v8/test/mjsunit/regress/regress-crbug-906043.js
Peter Marshall 4e3a17d040 [runtime] Reduce spread/apply call max arguments
Bug: chromium:906043
Change-Id: I308b29af0644c318d73926b27e65a94913c760c7
Reviewed-on: https://chromium-review.googlesource.com/c/1346115
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57731}
2018-11-22 12:08:17 +00:00

55 lines
1.9 KiB
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function fun(arg) {
let x = arguments.length;
a1 = new Array(0x10);
a1[0] = 1.1;
a2 = new Array(0x10);
a2[0] = 1.1;
a1[(x >> 16) * 21] = 1.39064994160909e-309; // 0xffff00000000
a1[(x >> 16) * 41] = 8.91238232205e-313; // 0x2a00000000
}
var a1, a2;
var a3 = [1.1,2.2];
a3.length = 0x11000;
a3.fill(3.3);
var a4 = [1.1];
for (let i = 0; i < 3; i++) fun(...a4);
%OptimizeFunctionOnNextCall(fun);
fun(...a4);
assertThrows(() => fun(...a3), RangeError);
assertThrows(() => fun.apply(null, a3), RangeError);
const kMaxArguments = 65534;
let big_array = [];
for (let i = 0; i < kMaxArguments + 1; i++) big_array.push(i);
assertThrows(() => fun(...big_array), RangeError);
assertThrows(() => new fun(...big_array), RangeError);
assertThrows(() => fun.apply(null, big_array), RangeError);
assertThrows(() => Reflect.construct(fun, big_array), RangeError);
assertThrows(() => Reflect.apply(fun, undefined, big_array), RangeError);
big_array = [];
for (let i = 0; i < kMaxArguments + 1; i++) big_array.push(i + 0.1);
assertThrows(() => fun(...big_array), RangeError);
assertThrows(() => new fun(...big_array), RangeError);
assertThrows(() => fun.apply(null, big_array), RangeError);
assertThrows(() => Reflect.construct(fun, big_array), RangeError);
assertThrows(() => Reflect.apply(fun, undefined, big_array), RangeError);
big_array = [];
for (let i = 0; i < kMaxArguments + 1; i++) big_array.push({i: i});
assertThrows(() => fun(...big_array), RangeError);
assertThrows(() => new fun(...big_array), RangeError);
assertThrows(() => fun.apply(null, big_array), RangeError);
assertThrows(() => Reflect.construct(fun, big_array), RangeError);
assertThrows(() => Reflect.apply(fun, undefined, big_array), RangeError);