v8/test/mjsunit/regress/regress-447756.js
Georg Neis aff70262f1 [test] Crash on invalid intrinsic use unless --fuzzing is on
For example, when --fuzzing is off, %OptimizeFunctionOnNextCall now
crashes when given a non-function argument.

The following behaviors remain unchanged for now:
- %DeoptimizeFunction continues to do nothing if the function is not
  optimized.
- %DeoptimizeNow continues to do nothing if the top-most JS function
  is not optimized.
- %OptimizeOSR continues to do nothing if the function already has
  optimized code.

Bug: v8:10249
Change-Id: I35d2f3d50ce3f94c8ffccabe50fb4df2b70ce028
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2137406
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67121}
2020-04-14 15:01:49 +00:00

50 lines
1.3 KiB
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --allow-natives-syntax
function TestConstructor(c) {
var a = new c(-0);
assertSame(Infinity, 1 / a.length);
assertSame(Infinity, 1 / a.byteLength);
var ab = new ArrayBuffer(-0);
assertSame(Infinity, 1 / ab.byteLength);
var a1 = new c(ab, -0, -0);
assertSame(Infinity, 1 / a1.length);
assertSame(Infinity, 1 / a1.byteLength);
assertSame(Infinity, 1 / a1.byteOffset);
}
var constructors =
[ Uint8Array, Int8Array, Uint8ClampedArray,
Uint16Array, Int16Array,
Uint32Array, Int32Array,
Float32Array, Float64Array ];
for (var i = 0; i < constructors.length; i++) {
TestConstructor(constructors[i]);
}
function TestOptimizedCode() {
var a = new Uint8Array(-0);
assertSame(Infinity, 1 / a.length);
assertSame(Infinity, 1 / a.byteLength);
var ab = new ArrayBuffer(-0);
assertSame(Infinity, 1 / ab.byteLength);
var a1 = new Uint8Array(ab, -0, -0);
assertSame(Infinity, 1 / a1.length);
assertSame(Infinity, 1 / a1.byteLength);
assertSame(Infinity, 1 / a1.byteOffset);
}
%PrepareFunctionForOptimization(TestOptimizedCode);
TestOptimizedCode();
TestOptimizedCode();
%OptimizeFunctionOnNextCall(TestOptimizedCode);
TestOptimizedCode();