v8/test/mjsunit/regress
mvstanton 401450493e Security: type confusion lead to information leak in decodeURI
Quit using the global array in uri code.

R=yangguo@chromium.org
BUG=chromium:602970
LOG=N

Review URL: https://codereview.chromium.org/1889133003

Cr-Commit-Position: refs/heads/master@{#35530}
2016-04-15 13:09:45 +00:00
..
binop-in-effect-context-deopt.js
bitops-register-alias.js
call-function-in-effect-context-deopt.js
clear-keyed-call.js
compare-map-elim1.js
comparison-in-effect-context-deopt.js
consolidated-holey-load.js
cross-script-vars.js
d8-readbuffer.js
debug-prepare-step-in.js
external-and-normal-array-polymorphism.js
get-array-keys-oob.js Remove oob elements collected from the prototype chain by trimming in GetArrayKeys 2016-03-18 14:37:36 +00:00
internalized-string-not-equal.js
json-stringifier-emptyhandle.js
math-min.js [crankshaft][arm][mips][mips64] Fix Math.min(0, 0) 2016-02-15 14:43:02 +00:00
negative_lookup.js
number-named-call-deopt.js
poly_count_operation.js
polymorphic-accessor-test-context.js
post-increment-close-context.js
property-descriptor-to-object.js
readonly1.js
readonly2.js
readonly3.js
readonly4.js
readonly5.js
regress-6-9-regexp.js
regress-35.js
regress-57.js
regress-69.js
regress-74.js
regress-86.js
regress-87.js
regress-91.js
regress-105.js
regress-114.js
regress-116.js
regress-124.js
regress-137.js
regress-149.js
regress-171.js
regress-176.js
regress-186.js Remove support for legacy const, part 1 2016-03-22 17:52:13 +00:00
regress-187.js
regress-189.js
regress-191.js
regress-192.js
regress-193.js
regress-201.js
regress-219.js
regress-220.js Ship ES2015 restrictions on function declaration locations 2016-03-16 16:39:23 +00:00
regress-225.js
regress-227.js
regress-231.js
regress-233.js
regress-244.js
regress-246.js
regress-253.js
regress-254.js
regress-259.js
regress-260.js
regress-263.js
regress-265.js
regress-267.js
regress-269.js
regress-279.js
regress-284.js
regress-286.js
regress-294.js
regress-312.js
regress-317.js
regress-318.js
regress-326.js
regress-334.js
regress-341.js
regress-345.js
regress-349.js
regress-351.js
regress-386.js
regress-392.js
regress-394.js
regress-396.js
regress-397.js
regress-399.js
regress-406.js
regress-416.js
regress-475.js
regress-483.js
regress-485.js
regress-486.js
regress-490.js
regress-491.js
regress-492.js
regress-496.js
regress-502.js
regress-503.js
regress-515.js
regress-524.js
regress-526.js
regress-540.js
regress-545.js
regress-580.js
regress-581.js
regress-603.js
regress-612.js
regress-618.js
regress-619.js
regress-634-debug.js
regress-636.js
regress-643.js
regress-646.js
regress-675.js
regress-681.js
regress-685.js
regress-687.js
regress-696.js
regress-697.js
regress-712.js
regress-720.js
regress-728.js
regress-732.js
regress-747.js
regress-752.js
regress-753.js
regress-754.js
regress-760-1.js
regress-760-2.js
regress-784.js
regress-794.js
regress-798.js
regress-806.js
regress-815.js
regress-842.js
regress-851.js
regress-857.js
regress-874.js
regress-900.js
regress-918.js
regress-927.js
regress-931.js
regress-944.js
regress-955.js
regress-962.js
regress-969.js
regress-974.js
regress-982.js
regress-992.js
regress-995.js
regress-1015.js
regress-1017.js
regress-1020.js
regress-1060.js
regress-1079.js
regress-1083.js
regress-1092.js
regress-1099.js
regress-1103.js
regress-1104.js
regress-1106.js
regress-1107.js
regress-1110.js
regress-1112.js
regress-1117.js
regress-1118.js
regress-1119.js
regress-1120.js
regress-1121.js
regress-1122.js
regress-1125.js
regress-1126.js
regress-1129.js
regress-1130.js
regress-1131.js
regress-1132.js
regress-1146.js
regress-1149.js
regress-1150.js
regress-1151.js
regress-1156.js
regress-1160.js
regress-1166.js
regress-1167.js
regress-1170.js
regress-1172-bis.js
regress-1172.js
regress-1174.js
regress-1176.js
regress-1181.js
regress-1184.js
regress-1207.js
regress-1209.js
regress-1210.js
regress-1213.js
regress-1215.js
regress-1218.js
regress-1233.js
regress-1236.js
regress-1237.js
regress-1240.js
regress-1246.js
regress-1257.js
regress-1278.js
regress-1309.js
regress-1323.js
regress-1337.js
regress-1351.js
regress-1355.js
regress-1360.js
regress-1365.js
regress-1369.js
regress-1383.js
regress-1387.js
regress-1389.js
regress-1401.js
regress-1403.js
regress-1412.js
regress-1415.js
regress-1419.js
regress-1423.js
regress-1434.js
regress-1436.js
regress-1447.js
regress-1472.js
regress-1476.js
regress-1491.js
regress-1513.js
