From b963cb2351f354d13bbc32277d0a7233c2459ae7 Mon Sep 17 00:00:00 2001
From: yangguo <yangguo@chromium.org>
Date: Fri, 3 Feb 2017 04:19:21 -0800
Subject: [PATCH] Add test case for built-in objects' property mode.

R=jgruber@chromium.org
BUG=v8:5902

Review-Url: https://codereview.chromium.org/2669423002
Cr-Commit-Position: refs/heads/master@{#42922}
---
 test/mjsunit/regress/regress-5902.js | 63 ++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 test/mjsunit/regress/regress-5902.js

diff --git a/test/mjsunit/regress/regress-5902.js b/test/mjsunit/regress/regress-5902.js
new file mode 100644
index 0000000000..6925bf312c
--- /dev/null
+++ b/test/mjsunit/regress/regress-5902.js
@@ -0,0 +1,63 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var log = [];
+
+function check(predicate, item) {
+  if (!predicate) log.push(item);
+}
+
+var global = this;
+
+Object.getOwnPropertyNames(global).forEach(function(name) {
+  // Only check for global properties with uppercase names.
+  if (name[0] != name[0].toUpperCase()) return;
+
+  var obj = global[name];
+
+  // Skip non-receivers.
+  if (! % IsJSReceiver(obj)) return;
+
+  // Skip non-natives.
+  if (!obj.toString().includes('native')) return;
+
+  // Construct an instance.
+  try {
+    new obj();
+  } catch (e) {
+  }
+
+  // Check the object.
+  check(% HasFastProperties(obj), `${name}`);
+
+  // Check the constructor.
+  var constructor = obj.constructor;
+  if (! % IsJSReceiver(constructor)) return;
+  check(% HasFastProperties(constructor), `${name}.constructor`);
+
+  // Check the prototype.
+  var prototype = obj.prototype;
+  if (! % IsJSReceiver(prototype)) return;
+  check(% HasFastProperties(prototype), `${name}.prototype`);
+
+  // Check the prototype.constructor.
+  var prototype_constructor = prototype.constructor;
+  if (! % IsJSReceiver(prototype_constructor)) return;
+  check(
+      % HasFastProperties(prototype_constructor),
+      `${name}.prototype.constructor`);
+});
+
+// This is the current set of dictionary mode objects.
+// Remove items as we fix them. See issue 5902.
+assertEquals(
+    [
+      'RegExp', 'RegExp.prototype.constructor', 'Error.prototype',
+      'EvalError.prototype', 'RangeError.prototype', 'ReferenceError.prototype',
+      'SyntaxError.prototype', 'TypeError.prototype', 'URIError.prototype',
+      'Map', 'Map.prototype.constructor', 'Set', 'Set.prototype.constructor'
+    ],
+    log);