 2017 14:55:13 -0800
Code Review : https://chromium-review.googlesource.com/777940
Regress : test\mjsunit\harmony\regress\regress-6100.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// This test is added because harmony-template-escapes were not properly
// handled in the preparser.
function check({cooked, raw, exprs}) {
return function(strs, ...args) {
assertArrayEquals(cooked, strs);
assertArrayEquals(raw, strs.raw);
assertArrayEquals(exprs, args);
};
}
// clang-format off
function lazy() {
check({
'cooked': [
undefined
],
'raw': [
'\\01'
],
'exprs': []
})`\01`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\01',
'right'
],
'exprs': [
0
]
})`\01${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\01'
],
'exprs': [
0
]
})`left${0}\01`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\01',
'right'
],
'exprs': [
0,
1
]
})`left${0}\01${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\1'
],
'exprs': []
})`\1`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\1',
'right'
],
'exprs': [
0
]
})`\1${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\1'
],
'exprs': [
0
]
})`left${0}\1`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\1',
'right'
],
'exprs': [
0,
1
]
})`left${0}\1${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\xg'
],
'exprs': []
})`\xg`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\xg',
'right'
],
'exprs': [
0
]
})`\xg${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\xg'
],
'exprs': [
0
]
})`left${0}\xg`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\xg',
'right'
],
'exprs': [
0,
1
]
})`left${0}\xg${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\xAg'
],
'exprs': []
})`\xAg`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\xAg',
'right'
],
'exprs': [
0
]
})`\xAg${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\xAg'
],
'exprs': [
0
]
})`left${0}\xAg`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\xAg',
'right'
],
'exprs': [
0,
1
]
})`left${0}\xAg${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u0'
],
'exprs': []
})`\u0`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u0',
'right'
],
'exprs': [
0
]
})`\u0${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u0'
],
'exprs': [
0
]
})`left${0}\u0`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u0',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u0${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u0g'
],
'exprs': []
})`\u0g`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u0g',
'right'
],
'exprs': [
0
]
})`\u0g${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u0g'
],
'exprs': [
0
]
})`left${0}\u0g`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u0g',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u0g${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u00g'
],
'exprs': []
})`\u00g`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u00g',
'right'
],
'exprs': [
0
]
})`\u00g${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u00g'
],
'exprs': [
0
]
})`left${0}\u00g`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u00g',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u00g${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u000g'
],
'exprs': []
})`\u000g`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u000g',
'right'
],
'exprs': [
0
]
})`\u000g${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u000g'
],
'exprs': [
0
]
})`left${0}\u000g`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u000g',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u000g${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{}'
],
'exprs': []
})`\u{}`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{}',
'right'
],
'exprs': [
0
]
})`\u{}${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{}'
],
'exprs': [
0
]
})`left${0}\u{}`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{}',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{}${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{-0}'
],
'exprs': []
})`\u{-0}`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{-0}',
'right'
],
'exprs': [
0
]
})`\u{-0}${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{-0}'
],
'exprs': [
0
]
})`left${0}\u{-0}`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{-0}',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{-0}${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{g}'
],
'exprs': []
})`\u{g}`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{g}',
'right'
],
'exprs': [
0
]
})`\u{g}${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{g}'
],
'exprs': [
0
]
})`left${0}\u{g}`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{g}',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{g}${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{0'
],
'exprs': []
})`\u{0`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{0',
'right'
],
'exprs': [
0
]
})`\u{0${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{0'
],
'exprs': [
0
]
})`left${0}\u{0`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{0',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{0${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{\\u{0}'
],
'exprs': []
})`\u{\u{0}`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{\\u{0}',
'right'
],
'exprs': [
0
]
})`\u{\u{0}${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{\\u{0}'
],
'exprs': [
0
]
})`left${0}\u{\u{0}`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{\\u{0}',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{\u{0}${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{110000}'
],
'exprs': []
})`\u{110000}`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{110000}',
'right'
],
'exprs': [
0
]
})`\u{110000}${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{110000}'
],
'exprs': [
0
]
})`left${0}\u{110000}`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{110000}',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{110000}${1}right`;
function checkMultiple(expectedArray) {
let results = [];
return function consume(strs, ...args) {
if (typeof strs === 'undefined') {
assertArrayEquals(expectedArray, results);
} else {
results.push({cooked: strs, raw: strs.raw, exprs: args});
return consume;
}
};
}
checkMultiple([{
'cooked': [
undefined
],
'raw': [
'\\u',
],
'exprs': []
}, {
'cooked': [
undefined
],
'raw': [
'\\u',
],
'exprs': []
}])`\u``\u`();
checkMultiple([{
'cooked': [
' '
],
'raw': [
' ',
],
'exprs': []
}, {
'cooked': [
undefined
],
'raw': [
'\\u',
],
'exprs': []
}])` ``\u`();
checkMultiple([{
'cooked': [
undefined
],
'raw': [
'\\u',
],
'exprs': []
}, {
'cooked': [
' '
],
'raw': [
' ',
],
'exprs': []
}])`\u`` `();
checkMultiple([{
'cooked': [
' '
],
'raw': [
' ',
],
'exprs': []
}, {
'cooked': [
' '
],
'raw': [
' ',
],
'exprs': []
}])` `` `();
}
(function eager() {
check({
'cooked': [
undefined
],
'raw': [
'\\01'
],
'exprs': []
})`\01`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\01',
'right'
],
'exprs': [
0
]
})`\01${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\01'
],
'exprs': [
0
]
})`left${0}\01`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\01',
'right'
],
'exprs': [
0,
1
]
})`left${0}\01${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\1'
],
'exprs': []
})`\1`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\1',
'right'
],
'exprs': [
0
]
})`\1${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\1'
],
'exprs': [
0
]
})`left${0}\1`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\1',
'right'
],
'exprs': [
0,
1
]
})`left${0}\1${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\xg'
],
'exprs': []
})`\xg`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\xg',
'right'
],
'exprs': [
0
]
})`\xg${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\xg'
],
'exprs': [
0
]
})`left${0}\xg`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\xg',
'right'
],
'exprs': [
0,
1
]
})`left${0}\xg${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\xAg'
],
'exprs': []
})`\xAg`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\xAg',
'right'
],
'exprs': [
0
]
})`\xAg${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\xAg'
],
'exprs': [
0
]
})`left${0}\xAg`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\xAg',
'right'
],
'exprs': [
0,
1
]
})`left${0}\xAg${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u0'
],
'exprs': []
})`\u0`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u0',
'right'
],
'exprs': [
0
]
})`\u0${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u0'
],
'exprs': [
0
]
})`left${0}\u0`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u0',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u0${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u0g'
],
'exprs': []
})`\u0g`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u0g',
'right'
],
'exprs': [
0
]
})`\u0g${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u0g'
],
'exprs': [
0
]
})`left${0}\u0g`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u0g',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u0g${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u00g'
],
'exprs': []
})`\u00g`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u00g',
'right'
],
'exprs': [
0
]
})`\u00g${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u00g'
],
'exprs': [
0
]
})`left${0}\u00g`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u00g',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u00g${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u000g'
],
'exprs': []
})`\u000g`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u000g',
'right'
],
'exprs': [
0
]
})`\u000g${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u000g'
],
'exprs': [
0
]
})`left${0}\u000g`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u000g',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u000g${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{}'
],
'exprs': []
})`\u{}`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{}',
'right'
],
'exprs': [
0
]
})`\u{}${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{}'
],
'exprs': [
0
]
})`left${0}\u{}`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{}',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{}${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{-0}'
],
'exprs': []
})`\u{-0}`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{-0}',
'right'
],
'exprs': [
0
]
})`\u{-0}${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{-0}'
],
'exprs': [
0
]
})`left${0}\u{-0}`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{-0}',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{-0}${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{g}'
],
'exprs': []
})`\u{g}`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{g}',
'right'
],
'exprs': [
0
]
})`\u{g}${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{g}'
],
'exprs': [
0
]
})`left${0}\u{g}`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{g}',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{g}${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{0'
],
'exprs': []
})`\u{0`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{0',
'right'
],
'exprs': [
0
]
})`\u{0${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{0'
],
'exprs': [
0
]
})`left${0}\u{0`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{0',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{0${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{\\u{0}'
],
'exprs': []
})`\u{\u{0}`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{\\u{0}',
'right'
],
'exprs': [
0
]
})`\u{\u{0}${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{\\u{0}'
],
'exprs': [
0
]
})`left${0}\u{\u{0}`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{\\u{0}',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{\u{0}${1}right`;
check({
'cooked': [
undefined
],
'raw': [
'\\u{110000}'
],
'exprs': []
})`\u{110000}`;
check({
'cooked': [
undefined,
'right'
],
'raw': [
'\\u{110000}',
'right'
],
'exprs': [
0
]
})`\u{110000}${0}right`;
check({
'cooked': [
'left',
undefined
],
'raw': [
'left',
'\\u{110000}'
],
'exprs': [
0
]
})`left${0}\u{110000}`;
check({
'cooked': [
'left',
undefined,
'right'
],
'raw': [
'left',
'\\u{110000}',
'right'
],
'exprs': [
0,
1
]
})`left${0}\u{110000}${1}right`;
function checkMultiple(expectedArray) {
let results = [];
return function consume(strs, ...args) {
if (typeof strs === 'undefined') {
assertArrayEquals(expectedArray, results);
} else {
results.push({cooked: strs, raw: strs.raw, exprs: args});
return consume;
}
};
}
checkMultiple([{
'cooked': [
undefined
],
'raw': [
'\\u',
],
'exprs': []
}, {
'cooked': [
undefined
],
'raw': [
'\\u',
],
'exprs': []
}])`\u``\u`();
checkMultiple([{
'cooked': [
' '
],
'raw': [
' ',
],
'exprs': []
}, {
'cooked': [
undefined
],
'raw': [
'\\u',
],
'exprs': []
}])` ``\u`();
checkMultiple([{
'cooked': [
undefined
],
'raw': [
'\\u',
],
'exprs': []
}, {
'cooked': [
' '
],
'raw': [
' ',
],
'exprs': []
}])`\u`` `();
checkMultiple([{
'cooked': [
' '
],
'raw': [
' ',
],
'exprs': []
}, {
'cooked': [
' '
],
'raw': [
' ',
],
'exprs': []
}])` `` `();
})();
lazy();
Commit: [objects] Fix flag in {Map::AddMissingTransitions}.
Date(Commit): Mon, 27 Nov 2017 12:38:07 +0100
Code Review : https://chromium-review.googlesource.com/789839
Regress : test\mjsunit\regress\regress-crbug-786020.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
%SetAllocationTimeout(1000, 90);
(new constructor)[0x40000000] = null;
Issue: https://crbug.com/783132
Commit: [runtime] Ensure elements transitions don't interfere with field type tracking.
Date(Commit): Wed, 22 Nov 2017 12:17:03 +0100
Code Review : https://chromium-review.googlesource.com/785190
Regress : test\mjsunit\regress\regress-crbug-783132.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --verify-heap
function f(o, v) {
try {
f(o, v + 1);
} catch (e) {
}
o[v] = 43.35 + v * 5.3;
}
f(Array.prototype, 0);
Issue: https://crbug.com/784080
Commit: Fix hole handling in fast arguments slice
Date(Commit): Wed, 22 Nov 2017 12:22:41 +0100
Code Review : https://chromium-review.googlesource.com/785210
Regress : test\mjsunit\regress\regress-784080.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function() {
function f(a, b, a) {
return Array.prototype.slice.call(arguments);
}
let result = f(456, 789, 111112);
assertEquals(result[0], 456);
assertEquals(result[1], 789);
assertEquals(result[2], 111112);
assertEquals(result.length, 3);
})();
(function() {
function f(a, b, a) {
return Array.prototype.slice.call(arguments);
}
let result = f(456, 789, 111112, 543, 654);
assertEquals(result[0], 456);
assertEquals(result[1], 789);
assertEquals(result[2], 111112);
assertEquals(result[3], 543);
assertEquals(result[4], 654);
assertEquals(result.length, 5);
})();
Issue: https://crbug.com/786573
Commit: [regexp] Avoid integer overflow in callable @@replace
Date(Commit): Mon, 20 Nov 2017 12:35:55 +0100
Code Review : https://chromium-review.googlesource.com/779001
Regress : test\mjsunit\regress\regress-786573.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
let cnt = 0;
let reg = /./g;
reg.exec = () => {
// Note: it's still possible to trigger OOM by passing huge values here, since
// the spec requires building a list of all captures in
// https://tc39.github.io/ecma262/#sec-regexp.prototype-@@replace
if (cnt++ == 0) return {length: 2 ** 16};
cnt = 0;
return null;
};
assertThrows(() => ''.replace(reg, () => {}), RangeError);
Issue: https://crbug.com/785804
Commit: Fix bug in length handling of Array.prototype.slice fast-path
Date(Commit): Fri, 17 Nov 2017 19:17:34 +0100
Code Review : https://chromium-review.googlesource.com/776696
Regress : test\mjsunit\regress\regress-785804.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
let __v_25059 = {
valueOf: function () {
let __v_25062 = __v_25055.length;
__v_25055.length = 1;
return __v_25062;
}
};
let __v_25060 = [];
for (let __v_25063 = 0; __v_25063 < 1500; __v_25063++) {
__v_25060.push("" + 0.1);
}
for (let __v_25064 = 0; __v_25064 < 75; __v_25064++) {
__v_25055 = __v_25060.slice();
__v_25056 = __v_25055.slice(0, __v_25059);
}
Issue: https://crbug.com/783902
Commit: Reland^2 "[runtime] Slightly optimize creation of class literals."
Date(Commit): Thu, 16 Nov 2017 17:45:46 +0100
Code Review : https://chromium-review.googlesource.com/764067
Regress : test\mjsunit\regress\regress-crbug-783902.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
class A {}
class B extends A {
*gf() {
yield super.f();
}
}
Issue: https://crbug.com/v8/4545
Commit: Remove always-on flags for RegExp dotAll and lookbehind
Date(Commit): Thu, 16 Nov 2017 16:45:55 -0800
Code Review : https://chromium-review.googlesource.com/775601
Regress : test\mjsunit\regress\regress-crbug-570241.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertTrue(/(?<=12345123451234512345)/.test("12345123451234512345"));
Issue: https://crbug.com/778668
Commit: Fix hole escape in dictionary mode Array.prototype.slice()
Date(Commit): Thu, 16 Nov 2017 12:39:56 +0100
Code Review : https://chromium-review.googlesource.com/774263
Regress : test\mjsunit\regress\regress-784863.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var __v_18522 = [ 4.2, true, false];
Object.defineProperty(__v_18522, 2, {
get: function () {
return false;
},
});
__v_18522.shift();
__v_18522.slice();
Issue: https://crbug.com/784990
Commit: [collections] Handle holes in collection constructor fast paths
Date(Commit): Wed, 15 Nov 2017 09:23:13 -0600
Code Review : https://chromium-review.googlesource.com/771387
Regress : test\mjsunit\regress\regress-784990.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const key1 = {};
const key2 = {};
const set = new Set([, 1]);
assertEquals(set.has(undefined), true);
assertEquals(set.has(1), true);
const doubleSet = new Set([,1.234]);
assertEquals(doubleSet.has(undefined), true);
assertEquals(doubleSet.has(1.234), true);
const map = new Map([[, key1], [key2, ]]);
assertEquals(map.get(undefined), key1);
assertEquals(map.get(key2), undefined);
const doublesMap = new Map([[, 1.234]]);
assertEquals(doublesMap.get(undefined), 1.234);
const weakmap = new WeakMap([[key1, ]]);
assertEquals(weakmap.get(key1), undefined);
assertThrows(() => new WeakSet([, {}]));
assertThrows(() => new WeakSet([, 1.234]));
assertThrows(() => new Map([, [, key1]]));
assertThrows(() => new WeakMap([[, key1]]));
assertThrows(() => new WeakMap([, [, key1]]));
Issue: https://crbug.com/784835
Commit: [ic] Properly handle negative indices.