regress-1521.js
regress-1523.js
regress-1528.js
regress-1529.js
regress-1530.js
regress-1531.js
regress-1546.js
regress-1548.js
regress-1560.js
regress-1563.js
regress-1582.js
regress-1583.js
regress-1586.js
regress-1591.js
regress-1592.js
regress-1620.js
regress-1624-strict.js
regress-1624.js
regress-1625.js
regress-1639-2.js
regress-1639.js
regress-1647.js
regress-1650.js
regress-1692.js
regress-1708.js
regress-1711.js
regress-1748.js
regress-1757.js
regress-1790.js
regress-1849.js
regress-1853.js
regress-1898.js
regress-1924.js
regress-1973.js
regress-1980.js
regress-2027.js
regress-2030.js
regress-2032.js
regress-2045.js
regress-2054.js
regress-2055.js
regress-2056.js
regress-2058.js
regress-2071.js
regress-2073.js
regress-2110.js
regress-2119.js
regress-2132.js
regress-2153.js
regress-2163.js
regress-2170.js
regress-2172.js
regress-2185-2.js
regress-2185.js
regress-2193.js
regress-2226.js
regress-2234.js
regress-2249.js
regress-2250.js
regress-2261.js
regress-2263.js
regress-2273.js
regress-2284.js
regress-2286.js
regress-2289.js
regress-2291.js
regress-2294.js
regress-2296.js
regress-2315.js
regress-2318.js
regress-2326.js
regress-2339.js
regress-2346.js
regress-2373.js
regress-2374.js
regress-2398.js
regress-2410.js
regress-2416.js
regress-2419.js
regress-2433.js
regress-2437.js
regress-2438.js
regress-2441.js
regress-2443.js
regress-2444.js
regress-2451.js
regress-2470.js
regress-2489.js
regress-2499.js
regress-2529.js
regress-2537.js
regress-2539.js
regress-2564.js
regress-2565.js
regress-2566.js
regress-2568.js
regress-2570.js
regress-2593.js
regress-2594.js
regress-2595.js
regress-2596.js
regress-2606.js
regress-2612.js
regress-2615.js
regress-2618.js [compiler] Remove support for concurrent OSR. 2016-03-08 09:02:44 +00:00
regress-2624.js
regress-2646.js
regress-2653.js
regress-2671-1.js
regress-2671.js
regress-2686.js
regress-2690.js
regress-2711.js
regress-2717.js
regress-2758.js
regress-2790.js
regress-2813.js
regress-2825.js
regress-2836.js
regress-2843.js
regress-2855.js
regress-2931.js
regress-2980.js
regress-2984.js
regress-2987.js
regress-2988.js
regress-2989.js
regress-3010.js
regress-3025.js
regress-3026.js
regress-3027.js
regress-3029.js
regress-3032.js
regress-3039.js
regress-3116.js
regress-3135.js
regress-3138.js Remove support for legacy const, part 1 2016-03-22 17:52:13 +00:00
regress-3158.js
regress-3159.js
regress-3176.js
regress-3183.js
regress-3204.js
regress-3220.js
regress-3229.js
regress-3255.js
regress-3281.js
regress-3294.js
regress-3307.js
regress-3315.js
regress-3334.js
regress-3359.js
regress-3380.js
regress-3392.js
regress-3404.js
regress-3462.js
regress-3476.js
regress-3483.js
regress-3564.js
regress-3612.js
regress-3621.js
regress-3641.js
regress-3643.js
regress-3650-1.js [crankshaft] For-in index increment cannot overflow. 2016-01-22 07:55:11 +00:00
regress-3650-2.js [runtime] Make sure %ForInPrepare returns the correct length. 2016-01-22 14:52:20 +00:00
regress-3650-3.js [crankshaft] Fix another deopt loop in slow mode for-in. 2016-01-29 11:00:05 +00:00
regress-3687.js
regress-3709.js
regress-3717.js
regress-3718.js
regress-3756.js
regress-3859.js
regress-3865.js
regress-3884.js
regress-3926.js Remove runtime flags for sloppy mode block scoping features 2016-04-08 00:30:20 +00:00
regress-3960.js
regress-3969.js
regress-3976.js
regress-3985.js
regress-4023.js
regress-4027.js
regress-4121.js
regress-4169.js
regress-4173.js
regress-4214.js
regress-4255-1.js
regress-4255-2.js
regress-4255-3.js
regress-4255-4.js
regress-4266.js
regress-4267.js Array length reduction should throw in strict mode if it can't delete an element. 2016-01-22 09:53:51 +00:00
regress-4271.js
regress-4279.js
regress-4296.js
regress-4309-1.js
regress-4309-2.js
regress-4309-3.js
regress-4320.js
regress-4325.js
regress-4374.js
regress-4376-1.js
regress-4376-2.js
regress-4376-3.js
regress-4377.js
regress-4380.js
regress-4388.js
regress-4399.js
regress-4450.js
regress-4493-1.js
regress-4495.js
regress-4507.js
regress-4509-Class-constructor-typeerror-realm.js
regress-4515.js
regress-4521.js
regress-4525.js
regress-4534.js
regress-4595.js
regress-4640.js
regress-4654.js Fix Unicode string normalization with null bytes 2016-01-29 17:00:46 +00:00
regress-4659.js Force SharedFunctionInfo::name() to be a flat string 2016-02-11 18:53:02 +00:00
regress-4665-2.js Extend subarray web compatibility fix to --harmony-species 2016-02-08 21:16:49 +00:00
