v8/test/mjsunit/regress/regress-682349.js

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

let success = false;
function f() {
  success = (f.caller === null);
}
Promise.resolve().then(f);
%RunMicrotasks();
assertTrue(success);
[promises] Fix .arguments on builtin function. Using .caller, one can get access to the internal function that invokes the handler passed to Promise.prototype.then. This internal function is a TF builtin that was set up as non-native and without an argument adaptor. As a consequence of this, when accessing .arguments on it, the frame-walking logic in the .arguments accessor thinks the number of arguments is -1 and we try to allocate an array of size -1. This CL marks the builtin function as native (making its .arguments be null), along with a few others that may have been incorrect in the same way. BUG=chromium:682349 Review-Url: https://codereview.chromium.org/2672453002 Cr-Commit-Position: refs/heads/master@{#42855} 2017-02-01 14:06:38 +00:00			`// Copyright 2017 the V8 project authors. All rights reserved.`
			`// Use of this source code is governed by a BSD-style license that can be`
			`// found in the LICENSE file.`

			`// Flags: --allow-natives-syntax`

			`let success = false;`
			`function f() {`
Reland "[runtime] Make all built-in functions strict." This is a reland of 72b88fdab8b657562fad4b70bc10e8a55c9ce2ec Original change's description: > [runtime] Make all built-in functions strict. > > According to ES#sec-built-in-function-objects all built-in functions > must be strict. > > This is a preliminary CL before changing the way we define built-in > functions in native JS files. > > Bug: v8:6529, v8:6459 > Change-Id: I8e60b342f04ea1b0843fe1990334cbb9b26ebac4 > Reviewed-on: https://chromium-review.googlesource.com/546215 > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Adam Klein <adamk@chromium.org> > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/master@{#46237} Bug: v8:6529, v8:6459 Change-Id: Ic0eb3d7925ed63dd716c4a114601415f92627ca5 Reviewed-on: https://chromium-review.googlesource.com/550156 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#46262} 2017-06-23 16:12:04 +00:00			`success = (f.caller === null);`
[promises] Fix .arguments on builtin function. Using .caller, one can get access to the internal function that invokes the handler passed to Promise.prototype.then. This internal function is a TF builtin that was set up as non-native and without an argument adaptor. As a consequence of this, when accessing .arguments on it, the frame-walking logic in the .arguments accessor thinks the number of arguments is -1 and we try to allocate an array of size -1. This CL marks the builtin function as native (making its .arguments be null), along with a few others that may have been incorrect in the same way. BUG=chromium:682349 Review-Url: https://codereview.chromium.org/2672453002 Cr-Commit-Position: refs/heads/master@{#42855} 2017-02-01 14:06:38 +00:00			`}`
			`Promise.resolve().then(f);`
			`%RunMicrotasks();`
			`assertTrue(success);`