Date(Commit): Thu, 16 Nov 2017 07:24:35 +0100
Code Review : https://chromium-review.googlesource.com/774278
Regress : test\mjsunit\regress\regress-crbug-784835.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function foo(o, k) { return o[k]; }
var a = [1,2];
a["-1"] = 42;
assertEquals(1, foo(a, 0));
assertEquals(2, foo(a, 1));
assertEquals(undefined, foo(a, 3));
assertEquals(42, foo(a, -1));
Issue: https://crbug.com/784862
Commit: [collections] Allocate large collections in large object space
Date(Commit): Wed, 15 Nov 2017 09:27:52 +0100
Code Review : https://chromium-review.googlesource.com/771150
Regress : test\mjsunit\regress\regress-784862.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// This test triggers table allocation in large object space. We don't care
// about the result as long as we don't crash.
const array = new Array();
array[0x80000] = 1;
array.unshift({});
assertThrows(() => new WeakMap(array));
Issue: https://crbug.com/779457
Commit: [parser] RewritableExpressions should keep track of their Scope directly
Date(Commit): Tue, 14 Nov 2017 11:58:55 -0800
Code Review : https://chromium-review.googlesource.com/767666
Regress : test\mjsunit\regress\regress-crbug-779457.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function testEager() {
(function({name = [foo] = eval("[]")}) {})({});
(function([name = [foo] = eval("[]")]) {})([]);
})();
(function testLazy() {
function f({name = [foo] = eval("[]")}) {}
function g([name = [foo] = eval("[]")]) {}
f({});
g([]);
})();
(function testEagerArrow() {
(({name = [foo] = eval("[]")}) => {})({});
(([name = [foo] = eval("[]")]) => {})([]);
})();
(function testLazyArrow() {
var f = ({name = [foo] = eval("[]")}) => {};
var g = ([name = [foo] = eval("[]")]) => {};
f({});
g([]);
})();
Issue: https://crbug.com/783119
Commit: Fix index bug in splicing dictionary element arrays
Date(Commit): Fri, 10 Nov 2017 17:35:08 +0100
Code Review : https://chromium-review.googlesource.com/763460
Regress : test\mjsunit\regress\regress-783119.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
let a = [,,,,,,,,,,,,,,,,,,,,,,,11,12,13,14,15,16,17,18,19];
%NormalizeElements(a);
let b = a.slice(19);
assertEquals(11, b[4]);
Issue: https://crbug.com/782145
Commit: [string] Fix regexp fast path in MaybeCallFunctionAtSymbol
Date(Commit): Wed, 8 Nov 2017 10:16:47 +0100
Code Review : https://chromium-review.googlesource.com/758257
Regress : test\mjsunit\regress\regress-782145.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function newFastRegExp() { return new RegExp('.'); }
function toSlowRegExp(re) { re.exec = 42; }
let re = newFastRegExp();
const evil_nonstring = { [Symbol.toPrimitive]: () => toSlowRegExp(re) };
const empty_string = "";
String.prototype.replace.call(evil_nonstring, re, empty_string);
re = newFastRegExp();
String.prototype.match.call(evil_nonstring, re, empty_string);
re = newFastRegExp();
String.prototype.search.call(evil_nonstring, re, empty_string);
re = newFastRegExp();
String.prototype.split.call(evil_nonstring, re, empty_string);
Issue: https://crbug.com/v8/6936
Commit: [ic] Internalize strings on the fly in KeyedLoadICGeneric.
Date(Commit): Thu, 2 Nov 2017 20:56:02 +0100
Code Review : https://chromium-review.googlesource.com/751464
Regress : test\mjsunit\regress\regress-7026.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function foo(o, k) { return o[k]; }
const a = "a";
foo([1], 0);
foo({a:1}, a);
const p = new Proxy({}, {
get(target, name) {
return name;
}
});
assertEquals(a + "b", foo(p, a + "b"));
Issue: https://crbug.com/778952
Commit: Fix DCHECK in HasFastProperties
Date(Commit): Tue, 31 Oct 2017 10:25:20 -0700
Code Review : https://chromium-review.googlesource.com/747272
Regress : test\mjsunit\regress\regress-crbug-778952.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows(function() {
const p = new Proxy({}, {});
(new Set).add(p); // Compute the hash code for p.
null[p] = 0;
});
Issue: https://crbug.com/772897
Commit: [proxy] Properly handle exceptions from Object::ToName().
Date(Commit): Mon, 30 Oct 2017 15:38:10 +0100
Code Review : https://chromium-review.googlesource.com/744041
Regress : test\mjsunit\regress\regress-crbug-772897.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function store(obj, name) {
return obj[name] = 0;
}
function f(obj) {
var key = {
toString() { throw new Error("boom"); }
};
store(obj, key);
}
(function() {
var proxy = new Proxy({}, {});
store(proxy, 0)
assertThrows(() => f(proxy), Error);
})();
Issue: https://crbug.com/778574
Commit: Fix Array.protoype.slice bug in argument object handling
Date(Commit): Thu, 26 Oct 2017 15:50:39 +0200
Code Review : https://chromium-review.googlesource.com/738148
Regress : test\mjsunit\regress\regress-778574.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function () {
arguments.length = 7;
Array.prototype.slice.call(arguments);
})();
Issue: https://crbug.com/v8/6921
Commit: [cleanup] Limit Token usage to Parser, AST, BytecodeGenerator
Date(Commit): Wed, 25 Oct 2017 10:43:04 -0700
Code Review : https://chromium-review.googlesource.com/736851
Regress : test\mjsunit\regress\regress-crbug-465564.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --cache=code
assertTrue(%StringLessThan("a", "b"));
Commit: Revert "[test] Refactor assertPromiseResult"
Date(Commit): Wed, 25 Oct 2017 16:12:49 +0200
Code Review : https://chromium-review.googlesource.com/718746
Regress : test\mjsunit\regress\wasm\regress-670683.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-wasm --allow-natives-syntax
const bytes = new Uint8Array([
0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x05, 0x01,
0x60, 0x00, 0x01, 0x7f, 0x03, 0x02, 0x01, 0x00, 0x05, 0x03, 0x01,
0x00, 0x01, 0x07, 0x11, 0x02, 0x04, 0x67, 0x72, 0x6f, 0x77, 0x00,
0x00, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x02, 0x00, 0x0a,
0x08, 0x01, 0x06, 0x00, 0x41, 0x01, 0x40, 0x00, 0x0b
]);
assertPromiseResult(
WebAssembly.compile(bytes),
module => {
print('promise resolved: ' + module);
new WebAssembly.Instance(module).exports.grow();
});
Issue: https://crbug.com/v8/6970
Commit: [parser] Fix rewinding logic for destructuring in arrow params
Date(Commit): Mon, 23 Oct 2017 15:54:30 -0700
Code Review : https://chromium-review.googlesource.com/733950
Regress : test\mjsunit\regress\regress-6970.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertEquals(42, (({a = {b} = {b: 42}}) => a.b)({}));
assertEquals(42, b);
Issue: https://crbug.com/776338
Commit: [proxy] Fix invalid call to getter in [[Get/Set/Has]]
Date(Commit): Mon, 23 Oct 2017 10:24:41 +0200
Code Review : https://chromium-review.googlesource.com/732897
Regress : test\mjsunit\regress\regress-776338.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const obj = {};
Object.defineProperty(obj, 'value', {
enumerable: true,
configurable: true,
get: assertUnreachable,
set: assertUnreachable,
});
let called_get = false;
let called_has = false;
let called_set = false;
const has = function(target, prop) {
assertEquals('value', prop);
called_has = true;
return false; // Need to return false to trigger GetOwnProperty call.
};
const get = function(target, prop) {
assertEquals('value', prop);
called_get = true;
return 'yep';
};
const set = function(target, prop, value) {
assertEquals('value', prop);
called_set = true;
return true; // Need to return true to trigger GetOwnProperty call.
};
const proxy = new Proxy(obj, { has, get, set });
assertFalse(Reflect.has(proxy, 'value'));
assertTrue(called_has);
assertEquals('nope', proxy.value = 'nope');
assertTrue(called_set);
assertEquals('yep', proxy.value);
assertTrue(called_get);
Issue: https://crbug.com/777182
Commit: [typedarrays] Fix a wrong type casting in TA.p.set
Date(Commit): Mon, 23 Oct 2017 17:36:31 +0900
Code Review : https://chromium-review.googlesource.com/732865
Regress : test\mjsunit\es6\regress\regress-777182.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --enable-slow-asserts
var __v_65159 = [1.3];
__v_65159.length = 0;
new Int8Array(10).set(__v_65159);
Issue: https://crbug.com/v8/6940
Commit: [regexp] Fix a bug causing early aborts from AddCaseEquivalents
Date(Commit): Wed, 18 Oct 2017 13:34:38 +0200
Code Review : https://chromium-review.googlesource.com/725430
Regress : test\mjsunit\regress\regress-v8-6940.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertTrue(/[ŸŶ]/i.test('ÿ'));
assertTrue(/[ŸY]/i.test('ÿ'));
assertTrue(/[YÝŸŶỲ]/i.test('ÿ'));
assertTrue(/[YÝŸŶỲ]/iu.test('ÿ'));
Commit: [test] Shorten regression-.js filenames to regress-.js
Date(Commit): Tue, 17 Oct 2017 11:50:09 +0200
Code Review : https://chromium-review.googlesource.com/721550
Regress : test\mjsunit\regress\wasm\regress-769846.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function Module() {
"use asm";
function div_(__v_6) {
__v_6 = __v_6 | 0;
}
return { f: div_}
};
var __f_0 = Module().f;
__v_8 = [0];
__v_8.__defineGetter__(0, function() { return __f_0(__v_8); });
__v_8[0];
Issue: https://crbug.com/774860
Commit: Fix slack tracking for function subclasses.
Date(Commit): Tue, 17 Oct 2017 11:38:02 +0200
Code Review : https://chromium-review.googlesource.com/721551
Regress : test\mjsunit\regress\regress-crbug-774860.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --verify-heap
(function () {
class F extends Function {}
let f = new F("'use strict';");
// Create enough objects to complete slack tracking.
for (let i = 0; i < 20; i++) {
new F();
}
gc();
})();
Issue: https://crbug.com/774994
Commit: [parser] Skipping inner funcs: accurately record NeedsHomeObject
Date(Commit): Mon, 16 Oct 2017 12:05:29 -0700
Code Review : https://chromium-review.googlesource.com/721879
Regress : test\mjsunit\regress\regress-crbug-774994.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --preparser-scope-analysis
function f() {
new class extends Object {
constructor() {
eval("super(); super.__f_10();");
}
}
}
assertThrows(f, TypeError);
function g() {
let obj = {
m() {
eval("super.foo()");
}
}
obj.m();
}
assertThrows(g, TypeError);
function h() {
let obj = {
get m() {
eval("super.foo()");
}
}
obj.m;
}
assertThrows(h, TypeError);
Commit: [parser] Skipping inner funcs: fix related to aborting preparsing.
Date(Commit): Mon, 16 Oct 2017 14:37:19 +0200
Code Review : https://chromium-review.googlesource.com/720920
Regress : test\mjsunit\regress\regress-774475.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var o = function f3() {
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
}
Issue: https://crbug.com/764219
Commit: [ic] Fix storing to JSGlobalProxy having JSProxy in prototype chain.
Date(Commit): Fri, 13 Oct 2017 12:06:04 +0200
Code Review : https://chromium-review.googlesource.com/718108
Regress : test\mjsunit\regress\regress-crbug-764219.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function() {
function f(o) {
o.x = 42;
};
f({});
f(this);
f(this);
})();
(function() {
function f(o) {
o.y = 153;
};
Object.setPrototypeOf(this, new Proxy({}, {}));
f({});
f(this);
f(this);
})();
(function() {
function f(o) {
o.z = 153;
};
Object.setPrototypeOf(this, new Proxy({get z(){}}, {}));
f({});
f(this);
f(this);
})();
Issue: https://crbug.com/768875
Commit: [ic] Introduce proper slow stub for StoreGlobalIC.
Date(Commit): Thu, 12 Oct 2017 14:30:22 +0200
Code Review : https://chromium-review.googlesource.com/715802
Regress : test\mjsunit\regress\regress-crbug-768875.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
this.__defineGetter__('x', function() { return 0; });
function store_x() {
x = 23;
}
store_x();
store_x();
assertEquals(0, x);
Realm.eval(Realm.current(), "let x = 42");
assertEquals(42, x);
store_x();
assertEquals(23, x);
this.__defineGetter__('y', function() { return 0; });
function store_y() {
y = 23;
}
store_y();
store_y();
assertEquals(0, y);
Realm.eval(Realm.current(), "const y = 42");
assertEquals(42, y);
assertThrows(store_y, TypeError);
assertEquals(42, y);
Issue: https://crbug.com/772190
Commit: [turbofan] Don't try to constant-fold properties from the_hole.
Date(Commit): Fri, 6 Oct 2017 11:19:22 +0200
Code Review : https://chromium-review.googlesource.com/704578
Regress : test\mjsunit\regress\regress-772190.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --always-opt
assertThrows(function() {
__v_13383[4];
let __v_13383 = {};
});
Issue: https://crbug.com/768158
Commit: [parser] Ensure for-in/of loop variables are marked maybe_assigned
Date(Commit): Wed, 4 Oct 2017 17:30:10 -0700
Code Review : https://chromium-review.googlesource.com/701624
Regress : test\mjsunit\regress\regress-crbug-768158.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --always-opt
(function testOriginalRepro() {
var result;
var dict = { toString() { result = v;} };
for (var v of ['fontsize', 'sup']) {
String.prototype[v].call(dict);
assertEquals(v, result);
}
})();
(function testSimpler() {
var result;
function setResult() { result = v; }
for (var v of ['hello', 'world']) {
setResult();
assertEquals(v, result);
}
})();
Commit: [esnext] initialize native_context()->initial_async_generator_prototype
Date(Commit): Wed, 4 Oct 2017 11:18:55 +0200
Code Review : https://chromium-review.googlesource.com/700261
Regress : test\mjsunit\harmony\regress\regress-771470.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --enable-slow-asserts
async function* gen() { };
gen.prototype = 1;
Issue: https://crbug.com/v8/6682
Commit: Remove SetForceInlineFlag from tests.
Date(Commit): Wed, 13 Sep 2017 15:52:42 +0100
Code Review : https://chromium-review.googlesource.com/660739
Regress : test\mjsunit\regress\regress-crbug-593697-2.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --stress-inline
"use strict";
var f5 = (function f6(stdlib) {
"use asm";
var cos = stdlib.Math.cos;
function f5() {
return cos();
}
return { f5: f5 };
})(this, {}).f5();
Issue: https://crbug.com/763683
Commit: Improve error handling of proxies get property
Date(Commit): Tue, 12 Sep 2017 16:42:24 +0200
Code Review : https://chromium-review.googlesource.com/663218
Regress : test\mjsunit\regress\regress-crbug-763683.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows(function test() {
var proxy = new Proxy({}, {});
var key_or_proxy = 0;
function failing_get() {
return proxy[key_or_proxy];
}
failing_get();
key_or_proxy = new Proxy({
toString() {
throw new TypeError('error');
}
}, {});
failing_get();
}, TypeError);
Issue: https://crbug.com/v8/2435
Commit: [builtins] Add fast-path for JSTypedArray to CreateListFromArrayLike.