regress-4665.js
regress-4693.js Remove runtime flags for sloppy mode block scoping features 2016-04-08 00:30:20 +00:00
regress-4715.js [crankshaft] Make the for-in slow path compatible with the other compilers. 2016-01-29 07:50:51 +00:00
regress-4769.js [json] Fix iteration over object keys in InternalizeJSONProperty. 2016-03-01 11:53:28 +00:00
regress-4788-1.js [turbofan] Don't use the CompareIC in JSGenericLowering. 2016-02-26 18:41:35 +00:00
regress-4788-2.js [turbofan] Don't use the CompareIC in JSGenericLowering. 2016-02-26 18:41:35 +00:00
regress-4800.js [arm/arm64][stubs] Fix d16-d31 preservation on stub failure 2016-03-09 17:36:07 +00:00
regress-4825.js [runtime] fix getting element keys from SLOW_SLOPPY_ARGUMENTS_ELEMENTS 2016-03-14 17:10:50 +00:00
regress-45469.js
regress-52801.js
regress-58740.js
regress-70066.js
regress-71647.js
regress-78270.js
regress-82769.js
regress-84234.js
regress-85177.js
regress-88591.js Remove support for legacy const, part 1 2016-03-22 17:52:13 +00:00
regress-88858.js
regress-91008.js
regress-91010.js
regress-91013.js
regress-91120.js
regress-91787.js
regress-94425.js
regress-94873.js
regress-95113.js
regress-95485.js
regress-95920.js
regress-96523.js
regress-97116.js
regress-97116b.js
regress-98773.js
regress-99167.js
regress-100409.js
regress-100702.js
regress-102153.js
regress-103259.js
regress-108296.js
regress-109195.js
regress-110509.js
regress-113924.js
regress-115100.js
regress-115452.js
regress-117409.js
regress-117794.js
regress-119429.js
regress-119609.js
regress-119925.js
regress-120099.js
regress-121407.js
regress-123512.js
regress-123919.js
regress-124594.js
regress-125515.js
regress-126412.js
regress-128018.js
regress-128146.js
regress-131923.js
regress-131994.js
regress-133211.js
regress-133211b.js
regress-136048.js
regress-137768.js
regress-143967.js
regress-145201.js
regress-147497.js
regress-148378.js
regress-155924.js
regress-164442.js
regress-165637.js
regress-166379.js
regress-166553.js
regress-171641.js
regress-201590.js
regress-234101.js
regress-235311.js
regress-237617.js
regress-241344.js
regress-247688.js
regress-252797.js
regress-264203.js
regress-270142.js
regress-280531.js
regress-298269.js
regress-299979.js
regress-318420.js
regress-319120.js
regress-319722-ArrayBuffer.js
regress-319722-TypedArrays.js
regress-320532.js
regress-323845.js
regress-324028.js
regress-325676.js [debugger] allow debug-evaluate to change stack and context values. 2016-03-31 06:00:21 +00:00
regress-330046.js
regress-331416.js
regress-331444.js
regress-333594.js
regress-334708.js
regress-336820.js
regress-340125.js
regress-343609.js [compiler] Remove support for concurrent OSR. 2016-03-08 09:02:44 +00:00
regress-346343.js
regress-346587.js
regress-347262.js
regress-347530.js
regress-347542.js
regress-347543.js
regress-347904.js
regress-347909.js
regress-347912.js
regress-347914.js
regress-348280.js
regress-348512.js
regress-349870.js
regress-349885.js
regress-350863.js
regress-350865.js
regress-350884.js
regress-350887.js
regress-351261.js
regress-351263.js
regress-351319.js
regress-351624.js
regress-352059.js
regress-352982.js
regress-353004.js
regress-353058.js
regress-353551.js
regress-354357.js
regress-354433.js
regress-355485.js
regress-355486.js
regress-355523.js
regress-356053.js
regress-356589.js
regress-357054.js
regress-357103.js
regress-357105.js
regress-357108.js
regress-358057.js
regress-358059.js
regress-358088.js
regress-358090.js
regress-359441.js
regress-359491.js
regress-359525.js
regress-360733.js
regress-361025.js
regress-361608.js
regress-362128.js
regress-362870.js
regress-363956.js
regress-365172-1.js
regress-365172-2.js
regress-365172-3.js
regress-368243.js
regress-369450.js
regress-370384.js
regress-370827.js
regress-373283.js
regress-377290.js
regress-379770.js
regress-380092.js
regress-381313.js
regress-385054.js
regress-385565.js
regress-386034.js
regress-392114.js
regress-403292.js
regress-404981.js
regress-408036.js
regress-409533.js
regress-410030.js
regress-410912.js
regress-411210.js
regress-412162.js
regress-416416.js
regress-416730.js
regress-417709a.js
regress-417709b.js
regress-419663.js
regress-423633.js
regress-425551.js
regress-430201.js
regress-430201b.js
regress-435073.js
regress-435477.js
regress-436893.js
regress-437713.js
regress-437765.js
regress-441099.js
regress-444805.js
regress-444805.js-script
regress-446389.js
regress-447526.js
