Commit: Fix SealHandleScope usage in runtime-classes.cc
Date(Commit): Tue, 27 Dec 2016 10:55:16 -0800
Regress : test\mjsunit\regress\regress-5783.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
class C {}
class D extends C { constructor(...args) { super(...args, 75) } }
D.__proto__ = null;
assertThrows(() => new D(), TypeError);
Commit: Object.prototype.toString must reflect mutated @@toStringTag values for primitives
Date(Commit): Tue, 27 Dec 2016 09:57:38 -0800
Regress : test\mjsunit\regress\regress-5780.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function testMutatedPrimitiveToStringTag(primitive) {
Object.defineProperty(
primitive.__proto__, Symbol.toStringTag,
{value: "bogus", configurable: true, writable: false, enumerable: false});
assertEquals("[object bogus]", Object.prototype.toString.call(primitive));
}
testMutatedPrimitiveToStringTag('');
testMutatedPrimitiveToStringTag(true);
testMutatedPrimitiveToStringTag(42);
testMutatedPrimitiveToStringTag(42.42);
testMutatedPrimitiveToStringTag(Symbol());
Commit: [intl] Fix build for noi18n mode
Date(Commit): Fri, 23 Dec 2016 09:10:30 -0800
Regress : test\mjsunit\regress\regress-4870.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
if (this.Intl) {
assertThrows(() => Object.getOwnPropertyDescriptor(Intl.Collator.prototype,
'compare')
.get.call(new Intl.DateTimeFormat())('a', 'b'),
TypeError)
}
Commit: [ic] Always use generic ICs for growing element stores on arguments
Date(Commit): Thu, 22 Dec 2016 06:10:51 -0800
Regress : test\mjsunit\regress\regress-5772.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
(function sloppyPackedArguments() {
function f(a) {
for (var i = 0; i < 2; i++) {
a[i] = 0;
}
}
var boom;
function g() {
var a = arguments;
f(a);
boom = a[5];
assertEquals(undefined, boom);
}
f([]);
g(1);
})();
(function strictPackedArguments() {
"use strict";
function f(a) {
for (var i = 0; i < 2; i++) {
a[i] = 0;
}
}
var boom;
function g() {
var a = arguments;
f(a);
boom = a[5];
assertEquals(undefined, boom);
}
f([]);
g(1);
})();
Commit: Use a different map to distinguish eval contexts
Date(Commit): Tue, 20 Dec 2016 08:23:19 -0800
Regress : test\mjsunit\regress\regress-648719.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertEquals('function', typeof eval('const xz = {};function yz(){xz}yz'));
Commit: [es6] Fix the %TypedArray% constructor.
Date(Commit): Tue, 20 Dec 2016 08:14:08 -0800
Regress : test\mjsunit\regress\regress-5763-2.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
try {
var TA = Object.getPrototypeOf(Int8Array);
var obj = Reflect.construct(TA, [], Int8Array);
new Int8Array(4).set(obj);
} catch (e) {}
Commit: Implement header size calculation for array iterators.
Date(Commit): Tue, 20 Dec 2016 02:38:17 -0800
Regress : test\mjsunit\regress\regress-674232.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function getRandomProperty(v, rand) { var properties = Object.getOwnPropertyNames(v); var proto = Object.getPrototypeOf(v); if (proto) {; } if ("constructor" && v.constructor.hasOwnProperty()) {; } if (properties.length == 0) { return "0"; } return properties[rand % properties.length]; }
function __f_11() {
var __v_8 = new Array();
var __v_9 = __v_8.entries();
__v_9.__p_118574531 = __v_9[ 118574531];
__v_9.__defineGetter__(getRandomProperty(__v_9, 1442724132), function() {; __v_0[getRandomProperty()] = __v_1[getRandomProperty()]; return __v_9.__p_118574531; });
}
function __f_10() {
__f_11();
}
__f_10();
__f_10();
Commit: [intl] Avoid modifying options bag from constructor
Date(Commit): Mon, 19 Dec 2016 13:36:16 -0800
Regress : test\mjsunit\regress\regress-builtinbust-7.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
if ("Intl" in this) {
function overflow() {
return overflow() + 1;
}
Object.defineProperty = overflow;
assertDoesNotThrow(function() { Intl.Collator.supportedLocalesOf("en"); });
var date = new Date(Date.UTC(2004, 12, 25, 3, 0, 0));
var options = {
weekday: "long",
year: "numeric",
month: "long",
day: "numeric"
};
Object.apply = overflow;
assertDoesNotThrow(function() { date.toLocaleDateString("de-DE", options); });
var options_incomplete = {};
assertDoesNotThrow(function() {
date.toLocaleDateString("de-DE", options_incomplete);
});
assertFalse(options_incomplete.hasOwnProperty("year"));
assertDoesNotThrow(function() { date.toLocaleDateString("de-DE", undefined); });
assertDoesNotThrow(function() { date.toLocaleDateString("de-DE"); });
assertThrows(function() { date.toLocaleDateString("de-DE", null); }, TypeError);
}
Commit: [turbofan] Handle the impossible value representation mismatch in instruction selector.
Date(Commit): Thu, 15 Dec 2016 04:13:06 -0800
Regress : test\mjsunit\compiler\regress-674469.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
global = -1073741824;
global = 2;
function foo() {
global = "a";
global = global;
var o = global;
while (o < 2) {
}
}
foo();
Commit: [Interpreter] Allocate registers used as call arguments on-demand.
Date(Commit): Thu, 15 Dec 2016 02:59:57 -0800
Regress : test\mjsunit\ignition\regress-672027.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --max-old-space-size=100
(function() {
var source = "[]"
for (var i = 0; i < 300; i++) {
source += ".concat([";
for (var j = 0; j < 1000; j++) {
source += "0,";
}
source += "0])"
}
eval(source);
})();
Commit: [regexp] Let RegExp.prototype.compile return this
Date(Commit): Wed, 14 Dec 2016 23:28:25 -0800
Regress : test\mjsunit\regress\regress-585775.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var pattern = /foo/;
assertEquals(pattern, pattern.compile(pattern));
Commit: [heap] Initialize the owner on each page after lospace allocation
Date(Commit): Tue, 13 Dec 2016 22:45:22 -0800
Regress : test\mjsunit\regress\regress-672041.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Trigger an infinite loop through RegExp.prototype[@@match], which results
// in unbounded growth of the results array.
// Limit the number of iterations to avoid OOM while still triggering large
// object space allocation.
const min_ptr_size = 4;
const max_regular_heap_object_size = 507136;
const num_iterations = max_regular_heap_object_size / min_ptr_size;
const RegExpPrototypeExec = RegExp.prototype.exec;
let i = 0;
RegExp.prototype.__defineGetter__("global", () => true);
RegExp.prototype.exec = function(str) {
return (i++ < num_iterations) ? RegExpPrototypeExec.call(this, str) : null;
};
"a".match();
Commit: [ignition] Fix hole check for dynamic local variables
Date(Commit): Tue, 13 Dec 2016 06:28:20 -0800
Regress : test\mjsunit\regress\regress-crbug-669540.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f({
[
(function g() {
assertThrows(function(){
print(eval("p"));
}, ReferenceError);
})()
]: p
}) {};
f({});
Commit: [stubs] Fix negative index lookup in hasOwnProperty
Date(Commit): Mon, 12 Dec 2016 12:12:18 -0800
Regress : test\mjsunit\regress\regress-crbug-673008.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var a = {
"33": true,
"-1": true
};
var strkeys = Object.keys(a).map(function(k) { return "" + k });
var numkeys = Object.keys(a).map(function(k) { return +k });
var keys = strkeys.concat(numkeys);
keys.forEach(function(k) {
assertTrue(a.hasOwnProperty(k),
"property not found: " + k + "(" + (typeof k) + ")");
});
var b = {};
b.__proto__ = a;
keys.forEach(function(k) {
assertTrue(k in b, "property not found: " + k + "(" + (typeof k) + ")");
});
Commit: [wasm] Remove obsolete %IsNotAsmWasmCode predicate.
Date(Commit): Fri, 9 Dec 2016 03:55:40 -0800
Regress : test\mjsunit\asm\regress-672045.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --validate-asm --allow-natives-syntax
function Module(stdlib, env) {
"use asm";
var x = env.bar|0;
return { foo: function(y) { return eval(1); } };
}
Module(this, {bar:0});
assertFalse(%IsAsmWasmCode(Module));
Commit: [stubs] Add option to allow LO space allocation
Date(Commit): Tue, 6 Dec 2016 06:08:41 -0800
Regress : test\mjsunit\regress\regress-670671.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Trigger an infinite loop through RegExp.prototype[@@match], which results
// in unbounded growth of the results array.
// Limit the number of iterations to avoid OOM while still triggering large
// object space allocation.
const min_ptr_size = 4;
const max_regular_heap_object_size = 507136;
const num_iterations = max_regular_heap_object_size / min_ptr_size;
let i = 0;
const re = /foo.bar/;
const RegExpPrototypeExec = RegExp.prototype.exec;
re.exec = (str) => {
return (i++ < num_iterations) ? RegExpPrototypeExec.call(re, str) : null;
};
re.__defineGetter__("global", () => true); // Triggers infinite loop.
"foo*bar".match(re); // Should not crash.
Commit: [wasm] Implement location from stack trace for asm.js frames
Date(Commit): Mon, 5 Dec 2016 11:29:38 -0800
Regress : test\mjsunit\regress\regress-670808.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var sym = Symbol();
function asm(stdlib, ffi) {
"use asm";
var get_sym = ffi.get_sym;
function crash() {
get_sym()|0;
}
return {crash: crash};
}
function get_sym() {
return sym;
}
try {
asm(null, {get_sym: get_sym}).crash();
} catch (e) {
if (!(e instanceof TypeError))
throw e;
}
Commit: [compiler] Make --debug-code the default in debug builds.
Date(Commit): Fri, 2 Dec 2016 03:36:33 -0800
Regress : test\mjsunit\regress\regress-353551.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
var depth = 0;
function __f_3(x) {
var __v_1 = arguments;
__v_1[1000] = 123;
depth++;
if (depth > 2200) return;
function __f_4() {
++__v_1[0];
__f_3(0.5);
};
__f_4();
}
__f_3(0.5);
Date(Commit): Fri, 2 Dec 2016 02:03:18 -0800
Regress : test\mjsunit\regress\regress-crbug-669411.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(o) {
o[5000000] = 0;
}
var o = Object.create(null);
f(o);
f(o);
f(o);
Commit: [wasm] [asm.js] Ignore unused function tables in AsmWasmBuilder.
Date(Commit): Wed, 30 Nov 2016 18:26:56 -0800
Regress : test\mjsunit\asm\regress-669899.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
try {
(function () {
})();
} catch(e) {; }
function __f_113() {
}
(function () {
function __f_89() {
"use asm";
function __f_63(__v_26, __v_28) {
__v_26 = __v_26|0;
__v_28 = __v_28|0;
}
function __f_21(table_id, fun_id, arg1, arg2) {
table_id = table_id|0;
fun_id = fun_id|0;
arg1 = arg1|0;
arg2 = arg2|0;
}
var __v_17 = [];
}
var module = __f_89();
})();
Commit: Cleanup: Move mjsunit/regress-*.js into mjsunit/regress/.
Date(Commit): Tue, 29 Nov 2016 06:20:40 -0800
Regress : test\mjsunit\regress\regress-keyed-store-non-strict-arguments.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function args(arg) { return arguments; }
var a = args(false);
(function () {
"use strict";
a["const" + 0] = 0;
})();
(function () {
"use strict";
a[0] = 0;
})();
Date(Commit): Tue, 29 Nov 2016 04:01:16 -0800
Regress : test\mjsunit\regress\regress-5664.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --nolazy
var f = (x, y=()=>eval("x")) => y();
assertEquals(100, f(100));
Commit: [mjsunit] Change assertThrows such that it can check the exception message.
Date(Commit): Mon, 28 Nov 2016 02:26:30 -0800
Regress : test\mjsunit\regress\regress-2263.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
assertThrows = function assertThrows(code, type_opt, cause_opt) {
var threwException = true;
try {
if (typeof code === 'function') {
code();
} else {
eval(code);
}
threwException = false;
} catch (e) {
if (typeof type_opt === 'function') {
assertInstanceof(e, type_opt);
} else if (type_opt !== void 0) {
failWithMessage("invalid use of assertThrows, maybe you want assertThrowsEquals");
}
if (arguments.length >= 3) {
assertEquals(e.type, cause_opt);
}
// Success.
return;
}
failWithMessage("Did not throw exception");
};
var obj = { length: { valueOf: function(){ throw { type: "length" }}}};
var sep = { toString: function(){ throw { type: "toString" }}};
assertThrows("Array.prototype.join.call(obj, sep)", undefined, "length");
Commit: [runtime] Add missing @@IsConcatSpreadable check for FAST_DOUBLE_ELEMENTS
Date(Commit): Mon, 28 Nov 2016 02:06:07 -0800
Regress : test\mjsunit\regress\regress-crbug-668414.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function testSmiArrayConcat() {
var result = [].concat([-12]);
assertEquals(1, result.length);
assertEquals([-12], result);
})();
(function testDoubleArrayConcat() {
var result = [].concat([-1073741825]);
assertEquals(1, result.length);
assertEquals([-1073741825], result);
})();
(function testSmiArrayNonConcatSpreadable() {
var array = [-10];
array[Symbol.isConcatSpreadable] = false;
var result = [].concat(array);
assertEquals(1, result.length);
assertEquals(1, result[0].length);
assertEquals([-10], result[0]);
})();
(function testDoubleArrayNonConcatSpreadable() {
var array = [-1073741825];
array[Symbol.isConcatSpreadable] = false;
var result = [].concat(array);
assertEquals(1, result.length);
assertEquals(1, result[0].length);
assertEquals([-1073741825], result[0]);
})();
Array.prototype[Symbol.isConcatSpreadable] = false;
(function testSmiArray() {
var result = [].concat([-12]);
assertEquals(2, result.length);
assertEquals(0, result[0].length);
assertEquals(1, result[1].length);
assertEquals([-12], result[1]);
})();
(function testDoubleArray() {
var result = [].concat([-1073741825]);
assertEquals(2, result.length);
assertEquals(0, result[0].length);
assertEquals(1, result[1].length);
assertEquals([-1073741825], result[1]);
})();
Commit: Reland^2 of [stubs] KeyedStoreGeneric: inline dictionary property stores
Date(Commit): Thu, 24 Nov 2016 08:22:53 -0800
Regress : test\mjsunit\regress\regress-private-enumerable.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
class A {}
class B {}
Object.assign(B, A);
assertEquals("class B {}", B.toString());
(function() {
function f(a, i, v) {
a[i] = v;
}
f("make it generic", 0, 0);
var o = {foo: "foo"};
%OptimizeObjectForAddingMultipleProperties(o, 10);
var s = %CreatePrivateSymbol("priv");
f(o, s, "private");
%ToFastProperties(o);
var desc = Object.getOwnPropertyDescriptor(o, s);
assertEquals("private", desc.value);
assertTrue(desc.writable);
assertFalse(desc.enumerable);
assertTrue(desc.configurable);
})();
Commit: [parser] Fix scopes in rewriting of for-of and destructuring assignments.
