v8/test/mjsunit/regress/regress-682349.js

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

let success = false;
function f() {
  success = (f.caller === null);
}
Promise.resolve().then(f);
%PerformMicrotaskCheckpoint();
assertTrue(success);
[promises] Fix .arguments on builtin function. Using .caller, one can get access to the internal function that invokes the handler passed to Promise.prototype.then. This internal function is a TF builtin that was set up as non-native and without an argument adaptor. As a consequence of this, when accessing .arguments on it, the frame-walking logic in the .arguments accessor thinks the number of arguments is -1 and we try to allocate an array of size -1. This CL marks the builtin function as native (making its .arguments be null), along with a few others that may have been incorrect in the same way. BUG=chromium:682349 Review-Url: https://codereview.chromium.org/2672453002 Cr-Commit-Position: refs/heads/master@{#42855} 2017-02-01 14:06:38 +00:00			`// Copyright 2017 the V8 project authors. All rights reserved.`
			`// Use of this source code is governed by a BSD-style license that can be`
			`// found in the LICENSE file.`

			`// Flags: --allow-natives-syntax`

			`let success = false;`
			`function f() {`
Reland "[runtime] Make all built-in functions strict." This is a reland of 72b88fdab8b657562fad4b70bc10e8a55c9ce2ec Original change's description: > [runtime] Make all built-in functions strict. > > According to ES#sec-built-in-function-objects all built-in functions > must be strict. > > This is a preliminary CL before changing the way we define built-in > functions in native JS files. > > Bug: v8:6529, v8:6459 > Change-Id: I8e60b342f04ea1b0843fe1990334cbb9b26ebac4 > Reviewed-on: https://chromium-review.googlesource.com/546215 > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Adam Klein <adamk@chromium.org> > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/master@{#46237} Bug: v8:6529, v8:6459 Change-Id: Ic0eb3d7925ed63dd716c4a114601415f92627ca5 Reviewed-on: https://chromium-review.googlesource.com/550156 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#46262} 2017-06-23 16:12:04 +00:00			`success = (f.caller === null);`
[promises] Fix .arguments on builtin function. Using .caller, one can get access to the internal function that invokes the handler passed to Promise.prototype.then. This internal function is a TF builtin that was set up as non-native and without an argument adaptor. As a consequence of this, when accessing .arguments on it, the frame-walking logic in the .arguments accessor thinks the number of arguments is -1 and we try to allocate an array of size -1. This CL marks the builtin function as native (making its .arguments be null), along with a few others that may have been incorrect in the same way. BUG=chromium:682349 Review-Url: https://codereview.chromium.org/2672453002 Cr-Commit-Position: refs/heads/master@{#42855} 2017-02-01 14:06:38 +00:00			`}`
			`Promise.resolve().then(f);`
Replace %RunMicrotasks with %PerformMicrotaskCheckpoint This replaces Runtime_RunMicrotasks with Runtime_PerformMicrotaskCheckpoint. RunMicrotasks forcibly runs Microtasks even when the microtasks are suppressed, and may causes nested Microtasks in a problematic way. E.g. that confuses v8::MicrotasksScope::IsRunningMicrotasks() and GetEnteredOrMicrotaskContext(). OTOH, PerformMicrotaskCheckpoint() doesn't run cause the failure as it respects the microtask suppressions. As all existing tests don't call RunMicrotasks() in the suppressed situation (like Promise.resolve().then(()=>{%RunMicrotasks();})), this change should not affect to these tests. Change-Id: Ib043a0cc8e482e022d375084d65ea98a6f54ef3d Reviewed-on: https://chromium-review.googlesource.com/c/1360095 Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Taiju Tsuiki <tzik@chromium.org> Cr-Commit-Position: refs/heads/master@{#58068} 2018-12-04 06:12:49 +00:00			`%PerformMicrotaskCheckpoint();`
[promises] Fix .arguments on builtin function. Using .caller, one can get access to the internal function that invokes the handler passed to Promise.prototype.then. This internal function is a TF builtin that was set up as non-native and without an argument adaptor. As a consequence of this, when accessing .arguments on it, the frame-walking logic in the .arguments accessor thinks the number of arguments is -1 and we try to allocate an array of size -1. This CL marks the builtin function as native (making its .arguments be null), along with a few others that may have been incorrect in the same way. BUG=chromium:682349 Review-Url: https://codereview.chromium.org/2672453002 Cr-Commit-Position: refs/heads/master@{#42855} 2017-02-01 14:06:38 +00:00			`assertTrue(success);`