regress-447561.js
regress-447756.js
regress-448711.js
regress-449070.js
regress-449291.js
regress-450895.js
regress-451322.js
regress-451958.js
regress-453481.js
regress-454725.js
regress-455207.js
regress-455212.js
regress-457935.js
regress-458876.js
regress-458987.js
regress-459955.js
regress-460917.js
regress-463028.js
regress-466993.js
regress-467481.js
regress-469605.js
regress-469605b.js
regress-470804.js
regress-472504.js
regress-475705.js
regress-476488.js
regress-479528.js
regress-484544.js
regress-487981.js
regress-488398.js
regress-489151.js
regress-491481.js
regress-491536.js
regress-499790.js
regress-500173.js
regress-500176.js
regress-500831.js
regress-500980.js
regress-503565.js
regress-507980.js
regress-509961.js
regress-514362.js
regress-520029.js Remove runtime flags for sloppy mode block scoping features 2016-04-08 00:30:20 +00:00
regress-536751.js Remove runtime flags for sloppy mode block scoping features 2016-04-08 00:30:20 +00:00
regress-539875.js
regress-542099.js Remove runtime flags for sloppy mode block scoping features 2016-04-08 00:30:20 +00:00
regress-542100.js Remove runtime flags for sloppy mode block scoping features 2016-04-08 00:30:20 +00:00
regress-542823.js
regress-543994.js
regress-544991.js
regress-552302.js Remove destructuring and default arguments runtime flags 2016-03-10 23:22:30 +00:00
regress-554865.js Several mjsunit cleanups 2016-03-18 23:20:44 +00:00
regress-556543.js
regress-568765.js
regress-572589.js Remove destructuring and default arguments runtime flags 2016-03-10 23:22:30 +00:00
regress-575364.js [wasm] Rename _WASMEXP_ object to Wasm. 2016-03-08 14:48:27 +00:00
regress-578775.js
regress-583260.js Expect JSReceiver in Runtime_DeleteLookupSlot, not just JSObject. 2016-02-03 09:49:22 +00:00
regress-585041.js Bugfix: assert in lithium compile for LMaybeGrowElements 2016-04-07 11:41:39 +00:00
regress-585775.js Return undefined from RegExp.prototype.compile 2016-02-20 00:35:57 +00:00
regress-588599.js
regress-590074.js [turbofan] Fix register constraint for memory barrier. 2016-03-09 09:39:51 +00:00
regress-592341.js [turbofan] Fix deoptimization stack layout for fast literal comparisons. 2016-03-09 12:36:09 +00:00
regress-592353.js Remove Scope::scope_contains_with_ bit 2016-03-15 22:41:59 +00:00
regress-593299.js [turbofan] Fix operand calculation for constant materialization from frame. 2016-03-13 20:21:41 +00:00
regress-595319.js Throw the right exceptions from setting elements in Array.prototype.concat 2016-03-17 22:42:00 +00:00
regress-596718.js Check for proper types from error handling code 2016-03-25 02:10:02 +00:00
regress-599068-func-bindings.js [Interpreter] Handles legacy constants in strict mode. 2016-04-11 12:04:01 +00:00
regress-599089-array-push.js Fix representation issue in FastArrayPushStub 2016-04-07 12:46:08 +00:00
regress-599412.js [turbofan] Restrict types in load elimination. 2016-04-05 12:30:14 +00:00
regress-599414-array-concat-fast-path.js [elements] Fix length bounds precheck for Array.prototype.concat 2016-04-05 15:35:27 +00:00
regress-599710.js [crankshaft] Make infinite loops preserve control flow. 2016-04-07 05:36:44 +00:00
regress-599825.js [asm.js] Fix typing bug for non-literals in heap access. 2016-04-05 17:24:03 +00:00
regress-602970.js Security: type confusion lead to information leak in decodeURI 2016-04-15 13:09:45 +00:00
regress-662254.js
regress-666721.js
regress-667061.js
regress-670147.js
regress-674753.js
regress-676025.js
regress-678525.js
regress-682649.js
regress-734862.js
regress-737588.js
regress-780423.js
regress-806473.js
regress-842017.js
regress-874178.js
regress-875031.js
regress-877615.js
regress-892742.js
regress-900055.js
regress-900966.js
regress-925537.js
regress-937896.js
regress-990205.js
regress-992733.js
regress-996542.js
regress-998565.js
regress-1030466.js
regress-1036894.js
regress-1039610.js
regress-1050043.js
regress-1062422.js
regress-1066899.js
regress-1081309.js
regress-1102760.js
regress-1110164.js
regress-1112051.js
regress-1114040.js
regress-1134697.js
regress-1170187.js
regress-1173979.js
regress-1175390.js
regress-1177518.js
regress-1177809.js
regress-1178598.js Remove support for legacy const, part 1 2016-03-22 17:52:13 +00:00
regress-1187524.js
regress-1199401.js
regress-1199637.js Remove support for legacy const, part 1 2016-03-22 17:52:13 +00:00
regress-1200351.js
regress-1203459.js
regress-1213516.js