Date(Commit): Thu, 24 Nov 2016 01:47:57 -0800
Regress : test\mjsunit\regress\regress-5648.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var iter = {}
iter[Symbol.iterator] = () => ({
next: () => ({}),
return: () => {throw 666}
});
function* foo() {
for (let x of iter) {throw 42}
}
assertThrowsEquals(() => foo().next(), 42);
function* bar() {
let x;
{ let gaga = () => {x};
[[x]] = iter;
}
}
assertThrows(() => bar().next(), TypeError);
function baz() {
let x;
{ let gaga = () => {x};
let gugu = () => {gaga};
[[x]] = iter;
}
}
assertThrows(baz, TypeError);
Commit: [d8] Do not try to verify zero-ness of failed virtual memory allocation.
Date(Commit): Tue, 22 Nov 2016 04:36:20 -0800
Regress : test\mjsunit\regress\regress-667603.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
try {
var v65 = new ArrayBuffer(2147483647);
} catch(e) {
assertTrue(e instanceof RangeError);
}
Date(Commit): Mon, 21 Nov 2016 04:46:19 -0800
Regress : test\mjsunit\regress\regress-crbug-666742.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
var p = {x:1};
__proto__ = p;
assertEquals(x, 1);
__proto__ = {x:13};
assertEquals(x, 13);
__proto__ = {x:42};
p = null;
gc();
assertEquals(x, 42);
Commit: [ic] Don't check full prototype chain if name is a private symbol.
Date(Commit): Mon, 21 Nov 2016 03:21:30 -0800
Regress : test\mjsunit\regress\regress-crbug-664974.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
for (var i = 0; i < 2000; i++) {
Object.prototype['X'+i] = true;
}
var m = new Map();
m.set(Object.prototype, 23);
var o = {};
m.set(o, 42);
Commit: Fix function name inference corruption for async functions
Date(Commit): Fri, 18 Nov 2016 10:31:28 -0800
Regress : test\mjsunit\regress\regress-cr-658267.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows("class D extends async() =>", SyntaxError);
Commit: Remove FLAG_min_preparse_length.
Date(Commit): Fri, 18 Nov 2016 06:06:25 -0800
Regress : test\mjsunit\regress\regress-crbug-648740.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function () {
function foo() {
const arguments = 42;
}
})()
Date(Commit): Fri, 18 Nov 2016 04:57:02 -0800
Regress : test\mjsunit\regress\regress-crbug-666308.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function foo() {}
foo.prototype = 1;
v = new foo();
function bar() { return v instanceof foo; }
assertThrows(bar);
Commit: [ic] Support data handlers in LoadGlobalIC.
Date(Commit): Thu, 17 Nov 2016 04:18:22 -0800
Regress : test\mjsunit\regress\regress-crbug-662854.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f() {
typeof boom;
boom;
}
assertThrows(()=>f());
Commit: [ic] Invalidate prototype validity cell when a slow prototype becomes fast.
Date(Commit): Wed, 16 Nov 2016 09:44:39 -0800
Regress : test\mjsunit\regress\regress-crbug-665886.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
[1].toLocaleString();
delete Number.prototype.toLocaleString;
[1].toLocaleString();
var o = {};
o.__proto__ = { toString: Array.prototype.toString };
o.toString();
Number.prototype.arrayToString = Array.prototype.toString;
(42).arrayToString();
var a = [7];
a.toLocaleString();
Commit: [builtins] Take fast path in Array.prototype.keys() only if length is an Smi
Date(Commit): Mon, 14 Nov 2016 10:51:57 -0800
Regress : test\mjsunit\es6\regress\regress-660925.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
let array = new Array(0xFFFFFFFF);
let it = array.keys();
assertEquals({ value: 0, done: false }, it.next());
it = array.entries();
assertEquals({ value: [0, undefined], done: false }, it.next());
it = array[Symbol.iterator]();
assertEquals({ value: undefined, done: false }, it.next());
Commit: [ic] Fix elements conversion in KeyedStoreGeneric
Date(Commit): Fri, 11 Nov 2016 05:01:49 -0800
Regress : test\mjsunit\regress\regress-crbug-664469.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(a, i) {
a[i] = "object";
}
f("make it generic", 0);
// Nearly kMaxRegularHeapObjectSize's worth of doubles.
var kLength = 500000 / 8;
var kValue = 0.1;
var a = new Array(kLength);
for (var i = 0; i < kLength; i++) {
a[i] = kValue;
}
f(a, 0);
for (var i = 1; i < kLength; i++) {
assertEquals(kValue, a[i]);
}
Commit: [Interpreter] Fix logical-or/and to ensure it always visits the lhs.
Date(Commit): Thu, 10 Nov 2016 08:30:41 -0800
Regress : test\mjsunit\ignition\regress-664146.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var foo_call_count = 0;
function foo() { foo_call_count++; }
// These || and && combinations shouldn't call foo().
(true || foo()) ? 1 : 2;
assertTrue(foo_call_count == 0);
(false && foo()) ? 1 : 2;
assertTrue(foo_call_count == 0);
// These || and && combinations should all call foo().
(foo() || true) ? 1 : 2;
assertTrue(foo_call_count == 1);
(false || foo()) ? 1 : 2;
assertTrue(foo_call_count == 2);
(foo() || false) ? 1 : 2;
assertTrue(foo_call_count == 3);
(true && foo()) ? 1 : 2;
assertTrue(foo_call_count == 4);
(foo() && true) ? 1 : 2;
assertTrue(foo_call_count == 5);
(foo() && false) ? 1 : 2;
assertTrue(foo_call_count == 6);
Commit: [wasm] [asm.js] Don't allow bad return types from a global constant
Date(Commit): Tue, 8 Nov 2016 15:31:39 -0800
Regress : test\mjsunit\asm\regress-660813.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function Module() {
"use asm";
const i = 0xffffffff;
function foo() {
return i;
}
}
Module();
Commit: [Interpreter] Ensure ValueOf is only called once for post-increment operations.
Date(Commit): Tue, 8 Nov 2016 09:02:45 -0800
Regress : test\mjsunit\ignition\regress-662418.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var valueof_calls = 0;
var v = {
toString: function() {
var z = w++;
}
};
var w = {
valueOf: function() {
valueof_calls++;
}
};
var x = { [v]: 'B' };
assertTrue(valueof_calls == 1);
Commit: Remove the 'caller' property from the strict-mode arguments map
Date(Commit): Fri, 4 Nov 2016 07:29:46 -0700
Regress : test\mjsunit\regress\regress-1387.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Tests that we always return the same type error function when trying to
// access or set strict mode callee.
function foo() {
'use strict';
return arguments;
}
var get = Object.getOwnPropertyDescriptor(foo(), "callee").get;
var set = Object.getOwnPropertyDescriptor(foo(), "callee").set;
assertEquals(get, set);
Commit: Turn Scope::locals_ into a ThreadedList
Date(Commit): Thu, 3 Nov 2016 03:06:29 -0700
Regress : test\mjsunit\regress\regress-abort-preparsing-params.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var outer_a;
function f(a, b, a) {
outer_a = a;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
}
f(1, 2, 1);
assertEquals(1, outer_a);
Commit: [ic] Properly deal with all oddballs when updating BinaryOpIC state.
Date(Commit): Thu, 27 Oct 2016 05:16:01 -0700
Regress : test\mjsunit\regress\regress-crbug-659967.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f() { null >> arguments; }
f();
f();
Commit: [regexp] Set static property attributes as in spec proposal
Date(Commit): Thu, 27 Oct 2016 01:25:24 -0700
Regress : test\mjsunit\regress\regress-5566.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// https://github.com/tc39/proposal-regexp-legacy-features#additional-properties-of-the-regexp-constructor
const props = [ "input", "$_"
, "lastMatch", "$&"
, "lastParen", "$+"
, "leftContext", "$`"
, "rightContext", "$'"
, "$1", "$2", "$3", "$4", "$5", "$6", "$7", "$8", "$9"
];
for (let i = 0; i < props.length; i++) {
const prop = props[i];
const desc = Object.getOwnPropertyDescriptor(RegExp, prop);
assertTrue(desc.configurable, prop);
assertFalse(desc.enumerable, prop);
assertTrue(desc.get !== undefined, prop);
// TODO(jgruber): Although the spec proposal specifies setting setters to
// undefined, we are not sure that this change would be web-compatible, and
// we are intentionally sticking with the old behavior for now.
assertTrue(desc.set !== undefined, prop);
}
Commit: [ignition] Use more-targeted check for CONST-this-initialization hole check
Date(Commit): Tue, 25 Oct 2016 04:07:33 -0700
Regress : test\mjsunit\regress\regress-crbug-658528.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f() {
eval("var x = 1");
const x = 2;
}
assertThrows(f, SyntaxError);
Commit: [regexp] Add regression test for v8:5434
Date(Commit): Mon, 24 Oct 2016 03:38:18 -0700
Regress : test\mjsunit\regress\regress-5434.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Ensure that we have the correct number of accesses to exec in split, and
// that exec is called at the correct point in time.
var lastIndexHasBeenSet = false;
var countOfExecGets = 0;
// Force the slow path and make sure the created splitter object has our
// overwritten exec method (@@split does not call exec on the original regexp
// but on a newly-created splitter which is guaranteed to be sticky).
class ObservableExecRegExp extends RegExp {
constructor(pattern, flags) {
super(pattern, flags);
this.lastIndex = 42;
const re = this;
Object.defineProperty(this, "exec", {
get: function() {
// Ensure exec is first accessed after lastIndex has been reset to
// satisfy the spec.
assertTrue(re.lastIndex != 42);
countOfExecGets++;
return RegExp.prototype.exec;
}
});
}
}
var re = new ObservableExecRegExp(/x/);
assertEquals(42, re.lastIndex);
assertEquals(0, countOfExecGets);
var result = "axbxc".split(re);
assertEquals(5, countOfExecGets);
assertEquals(["a", "b", "c"], result);
Commit: [promises] fix deferred object leak
Date(Commit): Thu, 6 Oct 2016 11:29:23 -0700
Regress : test\mjsunit\regress\regress-5476.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
'use strict'
class LeakyPromise extends Promise {
constructor(executor) {
super((resolve, reject) => { resolve();});
this.resolve = function() {assertEquals(this, undefined); };
this.reject = function() {assertEquals(this, undefined); };
executor(this.resolve, this.reject);
}
}
const p1 = new LeakyPromise((r) => r());
const p2 = new LeakyPromise((_, r) => r());
Commit: [turbofan] Check instruction input/output count limits in instruction selector.
Date(Commit): Tue, 4 Oct 2016 22:43:21 -0700
Regress : test\mjsunit\compiler\regress-625966.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
"use strict";
var s = "";
for (var i = 0; i < 65535; i++) {
s += ("var a" + i + ";");
}
eval(s);
Commit: Don't skip hole checks inside patterns in parameter lists
Date(Commit): Tue, 4 Oct 2016 10:04:11 -0700
Regress : test\mjsunit\regress\regress-5454.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows(function(...[b = !b]) { }, ReferenceError);
assertThrows(() => (function([b = !b]) { })([]), ReferenceError);
assertThrows(() => (function({b = !b}) { })({}), ReferenceError);
assertThrows((...[b = !b]) => { }, ReferenceError);
assertThrows(() => (([b = !b]) => { })([]), ReferenceError);
assertThrows(() => (({b = !b}) => { })({}), ReferenceError);
Commit: [ignition] Fix building lookup graph when search depth is 0
Date(Commit): Tue, 4 Oct 2016 04:07:54 -0700
Regress : test\mjsunit\regress\regress-crbug-652186-local.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --always-opt
function f() {
var x = 1;
return eval("eval('var x = 2'); x;");
}
f();
Date(Commit): Mon, 3 Oct 2016 10:21:00 -0700
Regress : test\mjsunit\regress\regress-abort-context-allocate-params.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(getter) {
arguments = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
}
Commit: Readd default function variables upon scope reset for preparse abort
Date(Commit): Thu, 29 Sep 2016 06:29:04 -0700
Regress : test\mjsunit\regress\regress-651327.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
function __f_1(a) {
__v_1 = a;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
gc();
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = -1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
gc();
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 0;
gc();
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
gc();
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
__f_3();
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = -1073741825;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = -7;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
__f_3();
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 17;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
gc();
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 0;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
gc();
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 65535;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = 1;
x = -13;
x = 1;
x = 1;
this.mapHeight * Math.round();
}
__f_1();
function __f_2(initialX, initialY) {
}
function __f_3() {
}
gc();
__f_1();
Commit: [ic][mips][mips64] Ensure store handlers return value in proper register.
Date(Commit): Wed, 28 Sep 2016 04:46:24 -0700
Regress : test\mjsunit\regress\regress-crbug-650973.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var v = {p:0};
// Turn the object into dictionary mode.
v.__defineGetter__("p", function() { return 13; });
function f() {
var boom = (v.foo = v);
assertEquals(v, boom.foo);
}
f();
f();
f();
Commit: [typedarray] Properly initialize JSTypedArray::length with Smi.