Date(Commit): Fri, 8 Sep 2017 20:53:34 +0200
Code Review : https://chromium-review.googlesource.com/657405
Regress : test\mjsunit\regress\regress-2435.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function arrayLikeToString(a) {
return String.fromCharCode.apply(this, a);
}
const klasses = [
Int8Array,
Uint8Array,
Uint8ClampedArray,
Int16Array,
Uint16Array,
Int32Array,
Uint32Array,
Float32Array,
Float64Array
];
const string = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
for (const klass of klasses) {
const array = klass.from(string, s => s.charCodeAt(0));
assertEquals(string, arrayLikeToString(array));
}
Commit: [parser] Fix arrow funcs w/ destructuring params again. [Alternative fix]
Date(Commit): Thu, 7 Sep 2017 14:05:46 +0200
Code Review : https://chromium-review.googlesource.com/650297
Regress : test\mjsunit\regress\regress-761831.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function OrigReproCase() {
assertThrows('var f = ([x=[a=undefined]=[]]) => {}; f();', TypeError);
}
OrigReproCase();
function SimpleReproCase() {
assertThrows('var f = ([x=[]=[]]) => {}; f()', TypeError);
}
SimpleReproCase();
Commit: [asm.js] Gracefully handle stack overflow in start function.
Date(Commit): Wed, 6 Sep 2017 16:24:22 +0200
Code Review : https://chromium-review.googlesource.com/652478
Regress : test\mjsunit\regress\regress-crbug-762472.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --stack-size=100
function Module() {
"use asm";
function f() {}
return { f:f }
}
function InstantiateNearStackLimit() {
try {
var fuse = InstantiateNearStackLimit();
if (fuse == 0) Module();
return fuse - 1;
} catch(e) {
return init_fuse;
}
}
var init_fuse = 0;
for (init_fuse = 0; init_fuse < 10; init_fuse++) {
InstantiateNearStackLimit();
}
Issue: https://crbug.com/761639
Commit: Remove unnecessary check in StoreProxy
Date(Commit): Mon, 4 Sep 2017 09:42:22 +0200
Code Review : https://chromium-review.googlesource.com/647550
Regress : test\mjsunit\regress\regress-761639.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Regression test for hitting a DCHECK in StoreProxy.
for (var i = 0; i < 10; i++) {
__proto__ = new Proxy({}, { getPrototypeOf() { } });
}
Issue: https://crbug.com/760790
Commit: [csa] Canonicalize empty elements in AllocateJSArray
Date(Commit): Fri, 1 Sep 2017 17:54:18 +0200
Code Review : https://chromium-review.googlesource.com/645959
Regress : test\mjsunit\regress\regress-760790.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function g() {
var a = Array(0);
a[0]++;
}
g();
g();
g();
Issue: https://crbug.com/v8/6774
Commit: [console] correctly propagate exceptions.
Date(Commit): Thu, 31 Aug 2017 14:26:27 +0200
Code Review : https://chromium-review.googlesource.com/645127
Regress : test\mjsunit\regress\regress-crbug-714696.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
if (this.Intl) {
new Intl.v8BreakIterator();
new Intl.DateTimeFormat();
try { console.log({ toString: function() { throw 1; }}); } catch (e) {}
new Intl.v8BreakIterator();
}
Issue: https://crbug.com/760268
Commit: Fix wrongly handled exception in CheckProxyHasTrap
Date(Commit): Wed, 30 Aug 2017 10:01:19 +0200
Code Review : https://chromium-review.googlesource.com/642798
Regress : test\mjsunit\regress\regress-760268.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var obj = this;
var handler = {
has: function() { return false; }
}
var proxy = new Proxy(obj, handler);
Object.defineProperty(obj, "nonconf", {});
assertThrows("'nonconf' in proxy");
Issue: https://crbug.com/v8/6707
Commit: [builtins] Array.prototype.concat should set length on return value
Date(Commit): Mon, 28 Aug 2017 10:29:24 -0700
Code Review : https://chromium-review.googlesource.com/636695
Regress : test\mjsunit\regress\regress-6708.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var a = [0, 1];
a.constructor = {
[Symbol.species]: function(len) {
var arr = Array(20);
return arr;
}
};
assertEquals([0, 1], Array.prototype.concat.call(a));
Issue: https://crbug.com/739954
Commit: Fix type conversions in JSStackFrame accessors
Date(Commit): Fri, 25 Aug 2017 17:02:17 +0200
Code Review : https://chromium-review.googlesource.com/632376
Regress : test\mjsunit\regress\regress-3718.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
"use strict";
function getTypeName(receiver) {
Error.prepareStackTrace = function(e, stack) { return stack; }
var stack = (function() { return new Error().stack; }).call(receiver);
Error.prepareStackTrace = undefined;
return stack[0].getTypeName();
}
assertNull(getTypeName(undefined));
assertNull(getTypeName(null));
assertEquals("Number", getTypeName(1));
assertEquals("String", getTypeName(""));
assertEquals("Boolean", getTypeName(false));
assertEquals("Object", getTypeName({}));
assertEquals("Array", getTypeName([]));
assertEquals("Proxy", getTypeName(new Proxy({},{})));
assertEquals("Custom", getTypeName(new (function Custom(){})()));
Issue: https://crbug.com/758763
Commit: [regexp] Pass correct limit to Runtime::kRegExpSplit
Date(Commit): Fri, 25 Aug 2017 14:49:04 +0200
Code Review : https://chromium-review.googlesource.com/635588
Regress : test\mjsunit\regress\regress-758763.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const re = /./g;
function toSlowMode() { re.slow = true; }
re[Symbol.split]("abc", { valueOf: toSlowMode });
Issue: https://crbug.com/757199
Commit: Don't look at abandoned prototype maps when looking for root maps
Date(Commit): Fri, 25 Aug 2017 11:52:48 +0200
Code Review : https://chromium-review.googlesource.com/635223
Regress : test\mjsunit\regress\regress-crbug-758773.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(0).__defineGetter__(0, function() { });
Number.prototype[0] = "string";
Issue: https://crbug.com/v8/6733
Commit: [ignition] Fix return value of delete on global lexical variables
Date(Commit): Tue, 22 Aug 2017 15:18:53 -0700
Code Review : https://chromium-review.googlesource.com/627636
Regress : test\mjsunit\regress\regress-6733.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
let x;
Realm.eval(Realm.current(), "let y");
assertFalse(delete x);
assertFalse(delete y);
assertFalse(eval("delete x"));
assertFalse(eval("delete y"));
(function() {
let z;
assertFalse(delete x);
assertFalse(delete y);
assertFalse(delete z);
assertFalse(eval("delete x"));
assertFalse(eval("delete y"));
assertFalse(eval("delete z"));
})();
assertFalse(eval("let z; delete z"));
Issue: https://crbug.com/v8/6706
Commit: [regexp] Send sticky @@splits to the slow path
Date(Commit): Wed, 23 Aug 2017 10:00:32 +0200
Code Review : https://chromium-review.googlesource.com/626065
Regress : test\mjsunit\regress\regress-v8-6706.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const str = "a-b-c";
function test(re) {
assertArrayEquals(["a", "b", "c"], re[Symbol.split](str));
}
!function() {
const re = /-/y;
re.lastIndex = 1;
test(re);
}();
!function() {
const re = /-/y;
re.lastIndex = 3;
test(re);
}();
!function() {
const re = /-/y;
re.lastIndex = -1;
test(re);
}();
!function() {
const re = /-/y;
test(re);
}();
!function() {
const re = /-/g;
test(re);
}();
Issue: https://crbug.com/756332
Commit: [pattern-rewriter] Handle already-rewritten RewritableExpressions as before
Date(Commit): Thu, 17 Aug 2017 12:06:26 -0700
Code Review : https://chromium-review.googlesource.com/619506
Regress : test\mjsunit\regress\regress-crbug-756332.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
{
let z = ({x: {y} = {y: 42}} = {}) => y;
assertEquals(42, z());
}
{
let z = ({x: [y] = [42]} = {}) => y;
assertEquals(42, z());
}
Issue: https://crbug.com/756608
Commit: [builtins] Fix crash in ProxyHasProperty stub
Date(Commit): Fri, 18 Aug 2017 10:41:13 +0200
Code Review : https://chromium-review.googlesource.com/620647
Regress : test\mjsunit\regress\regress-756608.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows(function() {
'foo' in new Proxy({}, {has: 0});
}, TypeError);
Issue: https://crbug.com/v8/6409
Commit: Reland "[Compiler] Remove CompileDebugCode and EnsureBytecode and replace with Compile"
Date(Commit): Thu, 17 Aug 2017 13:40:24 +0100
Code Review : https://chromium-review.googlesource.com/613760
Regress : test\mjsunit\regress\regress-655573.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --no-always-opt --no-stress-opt
// Generate a function with a very large closure.
source = "(function() {\n"
for (var i = 0; i < 65000; i++) {
source += " var a_" + i + " = 0;\n";
}
source += " return function() {\n"
for (var i = 0; i < 65000; i++) {
source += "a_" + i + "++;\n";
}
source += "}})();\n"
eval(source);
Issue: https://crbug.com/v8/6712
Commit: Fix spec violation in Function.prototype.bind.
Date(Commit): Wed, 16 Aug 2017 13:53:05 +0200
Code Review : https://chromium-review.googlesource.com/616727
Regress : test\mjsunit\regress\regress-v8-6712.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var log = [];
function f() {}
Object.defineProperty(Function.prototype, "name", {
get() { log.push("getter"); return "ok"; }
});
delete f.name;
var b = f.bind();
assertEquals("bound ok", b.name);
assertEquals("bound ok", b.name);
assertEquals("bound ok", b.name);
assertEquals(["getter"], log);
Issue: https://crbug.com/v8/6559
Commit: Reland ^4 "[builtins] Port getting property from Proxy to CSA"
Date(Commit): Thu, 10 Aug 2017 09:09:05 +0200
Code Review : https://chromium-review.googlesource.com/609781
Regress : test\mjsunit\regress\regress-crbug-752712.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
// Proxy get trap doesn't fail when the value returned by it
// is a number.
var number = 1;
(function testFailingInvariant() {
var obj = {};
var handler = {
get: function() {}
};
var proxy = new Proxy(obj, handler);
Object.defineProperty(handler, 'get', {
get: function() {
return number;
}
});
assertThrows(function(){ proxy.property; }, TypeError);
})();
Commit: [fullcodegen] Remove --stress-fullcodegen flag.
Date(Commit): Thu, 10 Aug 2017 09:54:33 +0200
Code Review : https://chromium-review.googlesource.com/584747
Regress : test\mjsunit\regress\regress-crbug-651403.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --always-opt
function f () {
var x = "";
function g() {
try {
eval('');
return x;
} catch(e) {
}
}
return g();
}
f();
Issue: https://crbug.com/751789
Commit: [parser] Check if async function before throwing error
Date(Commit): Wed, 9 Aug 2017 11:17:55 -0700
Code Review : https://chromium-review.googlesource.com/607356
Regress : test\mjsunit\regress\regress-751789.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows(() => eval('async A=>{s.await i}'));
Issue: https://crbug.com/v8/6677
Commit: Throw errors when assigning to const variables inside with
Date(Commit): Fri, 4 Aug 2017 13:52:16 -0700
Code Review : https://chromium-review.googlesource.com/602690
Regress : test\mjsunit\regress\regress-6677.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Assignment to const variable inside with-statement should fail.
const x = 0;
assertThrows(() => { with ({}) { x = 1; } }, TypeError);
assertEquals(0, x);
assertThrows(() => { with ({}) { eval("x = 1"); } }, TypeError);
assertEquals(0, x);
// Assignment to name of named function expression inside with-statement
// should not throw (but also not succeed).
assertEquals('function', function f() {
with ({}) { f = 1 }
return typeof f;
}());
// But we should throw an exception if the assignment is itself in strict
// code.
assertEquals('function', function f() {
with ({}) {
assertThrows(function() { "use strict"; f = 1 }, TypeError);
}
return typeof f;
}());
Commit: [builtins] Fix missing check in Array.prototype.filter.
Date(Commit): Thu, 3 Aug 2017 16:50:46 +0200
Code Review : https://chromium-review.googlesource.com/600467
Regress : test\mjsunit\regress\regress-6657.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function TestArrayNonEmptySpecies() {
class MyArray extends Array {
constructor() { return [1, 2, 3]; }
}
var a = [5, 4];
a.__proto__ = MyArray.prototype;
var o = a.filter(() => true);
assertEquals([5, 4, 3], o);
assertEquals(3, o.length);
})();
(function TestArrayLeakingSpeciesInsertInCallback() {
var my_array = [];
class MyArray extends Array {
constructor() { return my_array; }
}
var a = [5, 4];
a.__proto__ = MyArray.prototype;
var o = a.filter(() => (my_array[2] = 3, true));
assertEquals([5, 4, 3], o);
assertEquals(3, o.length);
})();
(function TestArrayLeakingSpeciesRemoveInCallback() {
var my_array = [];
class MyArray extends Array {
constructor() { return my_array; }
}
var a = [5, 4, 3, 2, 1];
a.__proto__ = MyArray.prototype;
var o = a.filter(() => (my_array.length = 0, true));
assertEquals([,,,,1], o);
assertEquals(5, o.length);
})();
Issue: https://crbug.com/v8/5070
Commit: Enable --harmony-strict-legacy-accessor-builtins by default
Date(Commit): Mon, 31 Jul 2017 17:40:22 -0700
Code Review : https://chromium-review.googlesource.com/595129
Regress : test\mjsunit\regress\regress-crbug-702798.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Access any property that's also available on the global of the other realm.
this.__defineGetter__("Object", ()=>0);
__proto__ = Realm.global(Realm.create());
Object;
Issue: https://crbug.com/751109
Commit: [runtime] Properly forward the "interesting symbol" bit.
Date(Commit): Wed, 2 Aug 2017 12:40:45 +0200
Code Review : https://chromium-review.googlesource.com/597669
Regress : test\mjsunit\regress\regress-crbug-751109.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --verify-heap
(new constructor)[0] = null;
Issue: https://crbug.com/750830
Commit: Fix common misspellings
Date(Commit): Wed, 2 Aug 2017 10:23:36 +0200
Code Review : https://chromium-review.googlesource.com/595655
Regress : test\mjsunit\regress\regress-regexp-codeflush.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --gc-global
// Regression test for regexp that has multiple matches and which
// internally calls RegExpImpl::IrregexpExecOnce more than once without
// ensuring that the regexp is compiled.
// This can create a crash if the code was exchanged with the sweep
// generation (for code flushing support) in GC during the matching.
var re = new RegExp('(s)', "g");
function foo() {
return "42";
}
// Run enough times to get a number of GC's (all mark sweep because of the
// --gc_global) flag.
for ( var i = 0; i < 10; i++) {
// Make a long string with plenty of matches for re.
var x = "s foo s bar s foo s bar s";
x = x + x;
x = x + x;
x = x + x;
x = x + x;
x = x + x;
x = x + x;
x = x + x;
x.replace(re, foo);
}
Issue: https://crbug.com/740591
Commit: Properly fix-up ClassLiterals in ReparentExpressionScope()
Date(Commit): Thu, 27 Jul 2017 10:50:50 -0700
Code Review : https://chromium-review.googlesource.com/588054
Regress : test\mjsunit\regress\regress-crbug-740591.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function regressionCaseOne() {
var c;
for (let [a, b = c = function() { return a + b }] of [[0]]) {
function f() { return a };
}
c();
})();
(function testForInFunction() {
for (const {length: a, b = function() { return a, b }} in {foo: 42}) {
assertSame(b, (function() { return b() })());
}
})();
(function testForOfFunction() {
for (const [a, b = function() { return a, b }] of [[42]]) {
assertSame(b, (function() { return b() })());
}
})();
(function testForInVariableProxy() {
for (const {length: a, b = a} in {foo: 42}) {
assertEquals(3, a);
assertEquals(a, b);
}
})();
(function testForOfVariableProxy() {
for (const [a, b = a] of [[42]]) {
assertEquals(42, a);
assertEquals(a, b);
}
})();
(function testClassLiteral() {
for (let { a, b = class c { static f() { return a, b } } } of [{}]) {
assertSame(b, (function() { return b.f() })());
}
})();
// Methods in class literals remain inside the
// class scope after scope reparenting.