regress-1215653.js
regress-1254366.js
regress-1327557.js
regress-1346700.js
regress-1439135.js
regress-1493017.js
regress-1919169.js
regress-2249423.js
regress-3006390.js
regress-3185905.js
regress-3199913.js
regress-3218530.js
regress-3218915.js
regress-3230771.js
regress-3247124.js
regress-3252443.js
regress-3408144.js
regress-20070207.js
regress-add-minus-zero.js
regress-alloc-smi-check.js
regress-arg-materialize-store.js
regress-arguments-gc.js
regress-arguments-slice.js
regress-arm64-spillslots.js
regress-array-pop-deopt.js
regress-array-pop-nonconfigurable.js
regress-assignment-in-test-context.js
regress-bce-underflow.js
regress-bind-receiver.js
regress-binop.js
regress-builtin-array-op.js
regress-builtinbust-1.js
regress-builtinbust-3.js
regress-builtinbust-4.js
regress-builtinbust-5.js
regress-builtinbust-6.js
regress-builtinbust-7.js
regress-calls-with-migrating-prototypes.js
regress-captured-object-no-dummy-use.js
regress-check-eliminate-loop-phis.js
regress-clobbered-fp-regs.js
regress-cnlt-elements.js
regress-cnlt-enum-indices.js
regress-cntl-descriptors-enum.js
regress-compare-constant-doubles.js
regress-conditional-position.js Revert "Removed support deprecated (//@|/*@) source(URL|MappingURL)=" 2016-02-03 18:45:36 +00:00
regress-context-osr.js
regress-convert-enum2.js
regress-convert-enum.js
regress-convert-function-to-double.js
regress-convert-hole2.js
regress-convert-hole.js
regress-convert-transition.js
regress-copy-hole-to-field.js
regress-cr-344285.js
regress-crbug-3184.js
regress-crbug-3867.js
regress-crbug-18639.js
regress-crbug-37853.js
regress-crbug-39160.js
regress-crbug-40931.js
regress-crbug-72736.js
regress-crbug-87478.js
regress-crbug-100859.js
regress-crbug-107996.js
regress-crbug-109362.js Revert "Removed support deprecated (//@|/*@) source(URL|MappingURL)=" 2016-02-03 18:45:36 +00:00
regress-crbug-119800.js
regress-crbug-119926.js
regress-crbug-122271.js
regress-crbug-125148.js
regress-crbug-126414.js
regress-crbug-134055.js
regress-crbug-134609.js
regress-crbug-135008.js
regress-crbug-135066.js
regress-crbug-137689.js
regress-crbug-138887.js
regress-crbug-140083.js
regress-crbug-142087.js
regress-crbug-142218.js
regress-crbug-145961.js
regress-crbug-146910.js
regress-crbug-147475.js
regress-crbug-148376.js
regress-crbug-150545.js
regress-crbug-150729.js
regress-crbug-157019.js
regress-crbug-157520.js
regress-crbug-158185.js
regress-crbug-160010.js
regress-crbug-162085.js
regress-crbug-163530.js
regress-crbug-168545.js
regress-crbug-170856.js
regress-crbug-171715.js
regress-crbug-172345.js
regress-crbug-173907.js
regress-crbug-173907b.js
regress-crbug-173974.js
regress-crbug-178790.js
regress-crbug-181422.js
regress-crbug-196583.js
regress-crbug-217858.js
regress-crbug-222893.js
regress-crbug-229923.js
regress-crbug-233737.js
regress-crbug-240032.js
regress-crbug-242502.js
regress-crbug-242870.js
regress-crbug-242924.js
regress-crbug-243868.js
regress-crbug-244461.js
regress-crbug-245424.js
regress-crbug-245480.js
regress-crbug-258519.js
regress-crbug-259300.js
regress-crbug-260345.js
regress-crbug-263276.js
regress-crbug-272564.js
regress-crbug-274438.js
regress-crbug-280333.js
regress-crbug-285355.js
regress-crbug-305309.js
regress-crbug-306220.js
regress-crbug-306851.js
regress-crbug-309623.js
regress-crbug-315252.js
regress-crbug-318671.js
regress-crbug-319835.js
regress-crbug-319860.js
regress-crbug-320922.js
regress-crbug-323936.js [debugger] allow debug-evaluate to change stack and context values. 2016-03-31 06:00:21 +00:00
regress-crbug-323942.js
regress-crbug-325225.js
regress-crbug-329709.js
regress-crbug-336148.js
regress-crbug-340064.js
regress-crbug-344186.js
regress-crbug-345715.js
regress-crbug-345820.js
regress-crbug-346636.js
regress-crbug-347903.js
regress-crbug-349079.js
regress-crbug-349465.js
regress-crbug-349853.js
regress-crbug-349878.js
regress-crbug-350434.js
regress-crbug-350864.js
regress-crbug-350867.js
regress-crbug-350890.js
regress-crbug-351262.js
regress-crbug-351320.js
regress-crbug-351658.js
regress-crbug-351787.js
regress-crbug-352058.js
regress-crbug-352586.js
regress-crbug-352929.js
regress-crbug-354391.js
regress-crbug-357052.js
regress-crbug-357137.js
regress-crbug-357330.js
regress-crbug-364374.js
regress-crbug-374838.js
regress-crbug-380512.js
regress-crbug-380671.js
regress-crbug-381534.js
regress-crbug-382143.js
regress-crbug-382513.js
regress-crbug-385002.js
