AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[test] add mjsunit regression tests for v8:6322

Browse Source 
A few tests that would be good to have to verify that the known manifestations
of this bug are resolved.

Previously, the async generator and async function tests would crash. The other
ones never did, but still resulted in the register overwite bug.

BUG=v8:6322
R=adamk@chromium.org

Change-Id: Ic2238227629077de5671d67d18b3bfe018dd23f4
Reviewed-on: https://chromium-review.googlesource.com/514230
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#45524}
This commit is contained in:
Caitlin Potter 2017-05-24 14:34:20 -04:00 committed by Commit Bot
parent 2d3f1082f3
commit cd778f13ac
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
test/mjsunit/es6/regress/regress-6322.js
View File

@ -4,3 +4,8 @@
// Crash with --verify-heap
(function*() { for (let { a = class b { } } of [{}]) { } })().next();
(function() { for (let { a = class b { } } of [{}]) { } })();
(function() { var a; for ({ a = class b { } } of [{}]) { } })();
(function() { for (let [a = class b { } ] = [[]]; ;) break; })();
(function() { var a; for ([a = class b { } ] = [[]]; ;) break; })();

9
test/mjsunit/harmony/regress/regress-6322.js Normal file
View File

@ -0,0 +1,9 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --harmony-async-iteration
// Crash with --verify-heap
(async function() { for await (let { a = class b { } } of [{}]) { } })();
(async function() { var a; for await ({ a = class b { } } of [{}]) { } })();