(function testClassLiteralMethod() {
for (let { a, b = class c { m() { return c } } } of [{}]) {
assertSame(b, (function() { return (new b).m() })());
}
})();
// Function literals in computed class names remain inside the
// class scope after scope reparenting.
(function testClassLiteralComputedName() {
let d;
for (let { a, b = class c { [d = function() { return c }]() { } } } of [{}]) {
assertSame(b, (function() { return b, d() })());
}
})();
// Function literals in class extends expressions names remain inside the
// class scope after scope reparenting.
(function testClassLiteralComputedName() {
let d;
for (let { a, b = class c extends (d = function() { return c }, Object) { } } of [{}]) {
assertSame(b, (function() { return b, d() })());
}
})();
Issue: https://crbug.com/748539
Commit: [runtime] Don't create class field types for arrays' fields.
Date(Commit): Wed, 26 Jul 2017 16:16:24 +0200
Code Review : https://chromium-review.googlesource.com/586709
Regress : test\mjsunit\regress\regress-crbug-748539.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f1() {}
function f2() {}
var o1 = [];
o1.a = 0;
o1.f = f1;
%HeapObjectVerify(o1);
var o2 = [];
o2.a = 4.2;
o2.f = f2;
%HeapObjectVerify(o2);
o1.a;
%HeapObjectVerify(o1);
%HeapObjectVerify(o2);
Issue: https://crbug.com/v8/6148
Commit: [builtins] Increase the maximum string length on 64-bit platforms.
Date(Commit): Thu, 20 Jul 2017 15:08:39 +0200
Code Review : https://chromium-review.googlesource.com/570047
Regress : test\mjsunit\regress\regress-crbug-740398.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var longString = (function() {
return "a".repeat(%StringMaxLength());
})();
assertThrows(() => { return { get[longString]() { } } }, RangeError);
assertThrows(() => { return { set[longString](v) { } } }, RangeError);
assertThrows(() => { return { [Symbol(longString)]: () => {} } }, RangeError);
Issue: https://crbug.com/738763
Commit: [runtime] Don't track "class" field types for arrays with properties.
Date(Commit): Fri, 21 Jul 2017 17:58:06 +0200
Code Review : https://chromium-review.googlesource.com/581647
Regress : test\mjsunit\regress\regress-crbug-738763.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --verify-heap --allow-natives-syntax --expose-gc
let constant = { a: 1 };
function update_array(array) {
array.x = constant;
%HeapObjectVerify(array);
array[0] = undefined;
%HeapObjectVerify(array);
return array;
}
let ar1 = [1];
let ar2 = [2];
let ar3 = [3];
gc();
gc();
update_array(ar1);
constant = update_array(ar2);
update_array(ar3);
Issue: https://crbug.com/722783
Commit: [ic] Properly handle reconfiguring of a global property to 'readonly'.
Date(Commit): Thu, 20 Jul 2017 12:00:17 +0200
Code Review : https://chromium-review.googlesource.com/579268
Regress : test\mjsunit\regress\regress-crbug-722783.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function set_x(v) {
x = v;
}
var o = {};
set_x(o);
set_x(o);
assertEquals(o, x);
Object.defineProperty(this, "x", { value:5, writable:false, configurable:true });
assertEquals(5, x);
set_x(o);
set_x(o);
assertEquals(5, x);
Object.defineProperty(this, "x", { value:42, writable:true, configurable:true });
assertEquals(42, x);
set_x(o);
assertEquals(o, x);
Commit: Don't add dependencies on prototype chain when inlining forEach
Date(Commit): Mon, 17 Jul 2017 14:26:57 +0200
Code Review : https://chromium-review.googlesource.com/574175
Regress : test\mjsunit\regress\regress-740784.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --expose-gc --turbo-inline-array-builtins
"".stack;;var isNeverOptimize;var isAlwaysOptimize;var isInterpreted;var isOptimized;var isCrankshafted;var isTurboFanned;var failWithMessage;(function(){{;}
function PrettyPrint(){switch(typeof value){case"string":return JSON.stringify();case"number":if(1/value<0);case"object":if(value===null);switch(objectClass){case"Number":case"String":case"Boolean":case"Date":return objectClass+"("+PrettyPrint();return objectClass+"(["+joined+"])";case"Object":break;default:return objectClass+"()";}
var name=value.constructor.name;if(name)return name+"()";return"Object()";default:return"-- unknown value --";}}
function fail(){var message="Fail"+"ure";if(name_opt){message+=" ("+name_opt+")";}
return true;}
assertSame=function assertSame(){if(found===expected){return;}else if((expected!==expected)&&(found!==found)){return;}
};assertThrows=function assertThrows(code){try{if(typeof code==='function'){code();}else{;}}catch(e){if(typeof type_opt==='function'){;}else if(type_opt!==void 0){;}
return;}
;;}
isTurboFanned=function isTurboFanned(){opt_status&V8OptimizationStatus.kOptimized!==0;}})();
function __isPropertyOfType(){let desc;try{;}catch(e){return false;}
return false;return typeof type==='undefined'||typeof desc.value===type;}
function __getProperties(obj){if(typeof obj==="undefined"||obj===null)
return[];let properties=[];for(let name of Object.getOwnPropertyNames(obj)){
properties.push(name);}
let proto=Object.getPrototypeOf(obj);while(proto&&proto!=Object.prototype){Object.getOwnPropertyNames(proto).forEach(name=>{if(name!=='constructor'){__isPropertyOfType()
;}});proto=Object.getPrototypeOf(proto);}
return properties;}
function*__getObjects(root=this,level=0){if(level>4)
return;let obj_names=__getProperties(root);for(let obj_name of obj_names){let obj=root[obj_name];if(obj===root)
continue;yield obj;yield*__getObjects();}}
function __getRandomObject(){let objects=[];for(let obj of __getObjects()){;}
return objects[seed%objects.length];}
for (var __v_0 = 0; __v_0 < 2000; __v_0++) {
Object.prototype['X'+__v_0] = true;
}
assertThrows(function() { ; try { __getRandomObject(); } catch(e) {; };try {; } catch(e) {; } });
Issue: https://crbug.com/636914
Commit: [cleanup] Remove always-off support for tail calls
Date(Commit): Thu, 13 Jul 2017 11:06:15 -0700
Code Review : https://chromium-review.googlesource.com/569069
Regress : test\mjsunit\regress\regress-593299.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
"use strict";
function h(global) { return global.boom(); }
function g() { var r = h({}); return r; }
function f() {
var o = {};
o.__defineGetter__('prop1', g);
o.prop1;
}
assertThrows(f);
Commit: [Compiler] Remove unnecessary UseTurboFan function and turbo_asm flag.
Date(Commit): Thu, 13 Jul 2017 17:26:18 +0100
Code Review : https://chromium-review.googlesource.com/568484
Regress : test\mjsunit\compiler\regress-445732.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
"use asm";
%NeverOptimizeFunction(f);
function f() { }
f();
Issue: https://crbug.com/v8/6408
Commit: Reland "[flags] Remove some dead Crankshaft flags."
Date(Commit): Thu, 13 Jul 2017 13:22:37 +0200
Code Review : https://chromium-review.googlesource.com/569963
Regress : test\mjsunit\regress\regress-crbug-498022.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --debug-code
"use strict";
class Base {
}
class Derived extends Base {
constructor() {
eval();
}
}
assertThrows("new Derived()", ReferenceError);
Issue: https://crbug.com/740803
Commit: [scope] Null out rare_data_ when aborting preparsing
Date(Commit): Wed, 12 Jul 2017 12:55:51 -0700
Code Review : https://chromium-review.googlesource.com/568784
Regress : test\mjsunit\regress\regress-crbug-740803.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
({
m() {
x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
x;
}
})
Commit: [string] Handle two-byte contents in String.p.toLowerCase
Date(Commit): Tue, 11 Jul 2017 11:50:23 +0200
Code Review : https://chromium-review.googlesource.com/565559
Regress : test\mjsunit\regress\regress-crbug-736451.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-externalize-string --no-stress-opt
!function() {
const s0 = "external string turned into two byte";
const s1 = s0.substring(1);
externalizeString(s0, true);
s1.toLowerCase();
}();
Commit: [cleanup] Move mjsunit regression tests into test/mjsunit/regress
Date(Commit): Tue, 11 Jul 2017 11:21:12 +0200
Code Review : https://chromium-review.googlesource.com/566820
Regress : test\mjsunit\regress\regress-6223.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var ab = new Int8Array(20).map((v, i) => i).buffer;
var ta = new Int8Array(ab, 0, 10);
var seen_length = -1;
ta.constructor = {
[Symbol.species]: function(len) {
seen_length = len;
return new Int8Array(ab, 1, len);
}
};
assertEquals(-1, seen_length);
assertArrayEquals([0,1,2,3,4,5,6,7,8,9], ta);
var tb = ta.slice();
assertEquals(10, seen_length);
assertArrayEquals([0,0,0,0,0,0,0,0,0,0], ta);
assertArrayEquals([0,0,0,0,0,0,0,0,0,0], tb);
Commit: [wasm] Improve precision of slow DCHECK for WebAssembly-constructed internal objects.
Date(Commit): Mon, 10 Jul 2017 06:49:34 -0700
Regress : test\mjsunit\asm\regress-740325.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
assertTrue = function assertTrue() { }
assertFalse = function assertFalse() { }
__v_3 = [];
__v_2 = [];
__v_0 = 0;
__v_2.__defineGetter__(0, function() {
if (__v_0++ > 2) return;
gc();
__v_3.concat(__v_2);
});
__v_2[0];
function __f_2() {
}
(function __f_1() {
print("1...");
function __f_5(stdlib, imports) {
"use asm";
var __f_2 = imports.__f_2;
function __f_3(a) {
a = a | 0;
}
return { __f_3:__f_3 };
}
var __v_2 = __f_5(this, { __f_2:__f_2 });
;
})();
(function __f_10() {
print("2...");
function __f_5() {
"use asm";
function __f_3(a) {
}
}
var __v_2 = __f_5();
assertFalse();
})();
(function __f_11() {
print("3...");
let m = (function __f_6() {
function __f_5() {
"use asm";
function __f_3() {
}
return { __f_3:__f_3 };
}
var __v_2 = __f_5( { __f_2:__f_2 });
});
for (var i = 0; i < 30; i++) {
print(" i = " + i);
var x = m();
for (var j = 0; j < 200; j++) {
try {
__f_5;
} catch (e) {
}
}
x;
}
})();
Issue: https://crbug.com/737645
Commit: [runtime] Fix Array.prototype.sort for large entries
Date(Commit): Thu, 6 Jul 2017 10:26:19 +0200
Code Review : https://chromium-review.googlesource.com/558868
Regress : test\mjsunit\regress\regress-crbug-737645.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
for (let i = 0; i < 100; i++) {
// - length > 2 to trigger sorting.
// - key > kRequiresSlowElementsLimit required to set the according bit on the
// dictionary elements store.
let key = 1073741800 + i;
var a = { length: 12, 1: 0xFA, [key]: 0xFB };
%HeapObjectVerify(a);
assertEquals(["1", ""+key, "length"], Object.keys(a));
// Sort, everything > length is ignored.
Array.prototype.sort.call(a);
%HeapObjectVerify(a);
assertEquals(["0", ""+key, "length"], Object.keys(a));
// Sorting again to trigger bug caused by not setting requires_slow_elements
Array.prototype.sort.call(a);
%HeapObjectVerify(a);
assertEquals(["0", ""+key, "length"], Object.keys(a));
}
Commit: [elements] Rename HasElements and IsElementsKind methods
Date(Commit): Fri, 30 Jun 2017 20:00:44 +0200
Code Review : https://chromium-review.googlesource.com/558356
Regress : test\mjsunit\regress\regress-smi-only-concat.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --allow-natives-syntax
// This tests that concatenating a fast smi-only array and a fast object array
// results in a fast object array.
var fast_array = ['a', 'b'];
var array = fast_array.concat(fast_array);
assertTrue(%HasObjectElements(fast_array));
assertTrue(%HasObjectElements(array));
Commit: [elements] Rename FAST elements kinds
Date(Commit): Fri, 30 Jun 2017 13:26:14 +0200
Code Review : https://chromium-review.googlesource.com/556032
Regress : test\mjsunit\regress\regress-648373-sloppy-arguments-includesValues.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --expose-gc
function getRandomProperty(v, rand) { var properties = Object.getOwnPropertyNames(v); var proto = Object.getPrototypeOf(v); if (proto) {; } if ("constructor" && v.constructor.hasOwnProperty()) {; } if (properties.length == 0) { return "0"; } return properties[rand % properties.length]; }
var __v_4 = {};
__v_2 = {
PACKED_ELEMENTS() {
return {
get 0() {
} };
} ,
Arguments: {
FAST_SLOPPY_ARGUMENTS_ELEMENTS() {
var __v_11 = (function( b) { return arguments; })("foo", NaN, "bar");
__v_11.__p_2006760047 = __v_11[getRandomProperty( 2006760047)];
__v_11.__defineGetter__(getRandomProperty( 1698457573), function() { gc(); __v_4[ 1486458228] = __v_2[ 1286067691]; return __v_11.__p_2006760047; });
;
Array.prototype.includes.call(__v_11);
},
Detached_Float64Array() {
} }
};
function __f_3(suites) {
Object.keys(suites).forEach(suite => __f_4(suites[suite]));
function __f_4(suite) {
Object.keys(suite).forEach(test => suite[test]());
}
}
__f_3(__v_2);
Issue: https://crbug.com/v8/6509
Commit: [ast] AstTraversalVisitor should visit the Declarations of Block scopes
Date(Commit): Thu, 29 Jun 2017 10:19:41 -0700
Code Review : https://chromium-review.googlesource.com/556239
Regress : test\mjsunit\regress\regress-6509.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function testSloppy() {
var arrow = (sth = (function f() {
{
function f2() { }
}
})()) => 0;
assertEquals(0, arrow());
})();
(function testStrict() {
"use strict";
var arrow = (sth = (function f() {
{
function f2() { }
}
})()) => 0;
assertEquals(0, arrow());
})();
Commit: [turbofan] Remove --turbo shorthand for --turbo-filter.