Date(Commit): Tue, 27 Sep 2016 22:49:23 -0700
Regress : test\mjsunit\regress\regress-crbug-650933.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var a = [0, 1, 2, 3, 4, 5, 6, 7, 8];
var o = {length: 1e40};
try { new Uint8Array(o); } catch (e) { }
new Float64Array(a);
Commit: [regexp] Don't cache exec method in Regexp.proto[@@split]
Date(Commit): Tue, 27 Sep 2016 07:02:12 -0700
Regress : test\mjsunit\regress\regress-5351.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var re = /[bc]/;
var str = "baba";
assertEquals(["", "a", "a"], str.split(re));
// Force slow path.
re.exec = (string) => RegExp.prototype.exec.call(re, string);
assertEquals(["", "a", "a"], str.split(re));
Commit: [builtins] adapt arguments for Builtins::kIteratorPrototypeIterator
Date(Commit): Tue, 27 Sep 2016 04:05:26 -0700
Regress : test\mjsunit\es6\regress\regress-650172.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var iterator = [].entries().__proto__.__proto__[Symbol.iterator];
print(1/iterator(-1E-300));
Commit: Declare the arguments object before creating the function var, to make sure it masks it
Date(Commit): Thu, 22 Sep 2016 12:16:23 -0700
Regress : test\mjsunit\regress\regress-649067.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertEquals(1, (function arguments() { return eval("arguments"); })(1)[0]);
Commit: [promises] PromiseResolveThenableJob: change then to be a JSReceiver
Date(Commit): Wed, 21 Sep 2016 16:55:36 -0700
Regress : test\mjsunit\regress\regress-649078.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
let p = Promise.resolve();
Object.defineProperty(p, 'then', {
get: () => new Proxy(function() {}, p)
});
new Promise((r) => r(p));
Commit: [turbofan] Ensure monotonicity for induction variable typing.
Date(Commit): Wed, 7 Sep 2016 20:50:43 -0700
Regress : test\mjsunit\compiler\regress-644633.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var g = -1073741824;
function f() {
var x = g*g*g*g*g*g*g;
for (var i = g; i < 1; ) {
i += i * x;
}
}
f();
Commit: Reland - Allow lexically declared "arguments" in function scope in sloppy mode.
Date(Commit): Tue, 6 Sep 2016 23:54:36 -0700
Regress : test\mjsunit\regress\regress-4577.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(...arguments) {
return Array.isArray(arguments);
}
assertTrue(f());
function g({arguments}) {
return arguments === 42;
}
assertTrue(g({arguments: 42}));
function foo() {
let arguments = 2;
return arguments;
}
assertEquals(2, foo());
assertThrows(function(x = arguments, arguments) {}, ReferenceError);
Commit: Do not include Error.captureStackTrace in the trace
Date(Commit): Fri, 2 Sep 2016 02:51:04 -0700
Regress : test\mjsunit\regress\regress-5342.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var o = {}
Error.captureStackTrace(o);
assertEquals(-1, o.stack.indexOf("captureStackTrace"));
Commit: Fix bug with nested spreads as patterns
Date(Commit): Fri, 2 Sep 2016 00:52:18 -0700
Regress : test\mjsunit\es6\regress\regress-5337.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function testNestedSpreadsInPatterns() {
(function () {
var [...[...x]] = [42, 17];
assertArrayEquals([42, 17], x);
})();
(function () {
let [...[...x]] = [42, 17];
assertArrayEquals([42, 17], x);
})();
(function () {
const [...[...x]] = [42, 17];
assertArrayEquals([42, 17], x);
})();
(function () {
var x; [...[...x]] = [42, 17];
assertArrayEquals([42, 17], x);
})();
function f1([...[...x]] = [42, 17]) { return x; }
assertArrayEquals([42, 17], f1());
assertArrayEquals([1, 2, 3], f1([1, 2, 3]));
var f2 = function ([...[...x]] = [42, 17]) { return x; }
assertArrayEquals([42, 17], f2());
assertArrayEquals([1, 2, 3], f2([1, 2, 3]));
// The following two were failing in debug mode, until v8:5337 was fixed.
var f3 = ([...[...x]] = [42, 17]) => { return x; };
assertArrayEquals([42, 17], f3());
assertArrayEquals([1, 2, 3], f3([1, 2, 3]));
var f4 = ([...[...x]] = [42, 17]) => x;
assertArrayEquals([42, 17], f4());
assertArrayEquals([1, 2, 3], f4([1, 2, 3]));
})();
Commit: [test] Speed-up regression test for growing stores.
Date(Commit): Mon, 29 Aug 2016 21:04:01 -0700
Regress : test\mjsunit\regress\regress-crbug-635798.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() {
var x = [];
var y = [];
x.__proto__ = y;
for (var i = 0; i < 10000; ++i) {
y[i] = 1;
}
}
foo();
Commit: Remove --promise-extra flag
Date(Commit): Mon, 22 Aug 2016 14:34:44 -0700
Regress : test\mjsunit\es6\regress\regress-cr372788.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --allow-natives-syntax
var x = 0;
var y = 0;
var thenable = { then: function(f) { x++; f(); } };
for (var i = 0; i < 3; ++i) {
Promise.resolve(thenable).then(function() { x++; y++; });
}
assertEquals(0, x);
(function check() {
Promise.resolve().then(function() {
// Delay check until all handlers have run.
if (y < 3) check(); else assertEquals(6, x);
}).catch(function(e) { %AbortJS("FAILURE: " + e) });
})();
Commit: [Parser] Track ContainsDot for SMI values.
Date(Commit): Thu, 18 Aug 2016 01:15:31 -0700
Regress : test\mjsunit\regress\regress-638134.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function foo() {
// Generates a forward branch that puts 200 in the constant pool.
var i = 0;
if (i) {
i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
}
// Emit a 200 literal which also ends up in the constant pool.
var j = 0.2e3;
}
foo();
Commit: [Interpreter] Don't try to create bytecode array if HasStackOverflow().
Date(Commit): Tue, 9 Aug 2016 00:20:54 -0700
Regress : test\mjsunit\regress\regress-635429.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --stack-size=150
function foo() {
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "boom"};
try {
foo()
} catch(e) {}
Commit: [turbofan] Fix silly bug in loop variable analysis.
Date(Commit): Mon, 8 Aug 2016 08:50:30 -0700
Regress : test\mjsunit\compiler\regress-loop-variable-if.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --turbo-loop-variable
function f() {
for (var i = 0; i != 10; i++) {
if (i < 8) print("x");
}
}
f();
Commit: [turbofan] Insert sigma nodes for loop variable backedge.
Date(Commit): Fri, 5 Aug 2016 07:32:02 -0700
Regress : test\mjsunit\compiler\regress-loop-variable-unsigned.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --turbo-loop-variable
(function() {
function f() {
for (var i = 0; i < 4294967295; i += 2) {
if (i === 10) break;
}
}
f();
})();
(function() {
function f() {
for (var i = 0; i < 4294967293; i += 2) {
if (i === 10) break;
}
}
f();
})();
Commit: [test] don't use Intl.Collator in non-Intl regression test
Date(Commit): Fri, 5 Aug 2016 05:54:23 -0700
Regress : test\mjsunit\es7\regress\regress-634357.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --enable-slow-asserts
array = new Array({}, {}, {});
Object.defineProperty(array, 1, {
get: function() {
array.length = 0;
array[0] = -2147483648;
}
});
result = array.includes(new Array());
Commit: [elements] update Dictionary in IncludesValue if own elements change
Date(Commit): Thu, 4 Aug 2016 12:05:40 -0700
Regress : test\mjsunit\es7\regress\regress-634273.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --enable-slow-asserts
array = new Array(undefined, undefined, undefined);
Object.defineProperty(array, 0, {
get: function() {
array.push(undefined, undefined);
}
});
array[0x80000] = 1;
result = array.includes(new WeakMap());
Commit: Properly pass InitializationFlag back from ScriptContextTable lookups
Date(Commit): Thu, 4 Aug 2016 09:10:48 -0700
Regress : test\mjsunit\regress\regress-crbug-633884.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
try {
// Leave "blarg" as the hole in a new ScriptContext.
Realm.eval(Realm.current(), "throw Error(); let blarg");
} catch (e) { }
// Access "blarg" via a dynamic lookup. Should not crash!
assertThrows(function() {
// Prevent full-codegen from optimizing away the %LoadLookupSlot call.
eval("var x = 5");
blarg;
});
Commit: [elements] limit TypedElementsAccessor::IncludesValue to backing store length
Date(Commit): Thu, 4 Aug 2016 08:53:10 -0700
Regress : test\mjsunit\es7\regress\regress-634269.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
__v_1 = new Uint8Array();
Object.defineProperty(__v_1.__proto__, 'length', {value: 42});
Array.prototype.includes.call(new Uint8Array(), 2);
Commit: Handle stack overflows in NoSideEffectToString
Date(Commit): Thu, 4 Aug 2016 00:42:22 -0700
Regress : test\mjsunit\regress\regress-633998.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var err_str_1 = "apply was called on , which is a object and not a function";
var err_str_2 =
"apply was called on Error, which is a object and not a function";
var reached = false;
var error = new Error();
error.name = error;
try {
Reflect.apply(error);
reached = true;
} catch (e) {
assertTrue(e.stack.indexOf(err_str_1) != -1);
} finally {
assertFalse(reached);
}
reached = false;
error = new Error();
error.msg = error;
try {
Reflect.apply(error);
reached = true;
} catch (e) {
assertTrue(e.stack.indexOf(err_str_2) != -1);
} finally {
assertFalse(reached);
}
reached = false;
error = new Error();
error.name = error;
error.msg = error;
try {
Reflect.apply(error);
reached = true;
} catch (e) {
assertTrue(e.stack.indexOf(err_str_1) != -1);
} finally {
assertFalse(reached);
}
Commit: [builtins] fix mapcheck in Array.includes fast-case when searching for String
Date(Commit): Wed, 3 Aug 2016 07:26:44 -0700
Regress : test\mjsunit\es7\regress\regress-633883.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
v5 = new Array();
v17 = encodeURIComponent(v5);
v19 = isFinite();
v34 = new Array(v19);
v47 = v34.includes(v17);
Commit: Set Error.stack property writable
Date(Commit): Fri, 29 Jul 2016 01:11:34 -0700
Regress : test\mjsunit\regress\regress-5245.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
"use strict";
// After captureStackTrace.
var a = {};
Error.captureStackTrace(a, Error);
a.stack = 1; // Should not throw, stack should be writable.
// After the standard Error constructor.
var b = new Error();
b.stack = 1; // Should not throw, stack should be writable.
b.stack = 1; // Still writable.
// After read access to stack.
var c = new Error();
var old_stack = c.stack;
c.stack = 1; // Should not throw, stack should be writable.
c.stack = 1; // Still writable.
Commit: [interpreter] Fix peephole rule on eliding last before jump.
Date(Commit): Thu, 28 Jul 2016 07:41:15 -0700
Regress : test\mjsunit\ignition\regress-629792-source-position-on-jump.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(t) {
var f = t || this;
for (var i in t) {
for (var j in t) {
(j);
continue;
}
}
}
f();
Date(Commit): Thu, 28 Jul 2016 07:28:06 -0700
Regress : test\mjsunit\regress\regress-crbug-631917.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var b = { toString: function() { return "b"; } };
var c = { toString: function() { return "c"; } };
(function() {
var expected_receiver;
var obj1 = {
a: 100,
b_: 200,
get b() { assertEquals(expected_receiver, this); return this.b_; },
set b(v) { assertEquals(expected_receiver, this); this.b_ = v; },
c_: 300,
get c() { assertEquals(expected_receiver, this); return this.c_; },
set c(v) { assertEquals(expected_receiver, this); this.c_ = v; },
};
var obj2 = {
boom() {
super.a++;
super[b]++;
super[c]++;
},
}
Object.setPrototypeOf(obj2, obj1);
expected_receiver = obj2;
obj2.boom();
assertEquals(101, obj2.a);
assertEquals(201, obj2[b]);
assertEquals(301, obj2[c]);
expected_receiver = obj1;
assertEquals(100, obj1.a);
assertEquals(200, obj1[b]);
assertEquals(300, obj1[c]);
}());
Commit: [heap] Don't consider mementos on pages below age mark
Date(Commit): Wed, 27 Jul 2016 05:16:22 -0700
Regress : test\mjsunit\regress\regress-631050.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --gc-global --stress-runs=8
function __f_3(x, expected) {
var __v_3 = [];
__v_3.length = x;
__f_3(true, 1);
}
try {
__f_3(2147483648, 2147483648);
} catch (e) {}
Commit: [Turbofan] IsUseLessGeneral shouldn't consider machine representation.
Date(Commit): Mon, 25 Jul 2016 04:59:30 -0700
Regress : test\mjsunit\regress\regress-crbug-630952.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --always-opt
try {
function __f_4(sign_bit,
mantissa_29_bits) {
}
__f_4.prototype.returnSpecial = function() {
this.mantissa_29_bits * mantissa_29_shift;
}
__f_4.prototype.toSingle = function() {
if (-65535) return this.toSingleSubnormal();
}
__f_4.prototype.toSingleSubnormal = function() {
if (__v_15) {
var __v_7 = this.mantissa_29_bits == -1 &&
(__v_13 & __v_10 ) == 0;
}
__v_8 >>= __v_7;
}
__v_14 = new __f_4();
__v_14.toSingle();
} catch(e) {}
Commit: [turbofan] Avoid introducing machine operators during typed lowering.
Date(Commit): Mon, 25 Jul 2016 03:37:25 -0700
Regress : test\mjsunit\regress\regress-crbug-630951.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() {
"use asm";
var o = new Int32Array(64 * 1024);
return () => { o[i1 >> 2] | 0; }
}
assertThrows(foo());
Commit: Native try-catch syntax parsing should not crash.