regress-crbug-387031.js
regress-crbug-387599.js
regress-crbug-387636.js
regress-crbug-390918.js
regress-crbug-390925.js
regress-crbug-393988.js
regress-crbug-401915.js
regress-crbug-403409.js
regress-crbug-405491.js
regress-crbug-405517.js
regress-crbug-405922.js
regress-crbug-407946.js
regress-crbug-409614.js
regress-crbug-410033.js
regress-crbug-412203.js
regress-crbug-412208.js
regress-crbug-412210.js
regress-crbug-412215.js
regress-crbug-412319.js
regress-crbug-416558.js
regress-crbug-417508.js
regress-crbug-422858.js
regress-crbug-423687.js
regress-crbug-424142.js
regress-crbug-425519.js
regress-crbug-425585.js
regress-crbug-429159.js
regress-crbug-430846.js
regress-crbug-431602.js
regress-crbug-432493.js
regress-crbug-433332.js
regress-crbug-433766.js
regress-crbug-435825.js
regress-crbug-436820.js
regress-crbug-450642.js
regress-crbug-450960.js
regress-crbug-451013.js
regress-crbug-451016.js
regress-crbug-451770.js Remove runtime flags for sloppy mode block scoping features 2016-04-08 00:30:20 +00:00
regress-crbug-454091.js
regress-crbug-455644.js
regress-crbug-465298.js
regress-crbug-465564.js
regress-crbug-467047.js
regress-crbug-467180.js
regress-crbug-467531.js
regress-crbug-469480.js
regress-crbug-469768.js
regress-crbug-471659.js
regress-crbug-471702.js
regress-crbug-474297.js
regress-crbug-476477-1.js [crankshaft] Address the deoptimization loops of Math.floor, Math.round and Math.ceil. 2016-03-29 10:24:54 +00:00
regress-crbug-476477-2.js [crankshaft] Address the deoptimization loops of Math.floor, Math.round and Math.ceil. 2016-03-29 10:24:54 +00:00
regress-crbug-477924.js
regress-crbug-478011.js
regress-crbug-478612.js
regress-crbug-480807.js
regress-crbug-480819.js
regress-crbug-481896.js Revert "Removed support deprecated (//@|/*@) source(URL|MappingURL)=" 2016-02-03 18:45:36 +00:00
regress-crbug-482998.js
regress-crbug-484077.js
regress-crbug-485410.js
regress-crbug-485548-1.js
regress-crbug-485548-2.js
regress-crbug-487105.js
regress-crbug-487289.js
regress-crbug-487322.js
regress-crbug-487608.js
regress-crbug-489293.js
regress-crbug-489597.js
regress-crbug-489597.js-script
regress-crbug-490021.js
regress-crbug-490680.js
regress-crbug-491062.js
regress-crbug-491943.js
regress-crbug-492526.js
regress-crbug-493284.js
regress-crbug-493290.js
regress-crbug-493779.js
regress-crbug-498022.js
regress-crbug-498142.js
regress-crbug-498811.js
regress-crbug-500435.js
regress-crbug-500497.js
regress-crbug-500824.js
regress-crbug-501711.js
regress-crbug-501808.js
regress-crbug-501809.js [Atomics] Fix atomic access index validation 2016-03-25 21:52:52 +00:00
regress-crbug-502930.js
regress-crbug-503578.js
regress-crbug-503698.js
regress-crbug-503968.js
regress-crbug-503991.js
regress-crbug-504136.js
regress-crbug-504727.js
regress-crbug-504729.js
regress-crbug-504787.js
regress-crbug-505007-1.js
regress-crbug-505007-2.js
regress-crbug-505354.js
regress-crbug-505370.js
regress-crbug-505778.js
regress-crbug-505907.js Remove runtime flags for Proxy and Reflect 2016-03-21 19:40:02 +00:00
regress-crbug-506443.js
regress-crbug-506549.js
regress-crbug-506956.js Remove runtime flags for Proxy and Reflect 2016-03-21 19:40:02 +00:00
regress-crbug-507070.js
regress-crbug-510426.js
regress-crbug-510738.js
regress-crbug-511880.js
regress-crbug-513471.js Fix resuming generator marked for optimization. 2016-04-04 11:52:09 +00:00
regress-crbug-513472.js
regress-crbug-513507.js
regress-crbug-513602.js
regress-crbug-514081.js
regress-crbug-516592.js
regress-crbug-516775.js Remove flags for ES2015 features shipped in M48 2016-02-03 20:51:46 +00:00
regress-crbug-517592.js Revert "Removed support deprecated (//@|/*@) source(URL|MappingURL)=" 2016-02-03 18:45:36 +00:00
regress-crbug-518747.js
regress-crbug-522380.js
regress-crbug-522496.js
regress-crbug-522895.js
regress-crbug-523213.js
regress-crbug-523307.js
regress-crbug-523308.js
regress-crbug-523919.js
regress-crbug-527364.js
regress-crbug-530598.js
regress-crbug-537444.js [crankshaft] Fix environment handling after leaving inlined tail call. 2016-04-05 09:43:56 +00:00
regress-crbug-538086.js
regress-crbug-542101.js
regress-crbug-545364.js
regress-crbug-546968.js
regress-crbug-548580.js Remove --harmony-regexps flag 2016-03-25 23:02:11 +00:00
regress-crbug-549162.js
regress-crbug-551287.js
regress-crbug-552304.js
regress-crbug-554831.js
regress-crbug-554946.js
regress-crbug-557807.js