Date(Commit): Thu, 22 Jun 2017 15:46:04 +0200
Code Review : https://chromium-review.googlesource.com/528121
Regress : test\mjsunit\regress\regress-crbug-651403-global.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --always-opt
x = "";
function f () {
function g() {
try {
eval('');
return x;
} catch(e) {
}
}
return g();
}
f();
Date(Commit): Thu, 22 Jun 2017 05:19:26 -0700
Regress : test\mjsunit\regress\regress-refreeze-same-map.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
// precondition
assertTrue(%HaveSameMap(Object.freeze({}), Object.freeze({})));
assertTrue(%HaveSameMap(Object.freeze({a: 1}), Object.freeze({a: 1})));
assertTrue(%HaveSameMap(Object.freeze([]), Object.freeze([])));
assertTrue(%HaveSameMap(Object.freeze([1,2]), Object.freeze([1,2])));
assertTrue(%HaveSameMap(Object.seal({}), Object.seal({})));
assertTrue(%HaveSameMap(Object.seal({a: 1}), Object.seal({a: 1})));
assertTrue(%HaveSameMap(Object.seal([]), Object.seal([])));
assertTrue(%HaveSameMap(Object.seal([1,2]), Object.seal([1,2])));
// refreezing an already frozen obj does not keep adding transitions
assertTrue(%HaveSameMap(Object.freeze({}), Object.freeze( Object.freeze({}) )));
assertTrue(%HaveSameMap(Object.freeze({a: 1}), Object.freeze( Object.freeze({a: 1}) )));
assertTrue(%HaveSameMap(Object.freeze([]), Object.freeze( Object.freeze([]) )));
assertTrue(%HaveSameMap(Object.freeze([1,2]), Object.freeze( Object.freeze([1,2]) )));
// resealing a sealed object is idempotent
assertTrue(%HaveSameMap(Object.seal({}), Object.seal( Object.seal({}) )));
assertTrue(%HaveSameMap(Object.seal({a: 1}), Object.seal( Object.seal({a: 1}) )));
assertTrue(%HaveSameMap(Object.seal([]), Object.seal( Object.seal([]) )));
assertTrue(%HaveSameMap(Object.seal([1,2]), Object.seal( Object.seal([1,2]) )));
// sealing a frozen object is idempotent
assertTrue(%HaveSameMap(Object.freeze({}), Object.seal( Object.freeze({}) )));
assertTrue(%HaveSameMap(Object.freeze({a: 1}), Object.seal( Object.freeze({a: 1}) )));
assertTrue(%HaveSameMap(Object.freeze([]), Object.seal( Object.freeze([]) )));
assertTrue(%HaveSameMap(Object.freeze([1,2]), Object.seal( Object.freeze([1,2]) )));
// freezing a sealed empty is idempotent
assertTrue(%HaveSameMap(Object.freeze(Object.seal({})), Object.seal({})));
// sealing a unextensible empty object is idempotent
assertTrue(%HaveSameMap(Object.seal(Object.preventExtensions({})), Object.preventExtensions({})));
Issue: https://crbug.com/720247
Commit: [scopes] Fix sloppy-mode block-scoped function hoisting edge case
Date(Commit): Thu, 22 Jun 2017 09:49:08 +0200
Code Review : https://chromium-review.googlesource.com/529230
Regress : test\mjsunit\regress\regress-720247.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertEquals('function', typeof (function() {
return eval('with ({a: 1}) { function a() {} }; a')
})());
Issue: https://crbug.com/726625
Commit: [parser] Treat \ufffe as non-whitespace.
Date(Commit): Mon, 12 Jun 2017 14:29:15 +0200
Code Review : https://chromium-review.googlesource.com/530849
Regress : test\mjsunit\regress\regress-726625.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function abc() { return; }
assertThrows("abc" + String.fromCharCode(65534) + "(1)");
Issue: https://crbug.com/734162
Commit: [literals] Perform a deep boilerplate copy for MutableHeapNumber fields
Date(Commit): Tue, 20 Jun 2017 11:52:17 +0200
Code Review : https://chromium-review.googlesource.com/541415
Regress : test\mjsunit\regress\regress-crbug-734162.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function TestSmi() {
var v_0 = {};
function f_0(constructor, closure) {
var v_2 = { value: 0 };
v_4 = closure(constructor, 1073741823, v_0, v_2);
assertEquals(1, v_2.value);
}
function f_1(constructor, val, deopt, v_2) {
if (!new constructor(val, deopt, v_2)) {
}
}
function f_10(constructor) {
f_0(constructor, f_1);
f_0(constructor, f_1);
f_0(constructor, f_1);
}
function f_12(val, deopt, v_2) {
v_2.value++;
}
f_10(f_12);
})();
(function TestHeapNumber() {
var v_0 = {};
function f_0(constructor, closure) {
var v_2 = { value: 1.5 };
v_4 = closure(constructor, 1073741823, v_0, v_2);
assertEquals(2.5, v_2.value);
}
function f_1(constructor, val, deopt, v_2) {
if (!new constructor(val, deopt, v_2)) {
}
}
function f_10(constructor) {
f_0(constructor, f_1);
f_0(constructor, f_1);
f_0(constructor, f_1);
}
function f_12(val, deopt, v_2) {
v_2.value++;
}
f_10(f_12);
})();
Issue: https://crbug.com/731193
Commit: [ic] Fix stub-cached access to use the dereffed thin-string.
Date(Commit): Mon, 19 Jun 2017 13:49:35 +0200
Code Review : https://chromium-review.googlesource.com/539596
Regress : test\mjsunit\regress\regress-crbug-731193.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f() {
}
// Make prototype of f go dictionary-mode.
for (var i = 0; i < 10000; i++) {
f.prototype["b" + i] = 1;
}
var o = new f();
function access(o, k) {
return o[k];
}
// Create a thin string.
var p = "b";
p += 10001;
assertEquals(undefined, access(o, p));
assertEquals(undefined, access(o, p));
assertEquals(undefined, access(o, p));
f.prototype[p] = 100;
assertEquals(100, access(o, p));
Issue: https://crbug.com/733059
Commit: [heap] Fix adjusting of area end when shrinking large pages
Date(Commit): Wed, 14 Jun 2017 16:32:12 +0200
Code Review : https://chromium-review.googlesource.com/535596
Regress : test\mjsunit\regress\regress-733059.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --enable-slow-asserts
a = new Proxy([], {
defineProperty() {
b.length = 1; gc();
return Object.defineProperty.apply(this, arguments);
}
});
class MyArray extends Array {
static get[Symbol.species](){
return function() {
return a;
}
};
}
b = new MyArray(65535);
b[1] = 0.1;
c = Array.prototype.concat.call(b);
gc();
Issue: https://crbug.com/707580
Date(Commit): Thu, 8 Jun 2017 14:16:58 +0200
Code Review : https://chromium-review.googlesource.com/528077
Regress : test\mjsunit\regress\regress-crbug-707580.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var thrower = { [Symbol.toPrimitive] : function() { throw "I was called!" } };
var heap_number = 4.2;
var smi_number = 23;
assertThrows(() => heap_number.hasOwnProperty(thrower));
assertThrows(() => smi_number.hasOwnProperty(thrower));
Issue: https://crbug.com/v8/6471
Commit: [runtime] Drop PrototypeOptimizationMode to unify prototype handling
Date(Commit): Wed, 7 Jun 2017 16:33:27 +0200
Code Review : https://chromium-review.googlesource.com/526596
Regress : test\mjsunit\regress\regress-put-prototype-transition.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --expose-gc --stress-compaction --gc-interval=255
function deepEquals(a, b) { if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; } if (typeof a != typeof b) return false; if (typeof a == "number") return isNaN(a) && isNaN(b); if (typeof a !== "object" && typeof a !== "function") return false; var objectClass = classOf(a); if (objectClass !== classOf(b)) return false; if (objectClass === "RegExp") { return (a.toString() === b.toString()); } if (objectClass === "Function") return false; if (objectClass === "Array") { var elementCount = 0; if (a.length != b.length) { return false; } for (var i = 0; i < a.length; i++) { if (!deepEquals(a[i], b[i])) return false; } return true; } if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") { if (a.valueOf() !== b.valueOf()) return false; } return deepObjectEquals(a, b); }
assertSame = function assertSame(expected, found, name_opt) { if (found === expected) { if (expected !== 0 || (1 / expected) == (1 / found)) return; } else if ((expected !== expected) && (found !== found)) { return; } fail(PrettyPrint(expected), found, name_opt); }; assertEquals = function assertEquals(expected, found, name_opt) { if (!deepEquals(found, expected)) { fail(PrettyPrint(expected), found, name_opt); } };
assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) { assertTrue(Math.abs(expected - found) <= delta, name_opt); }; assertArrayEquals = function assertArrayEquals(expected, found, name_opt) { var start = ""; if (name_opt) { start = name_opt + " - "; } assertEquals(expected.length, found.length, start + "array length"); if (expected.length == found.length) { for (var i = 0; i < expected.length; ++i) { assertEquals(expected[i], found[i], start + "array element at index " + i); } } };
assertTrue = function assertTrue(value, name_opt) { assertEquals(true, value, name_opt); };
assertFalse = function assertFalse(value, name_opt) { assertEquals(false, value, name_opt); };
// End stripped down and modified version of mjsunit.js.
var __v_0 = {};
var __v_1 = {};
function __f_3() { }
function __f_4(obj) {
for (var __v_2 = 0; __v_2 < 26; __v_2++) {
obj["__v_5" + __v_2] = 0;
}
}
function __f_0(__v_1, __v_6) {
(new __f_3()).__proto__ = __v_1;
}
%DebugPrint(undefined);
function __f_1(__v_4, add_first, __v_6, same_map_as) {
var __v_1 = __v_4 ? new __f_3() : {};
assertTrue(__v_4 || %HasFastProperties(__v_1));
if (add_first) {
__f_4(__v_1);
assertFalse(%HasFastProperties(__v_1));
__f_0(__v_1, __v_6);
assertFalse(%HasFastProperties(__v_1));
} else {
__f_0(__v_1, __v_6);
assertTrue(__v_4 || !%HasFastProperties(__v_1));
__f_4(__v_1);
assertTrue(__v_4 || !%HasFastProperties(__v_1));
}
}
gc();
for (var __v_2 = 0; __v_2 < 4; __v_2++) {
var __v_6 = ((__v_2 & 2) != 7);
var __v_4 = ((__v_2 & 2) != 0);
__f_1(__v_4, true, __v_6);
var __v_0 = __f_1(__v_4, false, __v_6);
__f_1(__v_4, false, __v_6, __v_0);
}
__v_5 = {a: 1, b: 2, c: 3};
Date(Commit): Wed, 7 Jun 2017 08:39:56 -0700
Regress : test\mjsunit\compiler\regress-729369.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function* f() {
x.__defineGetter__();
var x = 0;
for (let y of iterable) {
yield y;
}
}
f();
Commit: Fix Array.indexOf for Proxies that throw
Date(Commit): Wed, 7 Jun 2017 13:51:42 +0200
Code Review : https://chromium-review.googlesource.com/527173
Regress : test\mjsunit\regress\regress-crbug-728813.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var p = new Proxy({}, {
has: function () { throw "nope"; }
});
p.length = 2;
assertThrows(() => Array.prototype.indexOf.call(p));
Commit: [json] Handle stack overflows in JSON.parse
Date(Commit): Wed, 7 Jun 2017 09:17:38 +0200
Code Review : https://chromium-review.googlesource.com/525812
Regress : test\mjsunit\regress\regress-729671.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var o = { 0: 11, 1: 9};
assertThrows(() => JSON.parse('[0,0]', function() { this[1] = o; }), RangeError);
Commit: [arm] Clean up disabling of sharing code target entries.
Date(Commit): Thu, 1 Jun 2017 06:18:21 -0700
Regress : test\mjsunit\compiler\regress-725743.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --no-turbo --cache=code --no-lazy
function f() {
var n = a.length;
for (var i = 0; i < n; i++) {
}
for (var i = 0; i < n; i++) {
}
}
var a = "xxxxxxxxxxxxxxxxxxxxxxxxx";
while (a.length < 100000) a = a + a;
f();
Commit: [asm.js] Fix associativity of multiplicative expressions.
Date(Commit): Thu, 1 Jun 2017 13:17:59 +0200
Code Review : https://chromium-review.googlesource.com/520945
Regress : test\mjsunit\asm\regress-719866.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function Module(stdlib) {
"use asm";
function f(a,b,c) {
a = +a;
b = +b;
c = +c;
var r = 0.0;
r = a / b * c;
return +r;
}
return { f:f }
}
var m = Module(this);
assertEquals(16, m.f(32, 4, 2));
Issue: https://crbug.com/v8/6447
Commit: [tests] Fix typo in Flags value.
Date(Commit): Wed, 31 May 2017 10:17:06 +0200
Code Review : https://chromium-review.googlesource.com/518823
Regress : test\mjsunit\regress\regress-543994.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --always-opt --gc-interval=163 --stress-compaction
try { a = f();
} catch(e) {
}
var i = 0;
function f() {
try {
f();
} catch(e) {
i++;
[];
}
}
f();
Commit: [parser] Disable aborting preparsing for arrow functions.
Date(Commit): Tue, 30 May 2017 15:30:48 +0200
Code Review : https://chromium-review.googlesource.com/518145
Regress : test\mjsunit\regress\regress-727218.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var f = ({ x } = { x: y }) => {
x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
};
Issue: https://crbug.com/723366
Commit: [ic] Properly handle the case when all receiver maps are deprecated.
Date(Commit): Mon, 29 May 2017 18:58:49 +0200
Code Review : https://chromium-review.googlesource.com/517952
Regress : test\mjsunit\regress\regress-723366.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var o = {foo: 0, 0: 0, 2: 2, 3: 3};
o.__defineSetter__("1", function(v) { this.foo = 0.1; });
for(var i = 0; i < 4; i++) {
switch (i) {
case 0: o.p1 = 0; break;
case 1: o.p2 = 0; break;
}
o[i] = i;
}
Issue: https://crbug.com/725537
Commit: [runtime] Set proper initial map for AsyncFunction constructor.
Date(Commit): Fri, 26 May 2017 19:19:03 +0200
Code Review : https://chromium-review.googlesource.com/517087
Regress : test\mjsunit\regress\regress-crbug-725537.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --verify-heap
const AsyncFunction = async function(){}.constructor;
class MyAsync extends AsyncFunction {}
var af = new MyAsync();
gc();
Issue: https://crbug.com/726636
Commit: [Promise] Add smi check for species constructor
Date(Commit): Fri, 26 May 2017 02:59:26 -0700
Code Review : https://chromium-review.googlesource.com/516734
Regress : test\mjsunit\regress\regress-726636.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --allow-natives-syntax
Object.defineProperty(Promise, Symbol.species, { value: 0 });
var p = new Promise(function() {});
try {
p.then();
assertUnreachable();
} catch(e) {
assertTrue(e instanceof TypeError);
}
Commit: [test] add mjsunit regression tests for v8:6322
Date(Commit): Wed, 24 May 2017 14:34:20 -0400
Code Review : https://chromium-review.googlesource.com/514230
Regress : test\mjsunit\es6\regress\regress-6322.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Crash with --verify-heap
(function*() { for (let { a = class b { } } of [{}]) { } })().next();
(function() { for (let { a = class b { } } of [{}]) { } })();
(function() { var a; for ({ a = class b { } } of [{}]) { } })();
(function() { for (let [a = class b { } ] = [[]]; ;) break; })();
(function() { var a; for ([a = class b { } ] = [[]]; ;) break; })();
Issue: https://crbug.com/723132
Commit: [parser] Stop treating generators as "top level" for preparsing purposes
Date(Commit): Wed, 17 May 2017 15:20:17 -0700
Code Review : https://chromium-review.googlesource.com/508055
Regress : test\mjsunit\regress\regress-crbug-723132.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function outer() {
function* generator() {
let arrow = () => {
assertSame(expectedReceiver, this);
assertEquals(42, arguments[0]);
};
arrow();
}
generator.call(this, 42).next();
}
let expectedReceiver = {};
outer.call(expectedReceiver);
Issue: https://crbug.com/722978
Commit: Reland "[compiler] Delay allocation of heap numbers for deoptimization literals."