Date(Commit): Sun, 24 Jul 2016 22:32:11 -0700
Regress : test\mjsunit\regress\regress-crbug-630559.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
assertThrows("try{}%");
Commit: [turbofan] Handle impossible types (Type::None()) in the backend.
Date(Commit): Sun, 24 Jul 2016 21:00:16 -0700
Regress : test\mjsunit\compiler\regress-630611.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var global = 1;
global = 2;
function f() {
var o = { a : 1 };
global = "a";
for (var i = global; i < 2; i++) {
delete o[i];
}
}
f();
Commit: [elements] Omit fast path in PrependElementIndices
Date(Commit): Sat, 23 Jul 2016 05:13:32 -0700
Regress : test\mjsunit\regress\regress-crbug-630561.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --gc-interval=30
var dict_elements = {};
for (var i= 0; i< 100; i++) {
dict_elements[2147483648 + i] = i;
}
var keys = Object.keys(dict_elements);
Commit: Omit frames up to new target in Error constructor
Date(Commit): Fri, 22 Jul 2016 04:43:36 -0700
Regress : test\mjsunit\regress\regress-5216.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Ensure that custom error constructors don't show up in stack traces.
class MyError extends Error { }
assertFalse(new MyError().stack.includes("at MyError"));
Commit: MIPS: Fix infinite loop in Math.pow(2,-2147483648)
Date(Commit): Thu, 21 Jul 2016 12:34:16 -0700
Regress : test\mjsunit\regress\regress-5213.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// See http://code.google.com/p/v8/issues/detail?id=5213
assertEquals(0, Math.pow(2,-2147483648));
assertEquals(0, Math.pow(2,-9223372036854775808));
Commit: [arm] Fix infinite loop in Math.pow(2,2147483648).
Date(Commit): Thu, 21 Jul 2016 02:27:16 -0700
Regress : test\mjsunit\regress\regress-5214.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// See http://code.google.com/p/v8/issues/detail?id=5214
assertEquals(Infinity, Math.pow(2, 0x80000000));
assertEquals(Infinity, Math.pow(2, 0xc0000000));
assertEquals(0, Math.pow(2, -0x80000000));
Commit: Move Error methods to C++
Date(Commit): Wed, 20 Jul 2016 06:02:36 -0700
Regress : test\mjsunit\regress\regress-crbug-599067.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
try {
var o = {};
var p = new Proxy({}, o);
Error.captureStackTrace(p);
} catch(e) {
assertEquals("invalid_argument", e.message);
}
Commit: [regexp] Fix case-insensitive matching for one-byte subjects.
Date(Commit): Mon, 18 Jul 2016 05:03:04 -0700
Regress : test\mjsunit\regress\regress-5199.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertTrue(/(a[\u1000A])+/i.test('aa'));
Commit: [fullcode] Restore context after calling ToNumber builtin.
Date(Commit): Fri, 15 Jul 2016 06:17:43 -0700
Regress : test\mjsunit\regress\regress-crbug-628573.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var z = {valueOf: function() { return 3; }};
(function() {
try {
var tmp = { x: 12 };
with (tmp) {
z++;
}
throw new Error("boom");
} catch(e) {}
})();
Commit: [turbofan] Add re-typing for PlainPrimitiveToNumber during representation inference.
Date(Commit): Fri, 15 Jul 2016 03:37:15 -0700
Regress : test\mjsunit\compiler\regress-628516.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f() {
var i = 0;
while (1) {
if ({}) i = expected[0] == x[0];
i++;
}
}
assertThrows(f);
Commit: [test] Extend a test of destructuring.
Date(Commit): Thu, 14 Jul 2016 09:11:19 -0700
Regress : test\mjsunit\regress\regress-5178.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows(() => {
try { throw {} } catch({a=b, b}) { a+b }
}, ReferenceError);
try { throw {a: 42} } catch({a, b=a}) { assertEquals(42, b) };
Commit: [i18n] Make regression test work without i18n.
Date(Commit): Thu, 14 Jul 2016 05:29:50 -0700
Regress : test\mjsunit\regress\regress-crbug-627935.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
if (this.Intl) {
assertThrows("Intl.DateTimeFormat('en-US', {timeZone: 0})", RangeError);
assertThrows("Intl.DateTimeFormat('en-US', {timeZone: true})", RangeError);
assertThrows("Intl.DateTimeFormat('en-US', {timeZone: null})", RangeError);
var object = { toString: function() { return "UTC" } };
assertDoesNotThrow("Intl.DateTimeFormat('en-US', {timeZone: object})");
}
Commit: [stubs] Properly handle length overflow in StringAddStub.
Date(Commit): Thu, 14 Jul 2016 04:44:53 -0700
Regress : test\mjsunit\regress\regress-crbug-627934.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var x = "1".repeat(32 * 1024 * 1024);
for (var z = x;;) {
try {
z += {toString: function() { return x; }};
} catch (e) {
break;
}
}
Commit: [regexp] Fix regexp source escaping with preceding backslashes.
Date(Commit): Mon, 11 Jul 2016 22:34:32 -0700
Regress : test\mjsunit\regress\regress-crbug-515897.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var r1 = new RegExp("\\\\/");
assertTrue(r1.test("\\/"));
var r2 = eval("/" + r1.source + "/");
assertEquals("\\\\\\/", r1.source);
assertEquals("\\\\\\/", r2.source);
Date(Commit): Mon, 11 Jul 2016 08:48:54 -0700
Regress : test\mjsunit\regress\regress-crbug-626715.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Create a prototype object which has a lot of fast properties.
var body = "";
for (var i = 0; i < 100; i++) {
body += `this.a${i} = 0;\n`;
}
var Proto = new Function(body);
function A() {}
A.prototype = new Proto();
// Create a object and add properties that already exist in the prototype.
// At some point the object will turn into a dictionary mode and one of
// the fast details from the prototype will be reinterpreted as a details
// for a new property ...
var o = new A();
for (var i = 0; i < 100; i++) {
o["a" + i] = i;
}
// ... which will break the enumeration order of the slow properties.
var names = Object.getOwnPropertyNames(o);
for (var i = 0; i < 100; i++) {
assertEquals("a" + i, names[i]);
}
Commit: [keys] propagate PropertyFilter to proxy targets in KeyAccumulator
Date(Commit): Mon, 11 Jul 2016 03:38:33 -0700
Regress : test\mjsunit\regress\regress-5174.js
// // Use of this source code is governed by a BSD-style license that can be
// // found in the LICENSE file.
assertEquals([], Object.keys(new Proxy([], {})));
assertEquals([], Object.keys(new Proxy(/regex/, {})));
Commit: Correctly format builtin constructors in stack traces
Date(Commit): Mon, 11 Jul 2016 03:03:02 -0700
Regress : test\mjsunit\regress\regress-5173.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var thrower = { [Symbol.toPrimitive]: () => FAIL };
// Tests that a native conversion function is included in the
// stack trace.
function testTraceNativeConversion(nativeFunc) {
var nativeFuncName = nativeFunc.name;
try {
nativeFunc(thrower);
assertUnreachable(nativeFuncName);
} catch (e) {
assertTrue(e.stack.indexOf(nativeFuncName) >= 0, nativeFuncName);
}
}
testTraceNativeConversion(Math.max);
testTraceNativeConversion(Math.min);
function testBuiltinInStackTrace(script, expectedString) {
try {
eval(script);
assertUnreachable(expectedString);
} catch (e) {
assertTrue(e.stack.indexOf(expectedString) >= 0, expectedString);
}
}
testBuiltinInStackTrace("Date.prototype.getDate.call('')", "at String.getDate");
testBuiltinInStackTrace("Date.prototype.getUTCDate.call('')",
"at String.getUTCDate");
testBuiltinInStackTrace("Date.prototype.getTime.call('')", "at String.getTime");
testBuiltinInStackTrace("Number(thrower);", "at Number");
testBuiltinInStackTrace("new Number(thrower);", "at new Number");
testBuiltinInStackTrace("String(thrower);", "at String");
testBuiltinInStackTrace("new String(thrower);", "at new String");
// Ensure we correctly pick up the receiver's string tag.
testBuiltinInStackTrace("Math.acos(thrower);", "at Math.acos");
testBuiltinInStackTrace("Math.asin(thrower);", "at Math.asin");
testBuiltinInStackTrace("Math.fround(thrower);", "at Math.fround");
testBuiltinInStackTrace("Math.imul(thrower);", "at Math.imul");
// As above, but function passed as an argument and then called.
testBuiltinInStackTrace("((f, x) => f(x))(Math.acos, thrower);", "at acos");
testBuiltinInStackTrace("((f, x) => f(x))(Math.asin, thrower);", "at asin");
testBuiltinInStackTrace("((f, x) => f(x))(Math.fround, thrower);", "at fround");
testBuiltinInStackTrace("((f, x) => f(x))(Math.imul, thrower);", "at imul");
Commit: [builtins] Construct builtin frame in String/Number ctors
Date(Commit): Thu, 7 Jul 2016 23:35:14 -0700
Regress : test\mjsunit\regress\regress-4815.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var thrower = { [Symbol.toPrimitive]: () => FAIL };
// Tests that a native conversion function is included in the
// stack trace.
function testTraceNativeConversion(nativeFunc) {
var nativeFuncName = nativeFunc.name;
try {
nativeFunc(thrower);
assertUnreachable(nativeFuncName);
} catch (e) {
assertTrue(e.stack.indexOf(nativeFuncName) >= 0, nativeFuncName);
}
}
// C++ builtins.
testTraceNativeConversion(Math.acos);
testTraceNativeConversion(Math.asin);
testTraceNativeConversion(Math.fround);
testTraceNativeConversion(Math.imul);
function testBuiltinInStackTrace(script, expectedString) {
try {
eval(script);
assertUnreachable(expectedString);
} catch (e) {
assertTrue(e.stack.indexOf(expectedString) >= 0, expectedString);
}
}
// C++ builtins.
testBuiltinInStackTrace("Boolean.prototype.toString.call(thrower);",
"at Object.toString");
// Constructor builtins.
testBuiltinInStackTrace("new Date(thrower);", "at new Date");
// Ensure we correctly pick up the receiver's string tag.
testBuiltinInStackTrace("Math.acos(thrower);", "at Math.acos");
testBuiltinInStackTrace("Math.asin(thrower);", "at Math.asin");
testBuiltinInStackTrace("Math.fround(thrower);", "at Math.fround");
testBuiltinInStackTrace("Math.imul(thrower);", "at Math.imul");
// As above, but function passed as an argument and then called.
testBuiltinInStackTrace("((f, x) => f(x))(Math.acos, thrower);", "at acos");
testBuiltinInStackTrace("((f, x) => f(x))(Math.asin, thrower);", "at asin");
testBuiltinInStackTrace("((f, x) => f(x))(Math.fround, thrower);", "at fround");
testBuiltinInStackTrace("((f, x) => f(x))(Math.imul, thrower);", "at imul");
Commit: [ForIn] Fix HasEnumerableProperty for Proxies with null prototype
Date(Commit): Thu, 7 Jul 2016 03:09:55 -0700
Regress : test\mjsunit\regress\regress-5181.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var target = Object.create(null);
var proxy = new Proxy(target, {
ownKeys: function() {
return ['a'];
}
});
for (var key in proxy) ;
Date(Commit): Mon, 4 Jul 2016 04:41:17 -0700
Regress : test\mjsunit\regress\regress-crbug-625590.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var obj = {};
function f() {}
f.prototype = {
mSloppy() {
super[obj] = 15;
}
};
new f().mSloppy();
Commit: [turbofan] Better handling of empty type in simplified lowering.
Date(Commit): Mon, 4 Jul 2016 01:42:24 -0700
Regress : test\mjsunit\compiler\regress-625558.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
for (var global = 0; global <= 256; global++) { }
function f() {
global = "luft";
global += ++global;
}
f();
Commit: Implement immutable prototype chains
Date(Commit): Fri, 1 Jul 2016 12:16:53 -0700
Regress : test\mjsunit\regress\regress-crbug-571517.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function Receiver() { this.receiver = "receiver"; }
function Proto() { this.proto = "proto"; }
function f(a) {
return a.foo;
}
var rec = new Receiver();
// Formerly, this mutated rec.__proto__.__proto__, but
// the global object prototype chain is now immutable;
// not sure if this test now hits the original hazard case.
var proto = rec.__proto__;
// Initialize prototype chain dependent IC (nonexistent load).
assertEquals(undefined, f(rec));
assertEquals(undefined, f(rec));
// Add a new prototype to the end of the chain.
var p2 = new Proto();
p2.__proto__ = null;
proto.__proto__ = p2;
// Update the IC.
assertEquals(undefined, f(rec));
// Now modify the most recently added prototype by adding a property...
p2.foo = "bar";
assertEquals("bar", f(rec));
// ...and removing it again. Due to missing prototype user registrations,
// this fails to invalidate the IC.
delete p2.foo;
p2.secret = "GAME OVER";
assertEquals(undefined, f(rec));
Commit: Do all parsing for try/catch destructuring inside the appropriate scopes
Date(Commit): Wed, 29 Jun 2016 23:49:18 -0700
Regress : test\mjsunit\regress\regress-5106.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function* g1() {
try {
throw {};
} catch ({a = class extends (yield) {}}) {
}
}
g1().next(); // crashes without fix
function* g2() {
let x = function(){};
try {
throw {};
} catch ({b = class extends x {}}) {
}
}
g2().next(); // crashes without fix
function* g3() {
let x = 42;
try {
throw {};
} catch ({c = (function() { return x })()}) {
}
}
g3().next(); // throws a ReferenceError without fix
Commit: Fix bug with re-scoping arrow function parameter initializers
Date(Commit): Tue, 28 Jun 2016 08:08:45 -0700
Regress : test\mjsunit\regress\regress-622663.js
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy
(function() {
try { (y = [...[]]) => {} } catch(_) {} // will core dump, if not fixed
})();
(function() {
try { ((y = [...[]]) => {})(); } catch(_) {} // will core dump, if not fixed,
// even without --no-lazy
})();
Commit: Remove all harmony runtime flags which shipped in M51
Date(Commit): Thu, 23 Jun 2016 18:11:08 -0700
Regress : test\mjsunit\regress\regress-crbug-605862.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
/[]*1/u.exec("\u1234");
/[^\u0000-\u{10ffff}]*1/u.exec("\u1234");
Commit: Rewrite scopes in computed properties in destructured parameters
Date(Commit): Thu, 23 Jun 2016 13:47:00 -0700
Regress : test\mjsunit\regress\regress-crbug-620119.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --no-lazy
assertEquals(0, ((x, {[(x = function() { y = 0 }, "foo")]: y = eval(1)}) => { x(); return y })(42, {}));
assertEquals(0, (function (x, {[(x = function() { y = 0 }, "foo")]: y = eval(1)}) { x(); return y })(42, {}));
Commit: Array splice should only normalize deleted_elements if it's an array
Date(Commit): Thu, 23 Jun 2016 10:20:32 -0700
Regress : test\mjsunit\regress\regress-crbug-618788.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Slice and splice both try to set the length property of their return
// value. Add a bogus setter to allow that.