regress-crbug-561973.js
regress-crbug-563929.js
regress-crbug-565917.js
regress-crbug-568477-1.js
regress-crbug-568477-2.js [debugger] fix break locations for assignments and return. 2016-03-01 12:47:55 +00:00
regress-crbug-568477-3.js
regress-crbug-568477-4.js
regress-crbug-568525.js
regress-crbug-569534.js
regress-crbug-570241.js
regress-crbug-570651.js
regress-crbug-571064.js
regress-crbug-571370.js
regress-crbug-571517.js
regress-crbug-572590.js
regress-crbug-573857.js
regress-crbug-573858.js InstanceOfStub incorrectly interprets the hole as a prototype. 2016-03-17 14:32:23 +00:00
regress-crbug-575080.js
regress-crbug-575082.js
regress-crbug-575314.js
regress-crbug-577112.js
regress-crbug-578039-Proxy_construct_prototype_change.js
regress-crbug-580506.js Also check new_target_is_base() bit when comparing two maps for equivalence. 2016-01-25 16:44:01 +00:00
regress-crbug-580584.js [api] Default native data property setter to replace the setter if the property is writable. 2016-01-27 13:22:18 +00:00
regress-crbug-580934.js Ensure arrow functions can close over lexically-scoped variables 2016-01-26 23:11:10 +00:00
regress-crbug-581577.js ES2015 web compat workaround: RegExp.prototype.flags => "" 2016-02-23 01:49:03 +00:00
regress-crbug-582051.js [debugger] correctly find function context. 2016-02-01 07:03:44 +00:00
regress-crbug-582703.js [runtime] Make %FunctionGetScript and %FunctionGetSourceCode robust. 2016-02-03 06:01:19 +00:00
regress-crbug-583257.js More *_STRING_WRAPPER_ELEMENTS fixes 2016-02-02 13:51:00 +00:00
regress-crbug-584188.js Fix Array.prototype.sort for *_STRING_WRAPPER_ELEMENTS 2016-02-05 13:36:51 +00:00
regress-crbug-587068.js [crankshaft] Fix deopt loop in String.fromCharCode on non-int32 inputs. 2016-02-24 10:59:55 +00:00
regress-crbug-589472.js [fullcodegen] Fix assert for operand stack depth tracking. 2016-02-24 16:29:47 +00:00
regress-crbug-589792.js [turbofan] Bailout if LoadBuffer typing assumption doesn't hold. 2016-02-26 11:06:30 +00:00
regress-crbug-590989-1.js [crankshaft] Fix invalid ToNumber optimization. 2016-03-02 19:28:04 +00:00
regress-crbug-590989-2.js [crankshaft] Fix invalid ToNumber optimization. 2016-03-02 19:28:04 +00:00
regress-crbug-592340.js Ensure appropriate bounds checking for Array subclass concat 2016-03-09 18:54:44 +00:00
regress-crbug-592343.js [regexp] Fix off-by-one in CharacterRange::Negate. 2016-03-07 11:00:01 +00:00
regress-crbug-593282.js [regexp] fix bogus assertion in CharacterRange constructor. 2016-03-09 15:55:38 +00:00
regress-crbug-593697-2.js [turbofan] Avoid dereferencing empty handle when inlining a tail call. 2016-03-11 11:41:29 +00:00
regress-crbug-594574-concat-leak-1.js [builtins] Fix Array.prototype.concat bug 2016-03-15 20:29:28 +00:00
regress-crbug-594574-concat-leak-2.js [builtins] Fix Array.prototype.concat bug 2016-03-15 20:29:28 +00:00
regress-crbug-594955.js Fix polymorphic keyed load handler selection for string elements 2016-03-16 10:56:16 +00:00
regress-crbug-595615.js [crankshaft] Check if the function is callable before generating a tail call via Call builtin. 2016-03-21 19:24:28 +00:00
regress-crbug-595657.js [regexp] catch stack overflow when parsing back references. 2016-03-18 14:52:41 +00:00
regress-crbug-595738.js [json] Allow any callable object for toJSON. 2016-03-20 19:35:28 +00:00
regress-crbug-596394.js Ensure CreateDataProperty works correctly on TypedArrays 2016-04-05 16:56:12 +00:00
regress-crbug-598998.js [crankshaft] [turbofan] Fix environment handling when generating a tail call from inlined function. 2016-04-01 07:22:47 +00:00
regress-crbug-599003.js Properly complete in-object slack tracking. 2016-04-04 10:00:44 +00:00
regress-crbug-599067.js Display a meaningfull error message when trying to capture a stack trace to a proxy. 2016-04-04 08:37:30 +00:00
regress-crbug-599073-1.js [ic] Use the CallFunction builtin to invoke accessors. 2016-04-01 06:37:57 +00:00
regress-crbug-599073-2.js [ic] Use the CallFunction builtin to invoke accessors. 2016-04-01 06:37:57 +00:00
regress-crbug-599073-3.js [ic] Use the CallFunction builtin to invoke accessors. 2016-04-01 06:37:57 +00:00
regress-crbug-599073-4.js [ic] Use the CallFunction builtin to invoke accessors. 2016-04-01 06:37:57 +00:00
regress-crbug-599714.js [frames] Also properly deal with TF builtins in OptimizedFrame::GetFunctions(). 2016-04-05 06:41:20 +00:00