Date(Commit): Wed, 17 May 2017 13:51:24 +0200
Code Review : https://chromium-review.googlesource.com/507207
Regress : test\mjsunit\regress\regress-722978.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --always-opt
var __v_3 = {};
function __f_0() {
var __v_30 = -0;
__v_30.__defineGetter__("0", function() { return undefined; });
__v_30 = 0;
__v_3 = 0;
assertTrue(Object.is(0, __v_30));
}
__f_0();
Issue: https://crbug.com/v8/6251
Commit: [runtime] Keep FAST_SLOPPY_ARGUMENTS packed
Date(Commit): Thu, 27 Apr 2017 14:58:19 +0200
Code Review : https://chromium-review.googlesource.com/486921
Regress : test\mjsunit\regress\regress-645680.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --allow-natives-syntax
function getRandomProperty(v, rand) {
var properties = Object.getOwnPropertyNames(v);
if ("constructor" && v.constructor.hasOwnProperty()) {; }
if (properties.length == 0) { return "0"; }
return properties[rand % properties.length];
}
var args = (function( b) { return arguments; })("foo", NaN, "bar");
args.__p_293850326 = "foo";
%HeapObjectVerify(args);
args.__defineGetter__(getRandomProperty( 990787501), function() {
gc();
return args.__p_293850326;
});
%HeapObjectVerify(args);
Array.prototype.indexOf.call(args)
Commit: [runtime] MigrateFastToFast: fix check for unboxed inobject doubles
Date(Commit): Fri, 5 May 2017 15:23:04 -0700
Regress : test\mjsunit\regress\regress-crbug-718779.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function __f_1()
{
__v_1.p2 = 2147483648;
__v_1.p3 = 3;
__v_1.p4 = 4;
__v_1.p5 = 2147483648;
__v_1.p6 = 6;
}
function __f_2()
{
delete __v_1.p6;
delete __v_1.p5;
}
var __v_1 = { };
__f_1(__v_1);
__f_2(__v_1);
__f_1(__v_1);
Commit: [asm.js] Fix checking of "fround" in parameter annotation.
Date(Commit): Fri, 5 May 2017 13:02:06 +0200
Code Review : https://chromium-review.googlesource.com/497469
Regress : test\mjsunit\asm\regress-718745.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function Module(stdlib) {
"use asm";
var fround = stdlib.Math.fround;
function f(a) {
a = (fround(a));
}
return { f:f };
}
Module(this).f();
Issue: https://crbug.com/718285
Commit: [builtins] Use the byte_length for byte length, not byte_offset.
Date(Commit): Fri, 5 May 2017 11:27:58 +0200
Code Review : https://chromium-review.googlesource.com/497727
Regress : test\mjsunit\regress\regress-718285.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function foo_reference(n) {
var array = new Int32Array(n + 1);
for (var i = 0; i < n; ++i) {
array[i] = i;
}
var array2 = new Int32Array(array);
array2.set(new Uint8Array(array.buffer, 0, n), 1);
return array2;
}
function foo(n) {
var array = new Int32Array(n + 1);
for (var i = 0; i < n; ++i) {
array[i] = i;
}
array.set(new Uint8Array(array.buffer, 0, n), 1);
return array;
}
function bar_reference(n) {
var array = new Int32Array(n + 1);
for (var i = 0; i < n; ++i) {
array[i] = i;
}
var array2 = new Int32Array(array);
array2.set(new Uint8Array(array.buffer, 34), 0);
return array2;
}
function bar(n) {
var array = new Int32Array(n + 1);
for (var i = 0; i < n; ++i) {
array[i] = i;
}
array.set(new Uint8Array(array.buffer, 34), 0);
return array;
}
foo(10);
foo_reference(10);
bar(10);
bar_reference(10);
Commit: Fix FastAssign for self-assignment
Date(Commit): Thu, 4 May 2017 06:41:08 -0700
Regress : test\mjsunit\regress\regress-crbug-716520.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var __v_0 = {};
var __v_8 = this;
var __v_11 = -1073741825;
__v_1 = this;
try {
} catch(e) {; }
function __f_4() {}
__f_4.prototype = __v_0;
function __f_9() { return new __f_4().v; }
__f_9(); __f_9();
try {
(function() {
})();
} catch(e) {; }
Object.assign(__v_0, __v_1, __v_0);
(function() {
})();
Commit: Move delete-last-fast-property code from CSA to C++
Date(Commit): Wed, 3 May 2017 08:50:50 -0700
Regress : test\mjsunit\regress\regress-crbug-716912.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --invoke-weak-callbacks
function __f_6() {
this.a4 = {};
}
__v_6 = new __f_6();
__v_6.prototype = __v_6;
__v_6 = new __f_6();
gc();
gc();
buf = new ArrayBuffer(8);
__v_8 = new Int32Array(buf);
__v_9 = new Float64Array(buf);
__v_8[0] = 1;
__v_6.a4 = {a: 0};
delete __v_6.a4;
__v_6.boom = __v_9[0];
Commit: Array.prototype.map write error.
Date(Commit): Wed, 3 May 2017 07:11:44 -0700
Regress : test\mjsunit\regress\regress-716044.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --verify-heap
class Array1 extends Array {
constructor(len) {
super(1);
}
};
class MyArray extends Array {
static get [Symbol.species]() {
return Array1;
}
}
a = new MyArray();
for (var i = 0; i < 100000; i++) {
a.push(1);
}
a.map(function(x) { return 42; });
Issue: https://crbug.com/v8/6337
Commit: [parser] Fix fatal error on spread in class properties
Date(Commit): Tue, 2 May 2017 10:24:32 -0700
Code Review : https://chromium-review.googlesource.com/493786
Regress : test\mjsunit\regress\regress-6337.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows(function() { eval(`class C { ...[] }`); } )
Commit: Mark Number and String as strict functions
Date(Commit): Tue, 2 May 2017 02:08:57 -0700
Regress : test\mjsunit\regress\regress-105.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
var custom_valueOf = function() {
assertEquals(null, custom_valueOf.caller);
return 2;
}
var custom_toString = function() {
assertEquals(null, custom_toString.caller);
return "I used to be an adventurer like you";
}
var object = {};
object.valueOf = custom_valueOf;
object.toString = custom_toString;
assertEquals(2, Number(object));
assertEquals('I', String(object)[0]);
Issue: https://crbug.com/716804
Commit: [ic] Fix handling of JSArray.length accessor info.
Date(Commit): Tue, 2 May 2017 10:22:28 +0200
Code Review : https://chromium-review.googlesource.com/493146
Regress : test\mjsunit\regress\regress-crbug-716804.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var v = [];
v.__proto__ = function() {};
v.prototype;
var v = [];
v.__proto__ = new Error();
v.stack;
Commit: [mjsunit] Remove non-existing flags from tests.
Date(Commit): Fri, 28 Apr 2017 15:09:31 +0200
Code Review : https://chromium-review.googlesource.com/489505
Regress : test\mjsunit\regress\regress-r4998.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Test for a broken fast-smi-loop that does not save the incremented value
// of the loop index. If this test fails, it loops forever, and times out.
// Calling foo() spills the virtual frame.
function foo() {
return;
}
function bar() {
var x1 = 3;
var x2 = 3;
var x3 = 3;
var x4 = 3;
var x5 = 3;
var x6 = 3;
var x7 = 3;
var x8 = 3;
var x9 = 3;
var x10 = 3;
var x11 = 3;
var x12 = 3;
var x13 = 3;
foo();
x1 = 257;
x2 = 258;
x3 = 259;
x4 = 260;
x5 = 261;
x6 = 262;
x7 = 263;
x8 = 264;
x9 = 265;
x10 = 266;
x11 = 267;
x12 = 268;
x13 = 269;
// The loop variable x7 is initialized to 3,
// and then MakeMergeable is called on the virtual frame.
// MakeMergeable has forced the loop variable x7 to be spilled,
// so it is marked as synced
// The back edge then merges its virtual frame, which incorrectly
// claims that x7 is synced, and does not save the modified
// value.
for (x7 = 3; x7 < 10; ++x7) {
foo();
}
}
bar();
function aliasing() {
var x = 3;
var j;
for (j = 7; j < 11; ++j) {
x = j;
}
assertEquals(10, x);
assertEquals(11, j);
}
aliasing();
Commit: Use --opt instead of --crankshaft in tests.
Date(Commit): Fri, 28 Apr 2017 14:33:43 +0100
Code Review : https://chromium-review.googlesource.com/490206
Regress : test\mjsunit\regress\regress-crbug-157520.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --noopt
(function(){
var f = function(arg) {
arg = 2;
return arguments[0];
};
for (var i = 0; i < 50000; i++) {
assertSame(2, f(1));
}
})();
Commit: [turbofan] Fix impossible type handling for TypeGuard and BooleanNot.
Date(Commit): Thu, 27 Apr 2017 04:35:15 -0700
Regress : test\mjsunit\compiler\regress-715204.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var global = true;
global = false;
function f() {
global = 1;
return !global;
}
f();
Commit: Add missing early-bailouts in ast traversal visitors
Date(Commit): Thu, 27 Apr 2017 08:31:41 +0200
Code Review : https://chromium-review.googlesource.com/487983
Regress : test\mjsunit\regress\regress-715582.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Should not crash.
//
this.__defineGetter__(
"x", (a = (function f() { return; (function() {}); })()) => { });
x;
Issue: https://crbug.com/714972
Commit: Revert behavioral part of 84dc8ed4c3e6c8c1e3005b2d2445c64328b139a4
Date(Commit): Wed, 26 Apr 2017 13:28:01 -0700
Code Review : https://chromium-review.googlesource.com/486130
Regress : test\mjsunit\regress\regress-crbug-714872.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f() {}
f.prototype = 1;
f.foo = 1;
f.prototype = {};
Commit: Reland [typedarrays] Check detached buffer at start of typed array methods
Date(Commit): Tue, 25 Apr 2017 23:10:17 -0700
Regress : test\mjsunit\regress\regress-4665.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// First test case
function FirstBuffer () {}
FirstBuffer.prototype.__proto__ = Uint8Array.prototype
FirstBuffer.__proto__ = Uint8Array
var buf = new Uint8Array(10)
buf.__proto__ = FirstBuffer.prototype
assertThrows(() => buf.subarray(2), TypeError);
// Second test case
let seen_args = [];
function SecondBuffer (arg) {
seen_args.push(arg);
var arr = new Uint8Array(arg)
arr.__proto__ = SecondBuffer.prototype
return arr
}
SecondBuffer.prototype.__proto__ = Uint8Array.prototype
SecondBuffer.__proto__ = Uint8Array
var buf3 = new SecondBuffer(10)
assertEquals([10], seen_args);
var buf4 = buf3.subarray(2)
assertEquals(10, buf4.length);
assertEquals([10, buf3.buffer], seen_args);
Commit: [asm.js] Treat typed array constructors as stdlib uses.
Date(Commit): Mon, 24 Apr 2017 14:57:28 +0200
Code Review : https://chromium-review.googlesource.com/485521
Regress : test\mjsunit\regress\regress-6280.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function Module(stdlib, imports, buffer) {
"use asm";
var x = new stdlib.Int8Array(buffer);
function f() {
return x[0] | 0;
}
return { f:f };
}
var b = new ArrayBuffer(1024);
var m1 = Module({ Int8Array:Int8Array }, {}, b);
assertEquals(0, m1.f());
var was_called = 0;
function observer() { was_called++; return [23]; }
var m2 = Module({ Int8Array:observer }, {}, b);
assertEquals(1, was_called);
assertEquals(23, m2.f());
Issue: https://crbug.com/v8/5070
Commit: Add flag to make defineGetter & co. behave as strict functions
Date(Commit): Fri, 14 Apr 2017 12:08:22 -0700
Code Review : https://chromium-review.googlesource.com/478312
Regress : test\mjsunit\regress\regress-1240.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// This regression tests that we are not allowed to overwrite an existing
// non-configurable getter with a new getter. In addition, we should not
// be able to change the configurable flag from false to true.
var a = {};
Object.defineProperty(a, 'b',
{ get: function () { return 42; }, configurable: false });
// Do not allow us to redefine b on a.
try {
a.__defineGetter__('b', function _b(){ return 'foo'; });
} catch (e) {}
assertEquals(42, a.b);
var desc = Object.getOwnPropertyDescriptor(a, 'b');
assertFalse(desc.configurable);
Issue: https://crbug.com/711165
Commit: [d8] Fix leak in IntializeModuleEmbedderData
Date(Commit): Thu, 13 Apr 2017 14:21:24 -0700
Code Review : https://chromium-review.googlesource.com/476970
Regress : test\mjsunit\regress\regress-711165.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// This is testing a leak failure.
try {
Realm.navigate(0);
} catch(e) {}
Commit: [regexp] Consider surrogate pairs when optimizing disjunctions
Date(Commit): Wed, 12 Apr 2017 02:09:12 -0700
Regress : test\mjsunit\regress\regress-641091.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertEquals(["🍤", "🍤"],
'🍤🍦🍋ππ🍋🍦🍤'.match(/🍤/ug));
assertEquals(["🍤", "🍦", "🍦", "🍤"],
'🍤🍦🍋ππ🍋🍦🍤'.match(/🍤|🍦/ug));
assertEquals(["🍤", "🍦", "🍋", "🍋", "🍦", "🍤"],
'🍤🍦🍋ππ🍋🍦🍤'.match(/🍤|🍦|🍋/ug));
assertEquals(["🍤", "🍦", "🍋", "π", "π", "🍋", "🍦", "🍤"],
'🍤🍦🍋ππ🍋🍦🍤'.match(/🍤|🍦|π|🍋/ug));
Issue: https://crbug.com/707675
Commit: [runtime] Filter out non-JSObject prototypes when eliding iteration.
Date(Commit): Mon, 10 Apr 2017 14:18:14 +0200
Code Review : https://chromium-review.googlesource.com/472907
Regress : test\mjsunit\regress\regress-707675.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --enable-slow-asserts
Array.prototype.__proto__ = null;
new Uint8Array(Array.prototype);
Commit: [regexp] Avoid side effects between map load and fast path check
Date(Commit): Mon, 10 Apr 2017 07:57:55 -0700
Regress : test\mjsunit\regress\regress-709029.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Changes the map of obj.
function mutateObjectOnStringConversion(obj) {
return { toString: () => { obj.x = 42;return "";}};
}
{
const re = /./;
re.exec(mutateObjectOnStringConversion(re));
}
{
const re = /./;
re.test(mutateObjectOnStringConversion(re));
}
{
const re = /./;
re[Symbol.match](mutateObjectOnStringConversion(re));
}
{
const re = /./;
re[Symbol.search](mutateObjectOnStringConversion(re));
}
{
const re = /./;
re[Symbol.split](mutateObjectOnStringConversion(re));
}
{
const re = /./;
re[Symbol.replace](mutateObjectOnStringConversion(re));
}
Commit: [parser] Skipping inner funcs: Fix untrue DCHECK.
Date(Commit): Mon, 10 Apr 2017 11:44:53 +0200
Code Review : https://chromium-review.googlesource.com/472826
Regress : test\mjsunit\regress\regress-708598.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Regression test for hitting a DCHECK; if we just get a syntax error, it's ok.
assertThrows(`function lazy_does_not_compile(x) {
break;
}
new lazy_does_not_compile();`, SyntaxError);
Commit: [regexp] Properly handle HeapNumbers in AdvanceStringIndex
Date(Commit): Thu, 6 Apr 2017 11:43:09 -0700
Regress : test\mjsunit\regress\regress-6209.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function testAdvanceStringIndex(lastIndex, expectedLastIndex) {
let exec_count = 0;
let last_last_index = -1;
let fake_re = {
exec: () => { return (exec_count++ == 0) ? [""] : null },
get lastIndex() { return lastIndex; },
set lastIndex(value) { last_last_index = value },
get global() { return true; },
get flags() { return "g"; }
};
assertEquals([""], RegExp.prototype[Symbol.match].call(fake_re, "abc"));
assertEquals(expectedLastIndex, last_last_index);
}
testAdvanceStringIndex(new Number(42), 43); // Value wrapper.
testAdvanceStringIndex(%AllocateHeapNumber(), 1); // HeapNumber.
testAdvanceStringIndex(4294967295, 4294967296); // HeapNumber.