Object.defineProperty(Int32Array.prototype, 'length', { set(v) { } });
(function testSlice() {
var a = new Array();
a.constructor = Int32Array;
a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
assertTrue(a.slice() instanceof Int32Array);
})();
(function testSplice() {
var a = new Array();
a.constructor = Int32Array;
a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
assertTrue(a.splice(1) instanceof Int32Array);
})();
Commit: [mips] Fix using signaling NaN for holes in fixed double arrays.
Date(Commit): Thu, 23 Jun 2016 01:26:53 -0700
Regress : test\mjsunit\regress\regress-crbug-620650.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function() {
function f(src, dst, i) {
dst[i] = src[i];
}
var buf = new ArrayBuffer(16);
var view_int32 = new Int32Array(buf);
view_int32[1] = 0xFFF7FFFF;
var view_f64 = new Float64Array(buf);
var arr = [,0.1];
f(view_f64, arr, -1);
f(view_f64, arr, 0);
})();
Date(Commit): Wed, 22 Jun 2016 14:07:53 -0700
Regress : test\mjsunit\regress\regress-616386.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --no-lazy
assertEquals(0, ((y = (function(a2) { bbbb = a2 }), bbbb = eval('1')) => {y(0); return bbbb})())
assertEquals(0, (({y = (function(a2) { bbbb = a2 }), bbbb = eval('1')} = {}) => {y(0); return bbbb})())
assertEquals(0, (function (y = (function(a2) { bbbb = a2 }), bbbb = eval('1')) {y(0); return bbbb})())
assertEquals(0, (function ({y = (function(a2) { bbbb = a2 }), bbbb = eval('1')} = {}) {y(0); return bbbb})())
Commit: Fix bug with illegal spread as single arrow parameter
Date(Commit): Wed, 22 Jun 2016 11:05:06 -0700
Regress : test\mjsunit\harmony\regress\regress-crbug-621496.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function testIllegalSpreadAsSingleArrowParameter() {
assertThrows("(...[42]) => 42)", SyntaxError) // will core dump, if not fixed
})();
Commit: [heap] Filter out stale left-trimmed handles for scavenges
Date(Commit): Wed, 22 Jun 2016 05:21:16 -0700
Regress : test\mjsunit\regress\regress-621869.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
var o0 = [];
var o1 = [];
var cnt = 0;
var only_scavenge = true;
o1.__defineGetter__(0, function() {
if (cnt++ > 2) return;
o0.shift();
gc(only_scavenge);
o0.push((64));
o0.concat(o1);
});
o1[0];
Commit: [heap] Fix check in AdvancePage
Date(Commit): Wed, 22 Jun 2016 02:07:30 -0700
Regress : test\mjsunit\regress\regress-620750.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --es-staging
function push_a_lot(arr) {
for (var i = 0; i < 2e4; i++) {
arr.push(i);
}
return arr;
}
__v_13 = push_a_lot([]);
Commit: Fix classifier related bug
Date(Commit): Tue, 21 Jun 2016 09:40:22 -0700
Regress : test\mjsunit\harmony\regress\regress-crbug-621111.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(y = 1[1, [...[]]]) => 1; // will core dump, if not fixed
(y = 1[1, [...[]]]) => {}; // will core dump, if not fixed
Commit: [builtins] Make sure the Math functions and constants agree.
Date(Commit): Tue, 21 Jun 2016 00:01:59 -0700
Regress : test\mjsunit\regress\regress-crbug-621611.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertEquals(Math.E, Math.exp(1));
assertEquals(Math.LN10, Math.log(10));
assertEquals(Math.LN2, Math.log(2));
assertEquals(Math.LOG10E, Math.log10(Math.E));
assertEquals(Math.LOG2E, Math.log2(Math.E));
assertEquals(Math.SQRT1_2, Math.sqrt(0.5));
assertEquals(Math.SQRT2, Math.sqrt(2));
Commit: [heap] Filter out stale left-trimmed handles
Date(Commit): Mon, 20 Jun 2016 07:29:54 -0700
Regress : test\mjsunit\regress\regress-620553.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
var o0 = [];
var o1 = [];
var cnt = 0;
o1.__defineGetter__(0, function() {
if (cnt++ > 2) return;
o0.shift();
gc();
o0.push(0);
o0.concat(o1);
});
o1[0];
Commit: [d8] Make exception reporting more resilient.
Date(Commit): Thu, 16 Jun 2016 03:12:06 -0700
Regress : test\mjsunit\regress\regress-crbug-620253.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --throws
load("test/mjsunit/regress/regress-crbug-620253.js");
Commit: Promises: Add regression test for promise resolution with proxy
Date(Commit): Wed, 15 Jun 2016 18:58:47 -0700
Regress : test\mjsunit\regress\regress-5004.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function assertAsync(b, s) {
if (!b) {
%AbortJS(" FAILED!")
}
}
class P extends Promise {
constructor() {
super(...arguments)
return new Proxy(this, {
get: (_, key) => {
return key == 'then' ?
this.then.bind(this) :
this.constructor.resolve(20)
}
})
}
}
let p = P.resolve(10)
p.key.then(v => assertAsync(v === 20));
Commit: [test] Bump stack size of regression test.
Date(Commit): Wed, 15 Jun 2016 04:18:55 -0700
Regress : test\mjsunit\regress\regress-1132.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Test the case when exception is thrown from the parser when lazy
// compiling a function.
// Flags: --stack-size=100
// NOTE: stack size constant above has been empirically chosen.
// If the test starts to fail in Genesis, consider increasing this constant.
function test() {
try {
test(1, test(1));
} catch(e) {
assertFalse(delete e, "deleting catch variable");
assertEquals(42, e);
}
}
var exception = false;
try {
test();
} catch (e) {
exception = true;
}
assertTrue(exception);
Commit: [Heap] Fix comparing against new space top pointer
Date(Commit): Tue, 14 Jun 2016 06:49:47 -0700
Regress : test\mjsunit\regress\regress-619382.js
// // Use of this source code is governed by a BSD-style license that can be
// // found in the LICENSE file.
//
// // Flags: --expose-gc --always-opt
(function __f_9() {
})();
function __f_16(ctor_desc) {
var __v_22 = 5;
var __v_25 = [];
gc(); gc(); gc();
for (var __v_18 = 0; __v_18 < __v_22; __v_18++) {
__v_25[__v_18] = ctor_desc.ctor.apply();
}
}
var __v_28 = [
{
ctor: function(__v_27) { return {a: __v_27}; },
args: function() { return [1.5 + __v_18]; } },
{
ctor: function(__v_27) { var __v_21 = []; __v_21[1] = __v_27; __v_21[200000] = __v_27; return __v_21; },
args: function() { return [1.5 + __v_18]; } },
{
ctor: function() {
} }
];
var __v_26 = [
{
}];
__v_26.forEach(function(__v_16) {
__v_28.forEach(function(ctor) {
__f_16(ctor);
});
});
Commit: Fix stale IC::receiver_map_ after prototype fastification
Date(Commit): Fri, 10 Jun 2016 04:42:27 -0700
Regress : test\mjsunit\regress\regress-crbug-618845.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function Foo() {}
Object.defineProperty(Foo.prototype, "name",
{get: function() { return "FooName"; }});
function ic(f) {
return f.prototype.name;
}
assertEquals("FooName", ic(Foo));
assertEquals("FooName", ic(Foo)); // Don't crash, don't time out.
Commit: Add test case for 85b8c2dc (fix observable array access in messages.js).
Date(Commit): Wed, 8 Jun 2016 00:53:18 -0700
Regress : test\mjsunit\regress\regress-crbug-617527.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --enable-slow-asserts
Object.defineProperty(Array.prototype, "1", { get: toLocaleString });
assertThrows(_ => new RegExp(0, 0));
Date(Commit): Tue, 7 Jun 2016 02:46:55 -0700
Regress : test\mjsunit\regress\regress-crbug-617524.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --always-opt
function f(a,b,c) {
a.a = b;
a[1] = c;
return a;
}
f(new Array(5),.5,0);
var o1 = f(new Array(5),0,.5);
gc();
var o2 = f(new Array(5),0,0);
var o3 = f(new Array(5),0);
assertEquals(0, o3.a);
Commit: math.js: Use %_TypedArrayGetLength to get length
Date(Commit): Wed, 1 Jun 2016 11:41:58 -0700
Regress : test\mjsunit\regress\regress-615776.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Object.defineProperty(Int32Array.prototype.__proto__, 'length', {
get: function() { throw new Error('Custom length property'); }
});
var a = Math.random();
// This tests MathRandomRaw.
var v0 = new Set();
var v1 = new Object();
v0.add(v1);
Commit: [runtime] Ensure that all elements kind transitions are chained to the root map.
Date(Commit): Wed, 1 Jun 2016 08:54:16 -0700
Regress : test\mjsunit\regress\regress-v8-5009.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function fn1() {
}
function fn2() {
}
function fn3() {
}
function create(id) {
// Just some `FunctionTemplate` to hang on
var o = new version();
o.id = id;
o[0] = null;
return o;
}
function setM1(o) {
o.m1 = fn1;
}
function setM2(o) {
o.m2 = fn2;
}
function setAltM2(o) {
// Failing StoreIC happens here
o.m2 = fn3;
}
function setAltM1(o) {
o.m1 = null;
}
function test(o) {
o.m2();
o.m1();
}
var p0 = create(0);
var p1 = create(1);
var p2 = create(2);
setM1(p0);
setM1(p1);
setM1(p2);
setM2(p0);
setAltM2(p0);
setAltM1(p0);
setAltM2(p1);
setAltM2(p2);
test(p2);
Commit: Check CallSite arguments more rigorously
Date(Commit): Mon, 30 May 2016 03:27:03 -0700
Regress : test\mjsunit\regress\regress-crbug-615774.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Error.prepareStackTrace = (e,s) => s;
var CallSiteConstructor = Error().stack[0].constructor;
try {
(new CallSiteConstructor(CallSiteConstructor, 6)).toString();
} catch (e) {
}
Commit: [builtins] Rewrite uri.js as builtin functions.
Date(Commit): Fri, 27 May 2016 02:56:04 -0700
Regress : test\mjsunit\regress\regress-crbug-612109.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
s = "string for triggering osr in __f_0";
for (var i = 0; i < 16; i++) s = s + s;
decodeURI(encodeURI(s));
Commit: [json] fix encoding change for two-byte gap strings.
Date(Commit): Mon, 23 May 2016 02:16:28 -0700
Regress : test\mjsunit\regress\regress-crbug-613570.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertEquals("[\n\u26031,\n\u26032\n]",
JSON.stringify([1, 2], null, "\u2603"));
Commit: [runtime] Don't crash when trying to access manually constructed CallSite object.
Date(Commit): Mon, 23 May 2016 02:00:07 -0700
Regress : test\mjsunit\regress\regress-crbug-613905.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Error.prepareStackTrace = (e,s) => s;
var CallSiteConstructor = Error().stack[0].constructor;
try {
(new CallSiteConstructor(3, 6)).toString();
} catch (e) {
}
Commit: Remove now-incorrect DataView accessor optimization
Date(Commit): Thu, 19 May 2016 12:47:56 -0700
Regress : test\mjsunit\regress\regress-5018.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var dv = new DataView(new ArrayBuffer(4), 2);
function getByteLength(a) {
return a.byteLength;
}
assertEquals(2, getByteLength(dv));
assertEquals(2, getByteLength(dv));
Object.defineProperty(dv.__proto__, 'byteLength', {value: 42});
assertEquals(42, dv.byteLength);
assertEquals(42, getByteLength(dv));
function getByteOffset(a) {
return a.byteOffset;
}
assertEquals(2, getByteOffset(dv));
assertEquals(2, getByteOffset(dv));
Object.defineProperty(dv.__proto__, 'byteOffset', {value: 42});
assertEquals(42, dv.byteOffset);
assertEquals(42, getByteOffset(dv));
Commit: [turbofan] Kill type Guard nodes during effect/control linearization.
Date(Commit): Tue, 17 May 2016 22:36:51 -0700
Regress : test\mjsunit\regress\regress-crbug-612142.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var thrower = {[Symbol.toPrimitive]: function(e) { throw e }};
try {
for (var i = 0; i < 10; i++) { }
for (var i = 0.5; i < 100000; ++i) { }
for (var i = 16 | 0 || 0 || this || 1; i;) { String.fromCharCode(thrower); }
} catch (e) { }
Commit: Revert "Fix TypedArray Property optimizations", add regression test and eliminate dead code
Date(Commit): Fri, 13 May 2016 15:30:40 -0700
Regress : test\mjsunit\regress\regress-610633.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function getLength(a) {
return a.length;
}
function getByteLength(a) {
return a.byteLength;
}
function getByteOffset(a) {
return a.byteOffset;
}
var a = new Uint8Array([1, 2, 3]);
getLength(a);
getLength(a);
Object.defineProperty(a.__proto__, 'length', {value: 42});
assertEquals(42, getLength(a));
assertEquals(42, a.length);
getByteLength(a);
getByteLength(a);
Object.defineProperty(a.__proto__, 'byteLength', {value: 42});
assertEquals(42, getByteLength(a));
assertEquals(42, a.byteLength);
getByteOffset(a);
getByteOffset(a);
Object.defineProperty(a.__proto__, 'byteOffset', {value: 42});
assertEquals(42, getByteOffset(a));
assertEquals(42, a.byteOffset);
Commit: Don't crash when load eval origin of a call site.