regress-crbug-600257.js [regexp] fix assertion failure when parsing close to stack overflow. 2016-04-14 14:44:28 +00:00
regress-crbug-600995.js Reland of [compiler] Make feedback vector cope with flag changes. (patchset #1 id:1 of https://codereview.chromium.org/1876103002/ ) 2016-04-11 18:56:37 +00:00
regress-crbug-601617.js [deoptimizer] Extend assert to also expect kTailCallerFunction as bottommost frame when accessing arguments for inlined function. 2016-04-11 12:20:37 +00:00
regress-create-exception.js
regress-debug-code-recompilation.js
regress-debug-context-load.js
regress-debug-deopt-while-recompile.js [debugger] break at each initialization in a multiple var declaration. 2016-03-07 13:41:18 +00:00
regress-deep-proto.js
regress-delete-empty-double.js
regress-deopt-gc.js
regress-deopt-gcb.js
regress-deopt-in-array-literal-spread.js
regress-deopt-store-effect.js
regress-deoptimize-constant-keyed-load.js
regress-dictionary-to-fast-arguments.js
regress-double-property.js
regress-embedded-cons-string.js
regress-empty-fixed-double-array.js
regress-ensure-initial-map.js
regress-enum-prop-keys-cache-size.js
regress-escape-preserve-smi-representation.js
regress-et-clobbers-doubles.js
regress-eval-cache.js
regress-eval-context.js
regress-existing-shared-function-info.js
regress-fast-empty-string.js
regress-fast-literal-transition.js
regress-filter-contexts.js
regress-force-constant-representation.js
regress-force-representation.js
regress-frame-details-null-receiver.js
regress-freeze-setter.js
regress-freeze.js
regress-function-length-strict.js
regress-fundecl.js
regress-grow-deopt.js
regress-grow-store-smi-check.js
regress-gvn-ftt.js
regress-hoist-load-named-field.js
regress-indirect-push-unchecked.js
regress-inline-arrow-as-construct.js
regress-inline-class-constructor.js
regress-inline-constant-load.js
regress-inline-getter-near-stack-limit.js
regress-inlining-function-literal-context.js
regress-int32-truncation.js
regress-integer-indexed-element.js [runtime] Remove receiver==holder check in IntegerIndexedExotic lookup 2016-02-03 10:30:40 +00:00
regress-is-contextual.js
regress-is-smi-repr.js
regress-iteration-order.js
regress-json-parse-index.js
regress-json-stringify-gc.js
regress-keyed-access-string-length.js
regress-keyed-store-global.js
regress-latin-1.js
regress-lazy-deopt-inlining2.js
regress-lazy-deopt-inlining.js
regress-lazy-deopt-reloc.js
regress-lea-matching.js
regress-load-elements.js
regress-load-field-by-index.js
regress-map-invalidation-1.js
regress-map-invalidation-2.js
regress-mask-array-length.js
regress-merge-descriptors.js
regress-migrate-callbacks.js
regress-mul-canoverflow.js
regress-mul-canoverflowb.js
regress-no-dummy-use-for-arguments-object.js
regress-observe-map-cache.js
regress-omit-checks.js
regress-opt-after-debug-deopt.js
regress-osr-context.js
regress-osr-in-case-label.js
regress-osr-in-literal.js
regress-param-local-type.js
regress-parse-use-strict.js
regress-parseint.js
regress-phi-truncation.js
regress-polymorphic-load.js
regress-polymorphic-store.js
regress-prepare-break-while-recompile.js
regress-push-args-twice.js
regress-put-prototype-transition.js
regress-r3391.js
regress-r4998.js
regress-regexp-codeflush.js
regress-regexp-construct-result.js
regress-regexp-nocase.js
regress-reset-dictionary-elements.js
regress-seqstrsetchar-ex1.js [runtime] Kill %Arguments and %ArgumentsLength. 2016-02-12 12:25:23 +00:00
regress-seqstrsetchar-ex2.js
regress-seqstrsetchar-ex3.js
regress-set-flags-stress-compact.js
regress-shift-enumerable.js
regress-sliced-external-cons-regexp.js
regress-smi-math-floor-round.js
regress-smi-only-concat.js
regress-smi-scanning.js
regress-sort-arguments.js
regress-splice-large-index.js
regress-sqrt.js
regress-store-global-proxy.js
regress-store-heapobject.js
regress-store-uncacheable.js
regress-swapelements.js
regress-transcendental.js
regress-typedarray-length.js
regress-undefined-nan2.js
regress-undefined-nan3.js
regress-undefined-nan.js
regress-undefined-store-keyed-fast-element.js
regress-unsigned-mul-add.js
regress-update-field-type-attributes.js
regress-v8-4839.js [crankshaft] Fix inlining to always connect both branches of test context. 2016-03-17 10:00:21 +00:00
regress-weakening-multiplication.js
regress-x87.js
setter.js
short-circuit.js
splice-missing-wb.js
string-compare-memcmp.js
string-fromcharcode-sideeffect.js
string-set-char-deopt.js
string-split-monkey-patching.js
typed-array-lifetime.js