Commit: [regexp] Fix two more possible shape changes on fast path
Date(Commit): Thu, 6 Apr 2017 08:52:21 -0700
Regress : test\mjsunit\regress\regress-6210.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --predictable
const str = '2016-01-02';
function testToUint32InSplit() {
var re;
function toDictMode() {
re.x = 42;
delete re.x;
return "def";
}
re = /./g; // Needs to be global to trigger lastIndex accesses.
return re[Symbol.replace]("abc", { valueOf: toDictMode });
}
function testToStringInReplace() {
var re;
function toDictMode() {
re.x = 42;
delete re.x;
return 42;
}
re = /./g; // Needs to be global to trigger lastIndex accesses.
return re[Symbol.split]("abc", { valueOf: toDictMode });
}
testToUint32InSplit();
testToStringInReplace();
Commit: [regexp] Ensure there are no shape changes on the fast path
Date(Commit): Thu, 6 Apr 2017 01:12:56 -0700
Regress : test\mjsunit\regress\regress-708247.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --predictable
const str = '2016-01-02';
function t() {
var re;
function toDictMode() {
for (var i = 0; i < 100; i++) { // Loop is required.
re.x = 42;
delete re.x;
}
return 0;
}
re = /-/g; // Needs to be global to trigger lastIndex accesses.
re.lastIndex = { valueOf : toDictMode };
return re.exec(str);
}
for (var q = 0; q < 10000; q++) {
t(); // Needs repetitions to trigger a crash.
}
Commit: [asm.js] Prevent throwing of asm.js warning messages.
Date(Commit): Wed, 5 Apr 2017 14:37:33 +0200
Code Review : https://chromium-review.googlesource.com/468808
Regress : test\mjsunit\regress\regress-6203.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function Module(stdlib, imports, buffer) {
"use asm";
var a = imports.x | 0;
function f() {
return a | 0;
}
return { f:f };
}
try {
Module(this).f();
} catch(e) {
assertInstanceof(e, TypeError);
// The following print is needed to cross the API boundary and thereby flush
// out any leftover scheduled exceptions. Any other API function would do.
print(e);
}
Date(Commit): Tue, 4 Apr 2017 15:12:52 -0400
Code Review : https://chromium-review.googlesource.com/465415
Regress : test\mjsunit\regress\regress-706234.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var fn = ({foo = {} = {}}) => { return foo; }
if (true) {
fn({});
}
Issue: https://crbug.com/v8/6186
Commit: [regexp] Handle a function Proxy passed to String.prototype.replace
Date(Commit): Mon, 3 Apr 2017 14:17:59 -0700
Code Review : https://chromium-review.googlesource.com/466549
Regress : test\mjsunit\regress\regress-6186.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertEquals("b", "a".replace(/a/, new Proxy(() => "b", {})));
Commit: [parser] Fix crash when lazy arrow func params contain destructuring assignments.
Date(Commit): Tue, 28 Mar 2017 07:53:26 +0200
Code Review : https://chromium-review.googlesource.com/459618
Regress : test\mjsunit\regress\regress-704811.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// The bug was that destructuring assignments which occur inside a lazy arrow
// function parameter list were not rewritten.
// Repro from the bug (slightly modified so that it doesn't produce a run-time
// exception).
(({x = {} = {}}) => {})({});
// ... and without the parens.
let a0 = ({x = {} = {}}) => {};
a0({});
// Testing that the destructuring assignments also work properly. The semantics
// are: The value of the destructuring assignment is an object {myprop: 2115}
// and 2115 also gets assigned to global_side_assignment. So the default value
// for x is {myprop: 2115}. This is the value which x will have if the function
// is called with an object which doesn't have property x.
let called = false;
let global_side_assignment = undefined;
(({x = {myprop: global_side_assignment} = {myprop: 2115}}) => {
assertTrue('myprop' in x);
assertEquals(2115, x.myprop);
called = true;
})({});
assertTrue(called);
assertEquals(2115, global_side_assignment);
// If the parameter is an object which has property x, the default value is not
// used.
called = false;
global_side_assignment = undefined;
(({x = {myprop: global_side_assignment} = {myprop: 2115}}) => {
assertEquals(3000, x);
called = true;
})({x: 3000});
assertTrue(called);
// Global side assignment doesn't happen, since the default value was not used.
assertEquals(undefined, global_side_assignment);
// Different kinds of lazy arrow functions (it's actually a bit weird that the
// above functions are lazy, since they are parenthesized).
called = false;
global_side_assignment = undefined;
let a1 = ({x = {myprop: global_side_assignment} = {myprop: 2115}}) => {
assertTrue('myprop' in x);
assertEquals(2115, x.myprop);
called = true;
}
a1({});
assertTrue(called);
assertEquals(2115, global_side_assignment);
called = false;
global_side_assignment = undefined;
let a2 = ({x = {myprop: global_side_assignment} = {myprop: 2115}}) => {
assertEquals(3000, x);
called = true;
}
a2({x: 3000});
assertTrue(called);
assertEquals(undefined, global_side_assignment);
// We never had a problem with non-arrow functions, but testing them too for
// completeness.
called = false;
global_side_assignment = undefined;
function f1({x = {myprop: global_side_assignment} = {myprop: 2115}}) {
assertTrue('myprop' in x);
assertEquals(2115, x.myprop);
assertEquals(2115, global_side_assignment);
called = true;
}
f1({});
assertTrue(called);
assertEquals(2115, global_side_assignment);
called = false;
global_side_assignment = undefined;
function f2({x = {myprop: global_side_assignment} = {myprop: 2115}}) {
assertEquals(3000, x);
called = true;
}
f2({x: 3000});
assertTrue(called);
assertEquals(undefined, global_side_assignment);
Commit: [parser] Use better error message to continue a non IterationStatement
Date(Commit): Sat, 25 Mar 2017 13:45:54 -0700
Code Review : https://chromium-review.googlesource.com/459436
Regress : test\mjsunit\regress\regress-6142.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
try {
eval('a: { continue a; }');
assertUnreachable();
} catch(e) {
assertTrue(e instanceof SyntaxError);
assertEquals('Illegal continue statement: \'a\' does not denote an iteration statement', e.message);
}
try {
eval('continue;');
assertUnreachable();
} catch(e) {
assertTrue(e instanceof SyntaxError);
assertEquals('Illegal continue statement: no surrounding iteration statement', e.message);
}
try {
eval('a: { continue b;}');
assertUnreachable();
} catch(e) {
assertTrue(e instanceof SyntaxError);
assertEquals("Undefined label 'b'", e.message);
}
Commit: [parser] allow patterns within left/right branches of ConditionalExpr
Date(Commit): Wed, 22 Mar 2017 17:15:47 -0400
Code Review : https://chromium-review.googlesource.com/455221
Regress : test\mjsunit\es6\regress\regress-6098.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const fn = (c) => {
let d = [1, 2], x = [3, 4],
e = null,
f = null;
0 < c.getIn(['a']) ? [e, f] = d : [e, f] = x;
return [e, f];
};
assertEquals([3, 4], fn({ getIn(x) { return false; } }));
assertEquals([1, 2], fn({ getIn(x) { return true; } }));
Commit: Fix LoadGlobalIC for cleared WeakCells
Date(Commit): Sat, 18 Mar 2017 00:45:18 +0100
Code Review : https://chromium-review.googlesource.com/456280
Regress : test\mjsunit\regress\regress-crbug-702793.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
prop = "property";
function f(o) {
return o.prop;
}
f(this);
f(this);
delete this.prop;
gc();
assertEquals(undefined, f(this));
Commit: [csa] Bailout to the runtime for ToInteger conversion in Array.p.indexOf.
Date(Commit): Wed, 15 Mar 2017 23:53:09 -0700
Regress : test\mjsunit\regress\regress-crbug-702058-3.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var arr = [];
for (var i = 0; i < 100000; i++) arr[i] = [];
var fromIndex = {valueOf: function() { arr.length = 0; }};
arr.indexOf({}, fromIndex);
Commit: [turbofan] Handle Smi -> Float32 conversion in representation changer.
Date(Commit): Wed, 15 Mar 2017 00:44:59 -0700
Regress : test\mjsunit\compiler\regress-693425.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var g = 0;
g++;
var f32 = new Float32Array();
function foo() {
f32[0 >> 2] = g;
}
foo();
Commit: [runtime] Fix KeyAccumulator for non-internalized keys.
Date(Commit): Mon, 13 Mar 2017 14:39:49 +0100
Code Review : https://chromium-review.googlesource.com/452979
Regress : test\mjsunit\regress\regress-crbug-700678.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function testNonConfigurableProperty() {
function ownKeys(x) { return ["23", "length"]; }
var target = [];
var proxy = new Proxy(target, {ownKeys:ownKeys});
Object.defineProperty(target, "23", {value:true});
assertEquals(["23", "length"], Object.getOwnPropertyNames(proxy));
})();
(function testPreventedExtension() {
function ownKeys(x) { return ["42", "length"]; }
var target = [];
var proxy = new Proxy(target, {ownKeys:ownKeys});
target[42] = true;
Object.preventExtensions(target);
assertEquals(["42", "length"], Object.getOwnPropertyNames(proxy));
})();
Commit: [turbofan] Fix regress-694088.js for big endian.
Date(Commit): Mon, 13 Mar 2017 05:59:48 -0700
Regress : test\mjsunit\compiler\regress-694088.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function is_little_endian() {
var buffer = new ArrayBuffer(4);
HEAP32 = new Int32Array(buffer);
HEAPU8 = new Uint8Array(buffer);
HEAP32[0] = 255;
if (HEAPU8[0] === 255 && HEAPU8[3] === 0)
return true;
else
return false;
}
(function () {
var buffer = new ArrayBuffer(8);
var i32 = new Int32Array(buffer);
var f64 = new Float64Array(buffer);
function foo() {
f64[0] = 1;
var x = f64[0];
if (is_little_endian())
return i32[0];
else
return i32[1];
}
assertEquals(0, foo());
})();
(function () {
var buffer = new ArrayBuffer(8);
var i16 = new Int16Array(buffer);
var i32 = new Int32Array(buffer);
function foo() {
i32[0] = 0x20001;
var x = i32[0];
if (is_little_endian())
return i16[0];
else
return i16[1];
}
assertEquals(1, foo());
})();
Commit: Retain source order when hoisting sloppy block functions
Date(Commit): Thu, 2 Mar 2017 12:36:08 -0800
Code Review : https://chromium-review.googlesource.com/448701
Regress : test\mjsunit\regress\regress-crbug-688567.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
{
function a(){}
function b(){}
function c(){}
function d(){}
function e(){}
function f(){}
function g(){}
function h(){}
}
var names = Object.getOwnPropertyNames(this);
names = names.filter(n => Array.prototype.includes.call("abcdefgh", n));
assertEquals("a,b,c,d,e,f,g,h", names.join());
{
{
let j;
{
// This j will not be hoisted
function j(){}
}
}
function i(){}
// but this j will be.
function j(){}
}
var names = Object.getOwnPropertyNames(this);
names = names.filter(n => Array.prototype.includes.call("ij", n));
assertEquals("i,j", names.join());
Commit: [runtime] Properly handle null constructor case when feeding back normalization.
Date(Commit): Wed, 1 Mar 2017 10:36:14 +0100
Code Review : https://chromium-review.googlesource.com/448217
Regress : test\mjsunit\regress\regress-crbug-697017.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
for (var i = 0; i < 100; i++) {
print(i);
(Int32Array)["abc" + i] = i;
}
Commit: [ast] Fix bug in deserialization of catch scopes.
Date(Commit): Tue, 28 Feb 2017 15:33:12 +0100
Code Review : https://chromium-review.googlesource.com/447680
Regress : test\mjsunit\regress\regress-696332.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
try {
throw 1
} catch (v) {
function foo() { return v; }
foo();
v = 2
}
assertEquals(2, foo());
Commit: Accurately record eval calls in arrow parameter lists
Date(Commit): Tue, 28 Feb 2017 10:47:15 -0800
Code Review : https://chromium-review.googlesource.com/446094
Regress : test\mjsunit\regress\regress-crbug-691687.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --always-opt --no-lazy --turbo-filter=whatever
function g() { eval() }
with ({}) { }
f = ({x}) => x;
assertEquals(42, f({x: 42}));
Commit: [runtime] Mark old JSGlobalProxy's map as unstable when an iframe navigates away.
Date(Commit): Tue, 28 Feb 2017 17:38:04 +0100
Code Review : https://chromium-review.googlesource.com/447638
Regress : test\mjsunit\regress\regress-crbug-683667.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --verify-heap
var realm = Realm.create();
var g = Realm.global(realm);
var obj = {x: 0, g: g};
// Navigation will replace JSGlobalObject behind the JSGlobalProxy g and
// therefore will change the g's map. The old map must be marked as non-stable.
Realm.navigate(realm);
gc();
Date(Commit): Mon, 27 Feb 2017 11:45:58 +0100
Code Review : https://chromium-review.googlesource.com/446845
Regress : test\mjsunit\regress\regress-crbug-688734.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function foo(a) {
a[0] = 3;
}
var v = [,6];
v.__proto__ = [];
foo(v);
delete v[0];
var count = 0;
v.__proto__.__defineSetter__(0, function() { count++; });
foo([1,,,2]);
foo(v);
assertEquals(1, count);
Commit: [typedarrays] Fix Out of Bound Access in TypedArraySortFast
Date(Commit): Mon, 27 Feb 2017 13:28:43 +0900
Code Review : https://chromium-review.googlesource.com/447036
Regress : test\mjsunit\regress\regress-696251.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var a = new Uint8Array(1000);
a.fill(255);
a.sort();
Commit: [regexp] Fix smi receiver in stack accessors
Date(Commit): Mon, 20 Feb 2017 03:48:10 -0800
Regress : test\mjsunit\regress\regress-693500.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Reflect.get(new Error(), "stack", 0);
Commit: [interpreter] When generating bytecode, properly track current scope.
Date(Commit): Sun, 19 Feb 2017 13:46:03 +0100
Code Review : https://chromium-review.googlesource.com/444785
Regress : test\mjsunit\regress\regress-5927.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
let a = Object.freeze({});
assertThrows(() => class C {[a.b = "foo"]() {}}, TypeError);
assertThrows(() => class C extends (a.c = null) {}, TypeError);
Commit: [regexp] Correct lastIndex behavior in RegExp.prototype[@@replace]
Date(Commit): Thu, 16 Feb 2017 01:21:37 -0800
Regress : test\mjsunit\regress\regress-2437.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Summary of the spec: lastIndex is reset to 0 if
// - a global or sticky regexp fails to match.
// - a global regexp is used in a function that returns multiple results,
// such as String.prototype.replace or String.prototype.match, since it
// repeats the regexp until it fails to match.
// Otherwise lastIndex is only set when a global regexp matches, to the index
// after the match.