Date(Commit): Mon, 9 May 2016 02:00:04 -0700
Regress : test\mjsunit\regress\regress-crbug-610207.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Error.prepareStackTrace = function(exception, frames) {
return frames[0].getEvalOrigin();
}
try {
Realm.eval(0, "throw new Error('boom');");
} catch(e) {
print(e.stack);
}
Commit: Don't treat catch scopes as possibly-shadowing for sloppy eval
Date(Commit): Wed, 4 May 2016 14:34:43 -0700
Regress : test\mjsunit\regress\regress-crbug-608279.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --always-opt --no-lazy
function __f_38() {
try {
throw 0;
} catch (e) {
eval();
var __v_38 = { a: 'hest' };
__v_38.m = function () { return __v_38.a; };
}
return __v_38;
}
var __v_40 = __f_38();
__v_40.m();
Commit: [turbofan] Implement %_NewObject using FastNewObjectStub.
Date(Commit): Wed, 4 May 2016 00:33:26 -0700
Regress : test\mjsunit\regress\regress-crbug-609029.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --always-opt --function-context-specialization --gc-interval=14
// Flags: --turbo-filter=match --verify-heap
"xxx".match();
Commit: Use InternalArrays from certain Intl code
Date(Commit): Mon, 2 May 2016 11:18:42 -0700
Regress : test\mjsunit\regress\regress-crbug-604299.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Array.prototype.__defineSetter__(0,function(value){});
if (this.Intl) {
var o = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Katmandu'})
}
Commit: [full-codegen] Fix stack depth tracking when reporting unsupported super usages
Date(Commit): Mon, 2 May 2016 10:28:40 -0700
Regress : test\mjsunit\regress\regress-4967.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows(() => {
new class extends Object {
constructor() { (() => delete super[super()])(); }
}
}, ReferenceError);
Commit: [runtime] Don't crash when creating an instance of a class inherited from a Proxy.
Date(Commit): Fri, 29 Apr 2016 08:06:58 -0700
Regress : test\mjsunit\regress\regress-v8-4972.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
new class extends new Proxy(class {},{}) {}
Commit: Check the state of the current binary op IC before patching smi code
Date(Commit): Wed, 27 Apr 2016 02:16:38 -0700
Regress : test\mjsunit\regress\regress-recurse-patch-binary-op.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var i = 0
function valueOf() {
while (true) return i++ < 4 ? 1 + this : 2
}
1 + ({valueOf})
Commit: Forward accept_IN to ParseYieldExpression
Date(Commit): Tue, 26 Apr 2016 10:24:22 -0700
Regress : test\mjsunit\regress\regress-4945.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function* g(o) {
yield 'x' in o;
}
assertTrue(g({x: 1}).next().value);
assertFalse(g({}).next().value);
Commit: MigrateInstance(target) before Object.assign(target, ...)
Date(Commit): Mon, 25 Apr 2016 08:40:38 -0700
Regress : test\mjsunit\regress\regress-object-assign-deprecated.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var x = {a:1, b:2};
var y = {a:1, b:2.5};
Object.assign(x, x);
Commit: [tests] Add testcase for r35397
Date(Commit): Fri, 22 Apr 2016 02:08:16 -0700
Regress : test\mjsunit\regress\regress-crbug-602184.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(test, a) {
var v;
if (test) {
v = v|0;
}
a[v] = 1;
}
var v = new String();
f(false, v);
f(false, v);
v = new Int32Array(10);
f(true, v);
Commit: More accurately record an end position for default parameters in arrows
Date(Commit): Wed, 20 Apr 2016 13:48:32 -0700
Regress : test\mjsunit\regress\regress-4908.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --always-opt --no-lazy
(function() { ((s = 17, y = s) => s)() })();
Commit: Fix polymorphic keyed load handler selection for proxies.
Date(Commit): Tue, 19 Apr 2016 01:56:53 -0700
Regress : test\mjsunit\regress\regress-crbug-603463.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function load(a, i) {
return a[i];
}
function f() {
return load(new Proxy({}, {}), undefined);
}
f();
f();
load([11, 22, 33], 0);
f();
Commit: [turbofan] Optimize typeof in abstract/strict equality comparison.
Date(Commit): Mon, 18 Apr 2016 00:03:11 -0700
Regress : test\mjsunit\regress\regress-674753.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --allow-natives-syntax
var undetectable = %GetUndetectable();
// Number
assertTrue(typeof 0 == 'number');
assertTrue(typeof 0 === 'number');
assertFalse(typeof 0 != 'number');
assertFalse(typeof 0 !== 'number');
assertTrue(typeof 1.2 == 'number');
assertTrue(typeof 1.2 === 'number');
assertFalse(typeof 1.2 != 'number');
assertFalse(typeof 1.2 !== 'number');
assertTrue(typeof 'x' != 'number');
assertTrue(typeof 'x' !== 'number');
assertFalse(typeof 'x' == 'number');
assertFalse(typeof 'x' === 'number');
assertTrue(typeof Object() != 'number');
assertTrue(typeof Object() !== 'number');
assertFalse(typeof Object() == 'number');
assertFalse(typeof Object() === 'number');
// String
assertTrue(typeof 'x' == 'string');
assertTrue(typeof 'x' === 'string');
assertFalse(typeof 'x' != 'string');
assertFalse(typeof 'x' !== 'string');
assertTrue(typeof ('x' + 'x') == 'string');
assertTrue(typeof ('x' + 'x') === 'string');
assertFalse(typeof ('x' + 'x') != 'string');
assertFalse(typeof ('x' + 'x') !== 'string');
assertTrue(typeof 1 != 'string');
assertTrue(typeof 1 !== 'string');
assertFalse(typeof 1 == 'string');
assertFalse(typeof 1 === 'string');
assertTrue(typeof Object() != 'string');
assertTrue(typeof Object() !== 'string');
assertFalse(typeof Object() == 'string');
assertFalse(typeof Object() === 'string');
// Boolean
assertTrue(typeof true == 'boolean');
assertTrue(typeof true === 'boolean');
assertFalse(typeof true != 'boolean');
assertFalse(typeof true !== 'boolean');
assertTrue(typeof false == 'boolean');
assertTrue(typeof false === 'boolean');
assertFalse(typeof false != 'boolean');
assertFalse(typeof false !== 'boolean');
assertTrue(typeof 1 != 'boolean');
assertTrue(typeof 1 !== 'boolean');
assertFalse(typeof 1 == 'boolean');
assertFalse(typeof 1 === 'boolean');
assertTrue(typeof 'x' != 'boolean');
assertTrue(typeof 'x' !== 'boolean');
assertFalse(typeof 'x' == 'boolean');
assertFalse(typeof 'x' === 'boolean');
assertTrue(typeof Object() != 'boolean');
assertTrue(typeof Object() !== 'boolean');
assertFalse(typeof Object() == 'boolean');
assertFalse(typeof Object() === 'boolean');
// Undefined
assertTrue(typeof void 0 == 'undefined');
assertTrue(typeof void 0 === 'undefined');
assertFalse(typeof void 0 != 'undefined');
assertFalse(typeof void 0 !== 'undefined');
assertTrue(typeof 1 != 'undefined');
assertTrue(typeof 1 !== 'undefined');
assertFalse(typeof 1 == 'undefined');
assertFalse(typeof 1 === 'undefined');
assertTrue(typeof null != 'undefined');
assertTrue(typeof null !== 'undefined');
assertFalse(typeof null == 'undefined');
assertFalse(typeof null === 'undefined');
assertTrue(typeof Object() != 'undefined');
assertTrue(typeof Object() !== 'undefined');
assertFalse(typeof Object() == 'undefined');
assertFalse(typeof Object() === 'undefined');
assertTrue(typeof undetectable == 'undefined');
assertTrue(typeof undetectable === 'undefined');
assertFalse(typeof undetectable != 'undefined');
assertFalse(typeof undetectable !== 'undefined');
// Function
assertTrue(typeof Object == 'function');
assertTrue(typeof Object === 'function');
assertFalse(typeof Object != 'function');
assertFalse(typeof Object !== 'function');
assertTrue(typeof 1 != 'function');
assertTrue(typeof 1 !== 'function');
assertFalse(typeof 1 == 'function');
assertFalse(typeof 1 === 'function');
assertTrue(typeof Object() != 'function');
assertTrue(typeof Object() !== 'function');
assertFalse(typeof Object() == 'function');
assertFalse(typeof Object() === 'function');
assertTrue(typeof undetectable != 'function');
assertTrue(typeof undetectable !== 'function');
assertFalse(typeof undetectable == 'function');
assertFalse(typeof undetectable === 'function');
// Object
assertTrue(typeof Object() == 'object');
assertTrue(typeof Object() === 'object');
assertFalse(typeof Object() != 'object');
assertFalse(typeof Object() !== 'object');
assertTrue(typeof new String('x') == 'object');
assertTrue(typeof new String('x') === 'object');
assertFalse(typeof new String('x') != 'object');
assertFalse(typeof new String('x') !== 'object');
assertTrue(typeof ['x'] == 'object');
assertTrue(typeof ['x'] === 'object');
assertFalse(typeof ['x'] != 'object');
assertFalse(typeof ['x'] !== 'object');
assertTrue(typeof null == 'object');
assertTrue(typeof null === 'object');
assertFalse(typeof null != 'object');
assertFalse(typeof null !== 'object');
assertTrue(typeof 1 != 'object');
assertTrue(typeof 1 !== 'object');
assertFalse(typeof 1 == 'object');
assertFalse(typeof 1 === 'object');
assertTrue(typeof 'x' != 'object');
assertTrue(typeof 'x' !== 'object');
assertFalse(typeof 'x' == 'object'); // bug #674753
assertFalse(typeof 'x' === 'object');
assertTrue(typeof Object != 'object');
assertTrue(typeof Object !== 'object');
assertFalse(typeof Object == 'object');
assertFalse(typeof Object === 'object');
assertTrue(typeof undetectable != 'object');
assertTrue(typeof undetectable !== 'object');
assertFalse(typeof undetectable == 'object');
assertFalse(typeof undetectable === 'object');
Commit: Security: type confusion lead to information leak in decodeURI
Date(Commit): Fri, 15 Apr 2016 06:08:17 -0700
Regress : test\mjsunit\regress\regress-602970.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --debug-code
// flag --debug-code ensures that we'll abort with a failed smi check without
// the fix.
var num = new Number(10);
Array.prototype.__defineGetter__(0,function(){
return num;
})
Array.prototype.__defineSetter__(0,function(value){
})
var str=decodeURI("%E7%9A%84");
assertEquals(0x7684, str.charCodeAt(0));
Commit: [regexp] fix assertion failure when parsing close to stack overflow.
Date(Commit): Thu, 14 Apr 2016 07:43:29 -0700
Regress : test\mjsunit\regress\regress-crbug-600257.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --stack-size=100
(function rec() {
try {
rec();
} catch (e) {
/{/;
}
})();
Commit: Remove runtime flags for sloppy mode block scoping features
Date(Commit): Thu, 7 Apr 2016 17:29:37 -0700
Regress : test\mjsunit\regress\regress-crbug-451770.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows(function f() {
var t = { toString: function() { throw new Error(); } };
var o = { [t]: 23 };
}, Error);
assertThrows(function f() {
var t = { toString: function() { throw new Error(); } };
class C { [t]() { return 23; } };
}, Error);
Commit: Fix representation issue in FastArrayPushStub
Date(Commit): Thu, 7 Apr 2016 05:44:09 -0700
Regress : test\mjsunit\regress\regress-599089-array-push.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var array = [1.2, 1.2];
array.length = 0;
array.push(undefined);
assertEquals(1, array.length);
assertEquals([undefined], array);
Commit: Ensure CreateDataProperty works correctly on TypedArrays
Date(Commit): Tue, 5 Apr 2016 09:55:16 -0700
Regress : test\mjsunit\regress\regress-crbug-596394.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// In ES#sec-array.prototype.concat
// When concat makes a new integer-indexed exotic object, the resulting properties
// are non-configurable and cannot have CreateDataPropertyOrThrow called on them,
// so it throws a TypeError on failure to make a new property.
__v_0 = new Uint8Array(100);
array = new Array(10);
array.__proto__ = __v_0;
assertThrows(() => Array.prototype.concat.call(array), TypeError);
Commit: Fix treatment of rest pattern in array destructuring.
Date(Commit): Tue, 5 Apr 2016 01:56:07 -0700
Regress : test\mjsunit\es6\regress\regress-4759.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function iterable(done) {
return {
[Symbol.iterator]: function() {
return {
next: function() {
if (done) return { done: true };
done = true;
return { value: 42, done: false };
}
}
}
}
}
var [...result] = iterable(true);
assertEquals([], result);
var [...result] = iterable(false);
assertEquals([42], result);
Commit: [frames] Also properly deal with TF builtins in OptimizedFrame::GetFunctions().
Date(Commit): Mon, 4 Apr 2016 23:40:59 -0700
Regress : test\mjsunit\regress\regress-crbug-599714.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var custom_toString = function() {
var boom = custom_toString.caller;
return boom;
}
var object = {};
object.toString = custom_toString;
try { Object.hasOwnProperty(object); } catch (e) {}
Commit: [ic] Use the CallFunction builtin to invoke accessors.
Date(Commit): Thu, 31 Mar 2016 23:37:39 -0700
Regress : test\mjsunit\regress\regress-crbug-599073-4.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Object.defineProperty(Number.prototype, "v", {set:constructor});
function foo(b) { b.v = 1; }
foo(2);
foo(3);
foo(4);
Commit: [Interpreter] Changes GenerateDoubleToObject to push and pop rsi value.
Date(Commit): Thu, 31 Mar 2016 06:44:44 -0700
Regress : test\mjsunit\ignition\regress-597565-double-to-object-transition.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --no-inline-new
function __f_2(b, value) {
b[1] = value;
}
function __f_9() {
var arr = [1.5, 0, 0];
// Call with a double, so the expected element type is double.
__f_2(1.5);
// Call with an object, which triggers transition from FAST_double
// to Object for the elements type.
__f_2(arr);
}
__f_9();
Commit: [crankshaft] Address the deoptimization loops of Math.floor, Math.round and Math.ceil.
Date(Commit): Tue, 29 Mar 2016 03:24:25 -0700
Regress : test\mjsunit\regress\regress-crbug-476477-1.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var obj = {
_leftTime: 12345678,
_divider: function() {
var s = Math.floor(this._leftTime / 3600);
var e = Math.floor(s / 24);
var i = s % 24;
return {
s: s,
e: e,
i: i,
}
}
}
for (var i = 0; i < 1000; i++) {
obj._divider();
}
Commit: Remove --harmony-regexps flag
Date(Commit): Fri, 25 Mar 2016 16:01:07 -0700
Regress : test\mjsunit\regress\regress-crbug-548580.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function store(v) {
var re = /(?=[d#.])/;
re.a = v;
return re;
}
var re1 = store(undefined);
var re2 = store(42);
assertEquals(re1.a, undefined);
assertEquals(re2.a, 42);
Commit: [Atomics] Fix atomic access index validation
Date(Commit): Fri, 25 Mar 2016 14:52:15 -0700
Regress : test\mjsunit\regress\regress-crbug-501809.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --harmony-sharedarraybuffer
var sab = new SharedArrayBuffer(8);
var ta = new Int32Array(sab);
ta.__defineSetter__('length', function() {;});
assertThrows(function() {
Atomics.compareExchange(ta, 4294967295, 0, 0);
}, RangeError);
Commit: Check for proper types from error handling code
Date(Commit): Thu, 24 Mar 2016 19:08:44 -0700
Regress : test\mjsunit\regress\regress-596718.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Error.prepareStackTrace = function(e, frames) { return frames; }
assertThrows(() => new Error().stack[0].getMethodName.call({}), TypeError);
Error.prepareStackTrace = function(e, frames) { return frames.map(frame => new Proxy(frame, {})); }
assertThrows(() => new Error().stack[0].getMethodName(), TypeError);
Error.prepareStackTrace = function(e, frames) { return frames; }
assertEquals(null, new Error().stack[0].getMethodName());
Commit: Remove support for legacy const, part 1
Date(Commit): Tue, 22 Mar 2016 10:51:13 -0700
Regress : test\mjsunit\regress\regress-88591.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Regression test for a crash. A data property in the global object's
// prototype shadowed by a setter in the global object's prototype's
// prototype would crash or assert when seen by Runtime_DeclareContextSlot.
var called = false;
Object.prototype.__defineSetter__('x', function(x) { called = true; });
Object.prototype.__defineGetter__('x', function () { return 0; });
this.__proto__ = { x: 1 };
try { fail; } catch (e) { eval('var x = 2'); }
var o = Object.getOwnPropertyDescriptor(this, 'x');
assertFalse(called);
assertEquals(2, o.value);
assertEquals(true, o.writable);
Commit: Remove runtime flags for Proxy and Reflect
Date(Commit): Mon, 21 Mar 2016 12:39:16 -0700
Regress : test\mjsunit\regress\regress-crbug-506956.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
try {
var p = new Proxy({}, {
getPropertyDescriptor: function() { throw "boom"; }
});
var o = Object.create(p);
with (o) { delete unresolved_name; }
} catch(e) {
}
Commit: [json] Allow any callable object for toJSON.
Date(Commit): Sun, 20 Mar 2016 12:34:55 -0700
Regress : test\mjsunit\regress\regress-crbug-595738.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function foo() { return 1; }
var x = {toJSON: foo.bind()};
assertEquals("1", JSON.stringify(x));
Commit: Several mjsunit cleanups
Date(Commit): Fri, 18 Mar 2016 16:19:03 -0700
Regress : test\mjsunit\regress\regress-554865.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function() {
var x = {};
((y = [42]) => assertEquals(42, y[0]))();
})();
Commit: [regexp] catch stack overflow when parsing back references.
Date(Commit): Fri, 18 Mar 2016 07:52:28 -0700
Regress : test\mjsunit\regress\regress-crbug-595657.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --stack-size=100
function test() {
try {
test();
} catch(e) {
/(\2)(a)/.test("");
}
}
test();
Commit: Throw the right exceptions from setting elements in Array.prototype.concat
Date(Commit): Thu, 17 Mar 2016 15:41:24 -0700
Regress : test\mjsunit\regress\regress-595319.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// https://bugs.chromium.org/p/chromium/issues/detail?id=595319
// Ensure exceptions are checked for by Array.prototype.concat from adding
// an element, and that elements are added to array subclasses appropriately
// If adding a property does throw, the exception is propagated
class MyException extends Error { }
class NoDefinePropertyArray extends Array {
constructor(...args) {
super(...args);
return new Proxy(this, {
defineProperty() { throw new MyException(); }
});
}
}
assertThrows(() => new NoDefinePropertyArray().concat([1]), MyException);
// Ensure elements are added to the instance, rather than calling [[Set]].
class ZeroGetterArray extends Array { get 0() {} };
assertArrayEquals([1], new ZeroGetterArray().concat(1));
// Frozen arrays lead to throwing
class FrozenArray extends Array {
constructor(...args) { super(...args); Object.freeze(this); }
}
assertThrows(() => new FrozenArray().concat([1]), TypeError);
// Non-configurable non-writable zero leads to throwing
class ZeroFrozenArray extends Array {
constructor(...args) {
super(...args);
Object.defineProperty(this, 0, {value: 1});
}
}
assertThrows(() => new ZeroFrozenArray().concat([1]), TypeError);
Commit: Fix polymorphic keyed load handler selection for string elements
Date(Commit): Wed, 16 Mar 2016 03:55:08 -0700
Regress : test\mjsunit\regress\regress-crbug-594955.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function g(s, key) { return s[key]; }
assertEquals(g(new String("a"), "length"), 1);
assertEquals(g(new String("a"), "length"), 1);
assertEquals(g("a", 32), undefined);
assertEquals(g("a", "length"), 1);
assertEquals(g(new String("a"), "length"), 1);
Commit: [builtins] Fix Array.prototype.concat bug
Date(Commit): Tue, 15 Mar 2016 13:28:15 -0700
Regress : test\mjsunit\regress\regress-crbug-594574-concat-leak-2.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
array = new Array(10);
array[0] = 0.1;
// array[1] = THE_HOLE, reading through the prototype chain
array[2] = 2.1;
array[3] = 3.1;
var copy = array.slice(0, array.length);
// Use the defaul array prototype.
var proto = array.__proto__;
// Define [1] on the prototype to alter the array during concatenation.
Object.defineProperty(
proto, 1, {
get() {
// Alter the array.
array.length = 1;
// Force gc to move the array.
gc();
return "value from proto";
},
set(new_value) { }
});
var concatted_array = Array.prototype.concat.call(array);
assertEquals(concatted_array[0], 0.1);
assertEquals(concatted_array[1], "value from proto");
assertEquals(concatted_array[2], undefined);
assertEquals(concatted_array[3], undefined);
Commit: Remove destructuring and default arguments runtime flags
Date(Commit): Thu, 10 Mar 2016 15:19:31 -0800
Regress : test\mjsunit\regress\regress-552302.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --allow-natives-syntax
assertThrows('var %OptimizeFunctionOnNextCall()', SyntaxError);
Commit: Ensure appropriate bounds checking for Array subclass concat
Date(Commit): Wed, 9 Mar 2016 10:52:39 -0800
Regress : test\mjsunit\regress\regress-crbug-592340.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
class MyArray extends Array { }
Object.prototype[Symbol.species] = MyArray;
delete Array[Symbol.species];
__v_1 = Math.pow(2, 31);
__v_2 = [];
__v_2[__v_1] = 31;
__v_4 = [];
__v_4[__v_1 - 2] = 33;
assertThrows(() => __v_2.concat(__v_4), RangeError);
Commit: [regexp] fix bogus assertion in CharacterRange constructor.
Date(Commit): Wed, 9 Mar 2016 07:54:54 -0800
Regress : test\mjsunit\regress\regress-crbug-593282.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --stack-size=120
var __v_11 = {};
function __f_2(depth) {
try {
__f_5(depth, __v_11);
return true;
} catch (e) {
gc();
}
}
function __f_5(n, __v_4) {
if (--n == 0) {
__f_1(__v_4);
return;
}
__f_5(n, __v_4);
}
function __f_1(__v_4) {
var __v_5 = new RegExp(__v_4);
}
function __f_4() {
var __v_1 = 100;
var __v_8 = 100000;
while (__v_1 < __v_8 - 1) {
var __v_3 = Math.floor((__v_1 + __v_8) / 2);
if (__f_2(__v_3)) {
__v_1 = __v_3;
} else {
__v_8 = __v_3;
}
}
}
__f_4();
Commit: [regexp] Fix off-by-one in CharacterRange::Negate.
Date(Commit): Mon, 7 Mar 2016 02:58:46 -0800
Regress : test\mjsunit\regress\regress-crbug-592343.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var r = /[^\u{1}-\u{1000}\u{1002}-\u{2000}]/u;
assertTrue(r.test("\u{0}"));
assertFalse(r.test("\u{1}"));
assertFalse(r.test("\u{1000}"));
assertTrue(r.test("\u{1001}"));
assertFalse(r.test("\u{1002}"));
assertFalse(r.test("\u{2000}"));
assertTrue(r.test("\u{2001}"));
Commit: [json] Fix iteration over object keys in InternalizeJSONProperty.
Date(Commit): Tue, 1 Mar 2016 03:51:55 -0800
Regress : test\mjsunit\regress\regress-4769.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// https://bugs.chromium.org/p/v8/issues/detail?id=4769
Object.getPrototypeOf([])[Symbol.iterator] = () => assertUnreachable();
JSON.stringify({foo: [42]});
JSON.stringify({foo: [42]}, []);
JSON.stringify({foo: [42]}, undefined, ' ');
JSON.stringify({foo: [42]}, [], ' ');
Commit: [fullcodegen] Fix assert for operand stack depth tracking.
Date(Commit): Wed, 24 Feb 2016 08:29:21 -0800
Regress : test\mjsunit\regress\regress-crbug-589472.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --stack-size=100
// Not guaranteed to throw because the stack limits are different on all
// architectures, hence we use try-catch instead of assertThrows here.
try { f() } catch(e) { assertInstanceof(e, RangeError) }
function f() {
return Math.max(
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
"boom", 1, 2, 3, 4, 5, 6, 7, 8, 9);
};
Commit: ES2015 web compat workaround: RegExp.prototype.flags => ""
Date(Commit): Mon, 22 Feb 2016 17:48:31 -0800
Regress : test\mjsunit\regress\regress-crbug-581577.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertEquals("", RegExp.prototype.flags);
Commit: Fix Array.prototype.sort for *_STRING_WRAPPER_ELEMENTS
Date(Commit): Fri, 5 Feb 2016 05:36:33 -0800
Regress : test\mjsunit\regress\regress-crbug-584188.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var x = {};
try {
Object.defineProperty(String.prototype, "3", { x: function() { x = v; }});
string = "bla";
} catch(e) {; }
assertThrows("Array.prototype.sort.call(string);", TypeError);
Commit: Remove flags for ES2015 features shipped in M48
Date(Commit): Wed, 3 Feb 2016 12:51:26 -0800
Regress : test\mjsunit\regress\regress-crbug-516775.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function arguments_with_length_getter(f) {
arguments.__defineGetter__('length', f);
return arguments;
}
var count = 0;
function increment_count_return() { count++; return "boom"; }
function increment_count_throw() { count++; throw "boom"; }
// Do not read the length of an arguments object on the prototype chain of
// an array.
var a1 = [];
%NormalizeElements(a1);
a1.__proto__ = arguments_with_length_getter(increment_count_return);
[].concat(a1);
assertEquals(0, count);
var a2 = [];
%NormalizeElements(a2);
a2.__proto__ = arguments_with_length_getter(increment_count_throw);
[].concat(a2);
assertEquals(0, count);
// Do read the length of an arguments object if spreadable.
var a3 = arguments_with_length_getter(increment_count_return);
a3[Symbol.isConcatSpreadable] = true;
[].concat(a3);
assertEquals(1, count);
var a4 = arguments_with_length_getter(increment_count_throw);
a4[Symbol.isConcatSpreadable] = true;
assertThrows(function() { [].concat(a4); });
assertEquals(2, count);
// Do read the length of an arguments object on the prototype chain of
// an object.
var a5 = {};
a5.__proto__ = arguments_with_length_getter(increment_count_return);
a5[Symbol.isConcatSpreadable] = true;
[].concat(a5);
assertEquals(3, count);
var a6 = {};
a6.__proto__ = arguments_with_length_getter(increment_count_throw);
a6[Symbol.isConcatSpreadable] = true;
assertThrows(function() { [].concat(a6); });
assertEquals(4, count);
Commit: [runtime] Remove receiver==holder check in IntegerIndexedExotic lookup
Date(Commit): Wed, 3 Feb 2016 02:30:05 -0800
Regress : test\mjsunit\regress\regress-integer-indexed-element.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var o = {__proto__:new Int32Array(100)};
Object.prototype[1.3] = 10;
assertEquals(undefined, o[1.3]);
var o = new Int32Array(100);
var o2 = new Int32Array(200);
o.__proto__ = o2;
assertEquals(undefined, Reflect.get(o, 1.3, o2));
Commit: Expect JSReceiver in Runtime_DeleteLookupSlot, not just JSObject.