// Test Regexp.prototype.exec
r = /a/;
r.lastIndex = 1;
r.exec("zzzz");
assertEquals(1, r.lastIndex);
// Test Regexp.prototype.test
r = /a/;
r.lastIndex = 1;
r.test("zzzz");
assertEquals(1, r.lastIndex);
// Test String.prototype.match
r = /a/;
r.lastIndex = 1;
"zzzz".match(r);
assertEquals(1, r.lastIndex);
// Test String.prototype.replace with atomic regexp and empty string.
r = /a/;
r.lastIndex = 1;
"zzzz".replace(r, "");
assertEquals(1, r.lastIndex);
// Test String.prototype.replace with non-atomic regexp and empty string.
r = /\d/;
r.lastIndex = 1;
"zzzz".replace(r, "");
assertEquals(1, r.lastIndex);
// Test String.prototype.replace with atomic regexp and non-empty string.
r = /a/;
r.lastIndex = 1;
"zzzz".replace(r, "a");
assertEquals(1, r.lastIndex);
// Test String.prototype.replace with non-atomic regexp and non-empty string.
r = /\d/;
r.lastIndex = 1;
"zzzz".replace(r, "a");
assertEquals(1, r.lastIndex);
// Test String.prototype.replace with replacement function
r = /a/;
r.lastIndex = 1;
"zzzz".replace(r, function() { return ""; });
assertEquals(1, r.lastIndex);
// Regexp functions that returns multiple results:
// A global regexp always resets lastIndex regardless of whether it matches.
r = /a/g;
r.lastIndex = -1;
"0123abcd".replace(r, "x");
assertEquals(0, r.lastIndex);
r.lastIndex = -1;
"01234567".replace(r, "x");
assertEquals(0, r.lastIndex);
r.lastIndex = -1;
"0123abcd".match(r);
assertEquals(0, r.lastIndex);
r.lastIndex = -1;
"01234567".match(r);
assertEquals(0, r.lastIndex);
// A non-global regexp resets lastIndex iff it is sticky.
r = /a/;
r.lastIndex = -1;
"0123abcd".replace(r, "x");
assertEquals(-1, r.lastIndex);
r.lastIndex = -1;
"01234567".replace(r, "x");
assertEquals(-1, r.lastIndex);
r.lastIndex = -1;
"0123abcd".match(r);
assertEquals(-1, r.lastIndex);
r.lastIndex = -1;
"01234567".match(r);
assertEquals(-1, r.lastIndex);
r = /a/y;
r.lastIndex = -1;
"0123abcd".replace(r, "x");
assertEquals(0, r.lastIndex);
r.lastIndex = -1;
"01234567".replace(r, "x");
assertEquals(0, r.lastIndex);
// Also test RegExp.prototype.exec and RegExp.prototype.test
r = /a/g;
r.lastIndex = 1;
r.exec("01234567");
assertEquals(0, r.lastIndex);
r.lastIndex = 1;
r.exec("0123abcd");
assertEquals(5, r.lastIndex);
r = /a/;
r.lastIndex = 1;
r.exec("01234567");
assertEquals(1, r.lastIndex);
r.lastIndex = 1;
r.exec("0123abcd");
assertEquals(1, r.lastIndex);
r = /a/g;
r.lastIndex = 1;
r.test("01234567");
assertEquals(0, r.lastIndex);
r.lastIndex = 1;
r.test("0123abcd");
assertEquals(5, r.lastIndex);
r = /a/;
r.lastIndex = 1;
r.test("01234567");
assertEquals(1, r.lastIndex);
r.lastIndex = 1;
r.test("0123abcd");
assertEquals(1, r.lastIndex);
Commit: [builtins] Convert the hole to undefined when pushing spread arguments.
Date(Commit): Wed, 15 Feb 2017 16:58:46 +0100
Code Review : https://chromium-review.googlesource.com/443247
Regress : test\mjsunit\regress\regress-5974.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function() {
var a = Array(...Array(5)).map(() => 1);
assertEquals([1, 1, 1, 1, 1], a);
})();
Commit: ParserBase should accept ESCAPED_STRICT_RESERVED_WORD as an identifier
Date(Commit): Tue, 14 Feb 2017 18:35:12 -0800
Regress : test\mjsunit\regress\regress-5692.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// "let" in non-strict mode can be a label, even if composed of unicode escape
// sequences.
var wasTouched = false;
l\u0065t:
do {
break l\u0065t;
wasTouched = true;
} while (false);
// Verify that in addition to no exception thrown, breaking to the label also
// works.
assertFalse(wasTouched);
Commit: [es2015] Remove the @@hasInstance protector cell.
Date(Commit): Sun, 12 Feb 2017 23:16:27 -0800
Regress : test\mjsunit\regress\regress-v8-5958.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
class A {}
class B {}
A.__proto__ = new Proxy(A.__proto__, {
get: function (target, property, receiver) {
if (property === Symbol.hasInstance) throw new B;
}
});
assertThrows(() => (new A) instanceof A, B);
Commit: [regexp] Update lastIndex semantics in RegExpBuiltinExec
Date(Commit): Thu, 9 Feb 2017 06:54:05 -0800
Regress : test\mjsunit\regress\regress-2438.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
function testSideEffects(subject, re) {
var counter = 0;
var side_effect_object = { valueOf: function() { return counter++; } };
re.lastIndex = side_effect_object;
re.exec(subject);
assertEquals(1, counter);
re.lastIndex = side_effect_object;
re.test(subject);
assertEquals(2, counter);
}
testSideEffects("zzzz", /a/);
testSideEffects("zzzz", /a/g);
testSideEffects("xaxa", /a/);
testSideEffects("xaxa", /a/g);
Commit: [parsing] Produce same Scopes in Parser and PreParser when the params are not simple.
Date(Commit): Wed, 8 Feb 2017 17:45:24 +0100
Code Review : https://chromium-review.googlesource.com/439345
Regress : test\mjsunit\regress\regress-5938.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --lazy-inner-functions
let global = 0;
{
let confusing = 13;
function lazy_func(b = confusing) { let confusing = 0; global = b; }
lazy_func();
}
assertEquals(13, global);
Commit: [builtins] Fix crash on stack overflow in CheckSpreadAndPushToStack.
Date(Commit): Tue, 7 Feb 2017 01:58:19 -0800
Regress : test\mjsunit\regress\regress-689016.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function() {
function f() {}
assertThrows(function() {
f(...Array(1000000));
}, RangeError);
})();
Commit: [string] Don't tail-call into runtime with adaptor frames
Date(Commit): Mon, 6 Feb 2017 01:47:55 -0800
Regress : test\mjsunit\regress\regress-688690.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var foo = "01234567";
foo += foo;
foo += foo;
foo += foo;
foo += foo;
foo += foo; // foo.length = 256;
// Create an adaptor frame, and take the StringReplaceOneCharWithString runtime
// fast path. This crashed originally since TailCallRuntime could not handle
// adaptor frames.
var bar = foo.replace('x', 'y', 'z');
Commit: ThinStrings: fix Factory::NewProperSubString
Date(Commit): Mon, 30 Jan 2017 10:24:16 -0800
Regress : test\mjsunit\regress\regress-crbug-685504.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var v2 = 1073741823;
var v13 = {};
function f1(a, b) {
var v4 = a + b;
var v1 = v4.substring(20);
v2[v4];
return v1;
}
v5 = f1("abcdefghijklmnopqrstuvwxyz", "abcdefghijklmnopqrstuvwxyz");
function f8(name, input, regexp) {
var v14 = input.match(regexp);
RegExp["$'"]}
f8("CaptureGlobal", v5, v13, []["anama"]);
Commit: ThinStrings: fix CodeStubAssembler::SubString
Date(Commit): Mon, 30 Jan 2017 10:17:52 -0800
Regress : test\mjsunit\regress\regress-crbug-685965.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function __f_0(a) {
var __v_3 = a + undefined;
var __v_0 = __v_3.substring(0, 20);
var __v_1 = {};
__v_1[__v_3];
return __v_0;
}
__v_4 = __f_0( "abcdefghijklmnopqrstuvwxyz");
assertEquals("bcdefg", __v_4.substring(7, 1));
Commit: [Builtins] Smi-check the spread and go to runtime in CheckSpreadAndPushToStack.
Date(Commit): Wed, 25 Jan 2017 05:55:58 -0800
Regress : test\mjsunit\regress\regress-685086.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
try {
Math.max(...0);
} catch (e) {
}
Commit: [turbofan] Fix accumulator use in bytecode analysis.
Date(Commit): Wed, 25 Jan 2017 01:14:41 -0800
Regress : test\mjsunit\regress\regress-crbug-683581.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var v = 0;
function foo() {
for (var i = 0; i < 70000; i++) {
v += i;
}
eval();
}
foo()
assertEquals(2449965000, v);
Commit: [runtime] Fix Array.prototype.concat with complex @@species
Date(Commit): Tue, 24 Jan 2017 20:37:04 -0800
Regress : test\mjsunit\regress\regress-crbug-682194.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
var proxy = new Proxy([], {
defineProperty() {
w.length = 1; // shorten the array so the backstore pointer is relocated
gc(); // force gc to move the array's elements backstore
return Object.defineProperty.apply(this, arguments);
}
});
class MyArray extends Array {
// custom constructor which returns a proxy object
static get[Symbol.species](){
return function() {
return proxy;
}
};
}
var w = new MyArray(100);
w[1] = 0.1;
w[2] = 0.1;
var result = Array.prototype.concat.call(w);
assertEquals(undefined, result[0]);
assertEquals(0.1, result[1]);
for (var i = 2; i < 200; i++) {
assertEquals(undefined, result[i]);
}
Commit: [Ignition/turbo] Add a CallWithSpread bytecode.
Date(Commit): Mon, 23 Jan 2017 01:03:35 -0800
Regress : test\mjsunit\regress\regress-682242.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --es-staging
class BaseClass {
method() {
return 1;
}
}
class SubClass extends BaseClass {
method(...args) {
return super.method(...args);
}
}
var a = new SubClass();
a.method();
Commit: Also suppress exception messages thrown by native scripts
Date(Commit): Fri, 20 Jan 2017 00:57:42 -0800
Regress : test\mjsunit\regress\regress-681984.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function __f_0() {
try {
__f_0();
} catch(e) {
Realm.create();
}
}
__f_0();
Commit: [regexp] Implement regexp groups as wrapper.
Date(Commit): Wed, 18 Jan 2017 00:14:59 -0800
Regress : test\mjsunit\regress\regress-5845.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertDoesNotThrow('/(?:(?=(foo)))?/u.exec("foo")');
assertThrows('/(?=(foo))?/u.exec("foo")');
Commit: [wasm][asm.js] Check if a property key is a PropertyName before assumming it.
Date(Commit): Tue, 17 Jan 2017 22:49:21 -0800
Regress : test\mjsunit\asm\regress-681707.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --validate-asm
var foo = (function(stdlib) {
"use asm";
var bar = (stdlib[0]);
function foo() { return bar ("lala"); }
return foo;
})(this);
try {
nop(foo);
foo();
} catch (e) {
}
Commit: [generators] Always call function with closure context when resuming.
Date(Commit): Tue, 17 Jan 2017 05:44:10 -0800
Regress : test\mjsunit\regress\regress-681171-3.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --always-opt --function-context-specialization --verify-heap
(function __f_5() {
var __v_0 = { *['a']() { yield 2; } };
var __v_3 = __v_0.a();
__v_3.next();
})();
Commit: Add test case for Number.prototype.toString (r42364).
Date(Commit): Mon, 16 Jan 2017 05:49:00 -0800
Regress : test\mjsunit\regress\regress-crbug-679841.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(-1e-301).toString(2);
Commit: String.prototype.anchor and others should not cause side effects.
Date(Commit): Fri, 13 Jan 2017 00:38:23 -0800
Regress : test\mjsunit\regress\regress-5836.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var previous = RegExp.lastMatch;
'hello world'.anchor('"hi"');
assertEquals(previous, RegExp.lastMatch);
Commit: Parser: Fix InitializerRewriter.
Date(Commit): Thu, 12 Jan 2017 07:52:00 -0800
Regress : test\mjsunit\regress\regress-679727.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
f = (e=({} = {} = 1)) => {}; f(1);
((e = ({} = {} = {})) => {})(1)
Commit: Fix: KeyedStoreGeneric must check for writable array length
Date(Commit): Wed, 11 Jan 2017 03:37:44 -0800
Regress : test\mjsunit\regress\regress-5669.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(a, i, v) { a[i] = v; }
f("make it generic", 0, 0);
var a = new Array();
Object.defineProperty(a, "length", {value: 3, writable: false});
print(JSON.stringify(Object.getOwnPropertyDescriptor(a, "length")));
assertEquals(3, a.length);
f(a, 3, 3);
assertFalse(Object.getOwnPropertyDescriptor(a, "length").writable);
assertEquals(3, a.length);
var b = new Array();
b.length = 3;
Object.freeze(b);
assertEquals(3, b.length);
f(b, 3, 3);
assertEquals(3, b.length);
Commit: Remove --harmony-async-await runtime flag
Date(Commit): Tue, 10 Jan 2017 15:27:02 -0800
Regress : test\mjsunit\es8\regress\regress-624300.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function f() {
try {
f();
} catch (e) {
(async() => await 1).length;
}
})();
Commit: [wasm][asm.js] Ensure final validation phase runs.
Date(Commit): Tue, 10 Jan 2017 09:47:21 -0800
Regress : test\mjsunit\asm\regress-676573.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function baz() {
"use asm";
}
function B(stdlib, env) {
"use asm";
var x = env.foo | 0;
}
var bar = {
get foo() {
}
};
bar.__defineGetter__('foo', function() { return baz(); });
B(this, bar);
Commit: [wasm][asm.js] Exclude zero left hand side in arm64 isel.
Date(Commit): Tue, 10 Jan 2017 09:46:11 -0800
Regress : test\mjsunit\asm\regress-641885.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var __f_2 = (function __f_4() {
"use asm";
function __f_2(i) {
i = i|0;
i = i << -2147483648 >> -1073741824;
return i|0;
}
return { __f_2: __f_2 };
})().__f_2;
Commit: [intl] Remove redundant type checking system
Date(Commit): Mon, 9 Jan 2017 14:24:57 -0800
Regress : test\mjsunit\regress\regress-677055.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
if (this.Intl) {
v5 = new Intl.NumberFormat();
v9 = new Intl.DateTimeFormat();
v52 = v9["formatToParts"];
var v55 = {};
assertThrows(() => Reflect.apply(v52, v5, v55), TypeError);
}
Commit: [turbofan] Teach escape analysis about StringCharAt
Date(Commit): Wed, 4 Jan 2017 04:01:38 -0800
Regress : test\mjsunit\regress\regress-crbug-677757.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
for (var i = 0; i < 50000; i++) {
("Foo"[0] + "barbarbarbarbarbar")[0];
}
Commit: Fix empty push bug in Array.push
Date(Commit): Wed, 4 Jan 2017 02:57:26 -0800
Regress : test\mjsunit\regress\regress-670981-array-push.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var array = [];
array.length = .6e+7;
array.push( );
assertEquals(array.length, .6e+7);
Commit: Force ctxt allocation in eval scopes.
Date(Commit): Tue, 3 Jan 2017 12:27:20 -0800
Regress : test\mjsunit\regress\regress-5736.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var my_global = 0;
// The problem was that we allowed lazy functions inside evals, but did not
// force context allocation on the eval scope. Thus, foo was not context
// allocated since we didn't realize that a lazy function referred to it.
eval(`let foo = 1;
let maybe_lazy = function() { foo = 2; }
maybe_lazy();
my_global = foo;`);
assertEquals(2, my_global);
(function TestVarInStrictEval() {
"use strict";
eval(`var foo = 3;
let maybe_lazy = function() { foo = 4; }
maybe_lazy();
my_global = foo;`);
assertEquals(4, my_global);
})();
eval("let foo = 1; function lazy() { foo = 2; } lazy(); my_global = foo;");
assertEquals(my_global, 2);
// Lexical variable inside a subscope in eval.
eval(`{ let foo = 5;
function not_lazy() { foo = 6; }
not_lazy();
my_global = foo;
}`);
assertEquals(my_global, 6);