Date(Commit): Wed, 3 Feb 2016 01:49:03 -0800
Regress : test\mjsunit\regress\regress-583260.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
__v_1 = {
has() { return true }
};
__v_2 = new Proxy({}, __v_1);
function __f_5(object) {
with (object) { return delete __v_3; }
}
__f_5(__v_2)
Commit: More *_STRING_WRAPPER_ELEMENTS fixes
Date(Commit): Tue, 2 Feb 2016 05:45:42 -0800
Regress : test\mjsunit\regress\regress-crbug-583257.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Object.defineProperty(String.prototype, "0", { __v_1: 1});
Object.defineProperty(String.prototype, "3", { __v_1: 1});
(function () {
var s = new String();
function set(object, index, value) { object[index] = value; }
set(s, 10, "value");
set(s, 1073741823, "value");
})();
function __f_11() {
Object.preventExtensions(new String());
}
__f_11();
__f_11();
(function() {
var i = 10;
var a = new String("foo");
for (var j = 0; j < i; j++) {
a[j] = {};
}
})();
Commit: Fix Unicode string normalization with null bytes
Date(Commit): Fri, 29 Jan 2016 09:00:13 -0800
Regress : test\mjsunit\regress\regress-4654.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertEquals('hello\u0000foobar', 'hello\u0000foobar'.normalize('NFC'));
Commit: [builtins] Make Math.max and Math.min fast by default.
Date(Commit): Thu, 28 Jan 2016 05:06:43 -0800
Regress : test\mjsunit\compiler\regress-max.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --allow-natives-syntax
// Test Math.max with negative zero as input.
for (var i = 0; i < 5; i++) Math.max(0, 0);
Math.max(0, 0);
var r = Math.max(-0, -0);
assertEquals(-Infinity, 1 / r);
Commit: [api] Default native data property setter to replace the setter if the property is writable.
Date(Commit): Wed, 27 Jan 2016 05:21:53 -0800
Regress : test\mjsunit\regress\regress-crbug-580584.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f() { return arguments }
// Reconfiguring function.name should update both the attributes and the value.
Object.defineProperty(f, "name", {
writable: true, configurable: true, value: 10});
assertEquals({value: 10, writable: true, enumerable: false, configurable: true},
Object.getOwnPropertyDescriptor(f, "name"));
var args = f();
// Setting a value for arguments[Symbol.iterator] should not affect the
// attributes.
args[Symbol.iterator] = 10;
assertEquals({value: 10, writable: true, configurable: true, enumerable: false},
Object.getOwnPropertyDescriptor(args, Symbol.iterator));
Commit: Also check new_target_is_base() bit when comparing two maps for equivalence.
Date(Commit): Mon, 25 Jan 2016 08:43:29 -0800
Regress : test\mjsunit\regress\regress-crbug-580506.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
(function() {
'use strict';
class A extends Function {
constructor(...args) {
super(...args);
this.a = 42;
}
}
var v1 = new A("'use strict';");
function f(func) {
func.__defineSetter__('a', function() { });
}
var v2 = new A();
f(v2);
f(v1);
})();
Commit: Fix bug with spread rewriting
Date(Commit): Thu, 21 Jan 2016 04:15:29 -0800
Regress : test\mjsunit\harmony\regress\regress-4696.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function testSpreadIndex() {
var result = [...[17, 42]][1];
assertEquals(result, 42);
})();
(function testSpreadProperty() {
var result = [...[17, 42]].length;
assertEquals(result, 2);
})();
(function testSpreadMethodCall() {
var result = [...[17, 42]].join("+");
assertEquals(result, "17+42");
})();
(function testSpreadSavedMethodCall() {
var x = [...[17, 42]];
var method = x.join;
var result = method.call(x, "+");
assertEquals(result, "17+42");
})();
(function testSpreadAsTemplateTag() {
assertThrows(function() { [...[17, 42]] `foo`; }, TypeError)
})();
Commit: [proxy] Reload the initial map after prototype lookup on constructable Proxy.
Date(Commit): Mon, 18 Jan 2016 04:48:38 -0800
Regress : test\mjsunit\regress\regress-crbug-578039-Proxy_construct_prototype_change.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function target() {};
var proxy = new Proxy(target, {
get() {
// Reset the initial map of the target.
target.prototype = 123;
}});
new proxy();
Commit: Remove premature crankshaft optimization of HasInPrototypeChain.
Date(Commit): Mon, 18 Jan 2016 04:11:49 -0800
Regress : test\mjsunit\regress\regress-578775.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// https://code.google.com/p/chromium/issues/detail?id=578775
var __v_9 = {};
for (var __v_0 = 0; __v_0 < 1000; __v_0++) {
}
__v_2 = { __v_2: 1 };
__v_12 = new Proxy({}, {});
function f() {
var __v_10 = new Proxy({}, __v_2);
__v_9.__proto__ = __v_10;
__v_2.getPrototypeOf = function () { return __v_9 };
Object.prototype.isPrototypeOf.call(__v_0, __v_10);
};
assertThrows(f, RangeError);
Commit: [runtime] Throw exception for derived constructors in correct context.
Date(Commit): Fri, 15 Jan 2016 07:30:58 -0800
Regress : test\mjsunit\regress\regress-4509-Class-constructor-typeerror-realm.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
"use strict";
var realm = Realm.create();
var OtherTypeError = Realm.eval(realm, 'TypeError');
class Derived extends Object {
constructor() {
return null;
}
}
assertThrows(() => { new Derived() }, TypeError);
var OtherDerived = Realm.eval(realm,
"'use strict';" +
"class Derived extends Object {" +
"constructor() {" +
"return null;" +
"}};");
// Before throwing the TypeError we have to switch to the caller context.
assertThrows(() => { new OtherDerived() }, TypeError);
Commit: Don't pre-initialise block contexts with holes
Date(Commit): Thu, 14 Jan 2016 10:04:00 -0800
Regress : test\mjsunit\harmony\regress\regress-crbug-571149.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function(a = 0){
var x; // allocated in a var block, due to use of default parameter
(function() { return !x })();
})();
(function({a}){
var x; // allocated in a var block, due to use of parameter destructuring
(function() { return !x })();
})({});
(function(...a){
var x; // allocated in a var block, due to use of rest parameter
(function() { return !x })();
})();
Commit: Generalize all representations when reconfiguring a property of a strict Function subclass.
Date(Commit): Thu, 14 Jan 2016 02:45:10 -0800
Regress : test\mjsunit\regress\regress-crbug-575080.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --es-staging
class A extends Function {
constructor(...args) {
super(...args);
this.a = 42;
this.d = 4.2;
this.o = 0;
}
}
var obj = new A("'use strict';");
obj.o = 0.1;
Commit: Partial rollback of Promise error checking
Date(Commit): Mon, 11 Jan 2016 14:41:14 -0800
Regress : test\mjsunit\regress\regress-crbug-575314.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
// https://code.google.com/p/chromium/issues/detail?id=575314
// Overwriting the constructor of a Promise with something that doesn't have
// @@species shouldn't result in a rejection, even if that constructor
// is somewhat bogus.
var test = new Promise(function(){});
test.constructor = function(){};
Promise.resolve(test).catch(e => %AbortJS(e + " FAILED!"));
Date(Commit): Fri, 8 Jan 2016 09:34:36 -0800
Regress : test\mjsunit\regress\regress-91120.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// With ES2015 function hoisting semantics, functions are only "hoisted" out
// of blocks by writing their values into var-scoped declarations. Therefore,
// they access the catch binding when it syntactically appears so.
// This is a potentially breaking change vs the old semantics, which would
// return 'function' from g() everywhere.
var x = 'global';
function f() {
var x = 'function';
assertEquals(undefined, g);
try {
assertEquals(undefined, g);
throw 'catch';
} catch (x) {
function g() { return x; }
assertEquals('catch', g());
}
assertEquals('catch', g());
return g;
}
assertEquals('catch', f()());
Commit: [tests] Fix bogus uses of assertThrows.
Date(Commit): Thu, 7 Jan 2016 06:48:57 -0800
Regress : test\mjsunit\regress\regress-70066.js
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Regression test for Chromium issue 70066. Delete should work properly
// from inside 'with' scopes.
// http://code.google.com/p/chromium/issues/detail?id=70066
x = 0;
// Delete on a slot from a function's own context.
function test1() {
var value = 1;
var status;
with ({}) { status = delete value; }
return value + ":" + status;
}
assertEquals("1:false", test1(), "test1");
assertEquals(0, x, "test1"); // Global x is undisturbed.
// Delete on a slot from an outer context.
function test2() {
function f() {
with ({}) { return delete value; }
}
var value = 2;
var status = f();
return value + ":" + status;
}
assertEquals("2:false", test2(), "test2");
assertEquals(0, x, "test2"); // Global x is undisturbed.
// Delete on a parameter.
function test3(value) {
var status;
with ({}) { status = delete value; }
return value + ":" + status;
}
assertEquals("3:false", test3(3), "test3");
assertEquals(0, x, "test3"); // Global x is undisturbed.
// Delete on a parameter found in an outer context.
function test4(value) {
function f() {
with ({}) { return delete value; }
}
var status = f();
return value + ":" + status;
}
assertEquals("4:false", test4(4), "test4");
assertEquals(0, x, "test4"); // Global x is undisturbed.
// Delete on a parameter, arguments object should be unaffected.
function test5(value) {
var status;
with ({}) { status = delete value; }
return arguments[0] + ":" + status;
}
assertEquals("5:false", test5(5), "test5");
assertEquals(0, x, "test5"); // Global x is undisturbed.
function test6(value) {
function f() {
with ({}) { return delete value; }
}
var status = f();
return arguments[0] + ":" + status;
}
assertEquals("6:false", test6(6), "test6");
assertEquals(0, x, "test6"); // Global x is undisturbed.
// Delete on a property found on 'with' object.
function test7(object) {
with (object) { return delete value; }
}
var o = {value: 7};
assertEquals(true, test7(o), "test7");
assertEquals(void 0, o.value, "test7");
assertEquals(0, x, "test7"); // Global x is undisturbed.
// Delete on a global property.
function test8() {
with ({}) { return delete x; }
}
assertEquals(true, test8(), "test8");
assertThrows("x"); // Global x should be deleted.
// Delete on a property that is not found anywhere.
function test9() {
with ({}) { return delete x; }
}
assertThrows("x"); // Make sure it's not there.
assertEquals(true, test9(), "test9");
// Delete on a DONT_DELETE property of the global object.
var y = 10;
function test10() {
with ({}) { return delete y; }
}
assertEquals(false, test10(), "test10");
assertEquals(10, y, "test10");
Commit: Fix^3 cast in HasEnumerableElements
Date(Commit): Thu, 7 Jan 2016 06:47:11 -0800
Regress : test\mjsunit\regress\regress-crbug-569534.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var array = [,0.5];
array.length = 0;
for (var i in array) {}
Commit: [date] Date parser says true even for wrong dates, check twice.
Date(Commit): Thu, 7 Jan 2016 01:30:36 -0800
Regress : test\mjsunit\regress\regress-crbug-575082.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var y = new Date("-1073741824");
Commit: Accept time zones like GMT-8 in the legacy date parser
Date(Commit): Mon, 4 Jan 2016 15:25:27 -0800
Regress : test\mjsunit\regress\regress-crbug-422858.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var date = new Date("2016/01/02 10:00 GMT-8")
assertEquals(0, date.getMinutes());
assertEquals(18, date.getUTCHours());
date = new Date("2016/01/02 10:00 GMT-12")
assertEquals(0, date.getMinutes());
assertEquals(22, date.getUTCHours());
date = new Date("2016/01/02 10:00 GMT-123")
assertEquals(23, date.getMinutes());
assertEquals(11, date.getUTCHours());
date = new Date("2016/01/02 10:00 GMT-0856")
assertEquals(56, date.getMinutes());
assertEquals(18, date.getUTCHours());
date = new Date("2016/01/02 10:00 GMT-08000")
assertEquals(NaN, date.getMinutes());
assertEquals(NaN, date.getUTCHours());
Commit: Timezone name check fix
Date(Commit): Mon, 4 Jan 2016 13:47:44 -0800
Regress : test\mjsunit\regress\regress-crbug-487322.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
if (this.Intl) {
// Normalizes Kat{h,}mandu (chromium:487322)
// According to the IANA timezone db, Kathmandu is the current canonical
// name, but ICU got it backward. To make this test robust against a future
// ICU change ( http://bugs.icu-project.org/trac/ticket/12044 ),
// just check that Kat(h)mandu is resolved identically.
df1 = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Katmandu'})
df2 = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Kathmandu'})
assertEquals(df1.resolvedOptions().timeZone, df2.resolvedOptions().timeZone);
// Normalizes Ulan_Bator to Ulaanbaatar. Unlike Kat(h)mandu, ICU got this
// right so that we make sure that Ulan_Bator is resolved to Ulaanbaatar.
df = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Ulaanbaatar'})
assertEquals('Asia/Ulaanbaatar', df.resolvedOptions().timeZone);
df = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Ulan_Bator'})
assertEquals('Asia/Ulaanbaatar', df.resolvedOptions().timeZone);
// Throws for unsupported time zones.
assertThrows(() => Intl.DateTimeFormat(undefined, {timeZone: 'Aurope/Paris'}));
}
Commit: Use JSObjectVerify instead of trying to reimplement parts of it.
Date(Commit): Mon, 4 Jan 2016 05:49:48 -0800
Regress : test\mjsunit\regress\regress-crbug-573857.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --verify-heap
function f() {}
f = f.bind();
f.x = f.name;
f.__defineGetter__('name', function() { return f.x; });
function g() {}
g.prototype = f;
gc();
Commit: [turbofan] Add deopt point for InternalSetPrototype in VisitObjectLiteral.
Date(Commit): Mon, 4 Jan 2016 01:54:07 -0800
Regress : test\mjsunit\compiler\regress-572409.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var o = function() {};
function f() {
var lit = { __proto__: o };
o instanceof RegExp;
}
f();
Commit: [es6] Unify ArrayBuffer and SharedArrayBuffer constructors.
Date(Commit): Thu, 31 Dec 2015 23:12:48 -0800
Regress : test\mjsunit\regress\regress-crbug-565917.js
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
try {
} catch(e) {; }
new ArrayBuffer();