v8/test/mjsunit/regress/regress-crbug-1055138-1.js
Igor Sheludko ae6c58c26d [ic] Fix stores to holey elements
... when the element is read-only in one of the prototypes:
* the length should not be updated,
* in strict mode the store operation should throw TypeError.

Bug: chromium:1055138
Change-Id: I7fc08e22c83f8a9848053cfe20851dc1b82f0e3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172090
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67717}
2020-05-11 16:42:19 +00:00

65 lines
1.7 KiB
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
Object.prototype[1] = 153;
Object.freeze(Object.prototype);
(function TestSloppyStoreToReadOnlyProperty() {
function foo() {
let ar = [];
for (let i = 0; i < 3; i++) {
ar[i] = 42;
if (i == 1) {
// Attempt to overwrite read-only element should not change
// array length.
assertEquals(1, ar.length);
} else {
assertEquals(i + 1, ar.length);
}
}
return ar;
}
assertEquals([42,153,42], foo());
assertEquals([42,153,42], foo());
assertEquals([42,153,42], foo());
%PrepareFunctionForOptimization(foo);
assertEquals([42,153,42], foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals([42,153,42], foo());
})();
(function StrictStoreToReadOnlyProperty() {
function foo() {
"use strict";
let ar = [];
let threw_exception = false;
for (let i = 0; i < 3; i++) {
try {
ar[i] = 42;
} catch(e) {
// Attempt to overwrite read-only element should throw and
// should not change array length.
assertTrue(i == 1);
assertEquals(1, ar.length);
assertInstanceof(e, TypeError);
threw_exception = true;
}
}
assertTrue(threw_exception);
return ar;
}
assertEquals([42,153,42], foo());
assertEquals([42,153,42], foo());
assertEquals([42,153,42], foo());
%PrepareFunctionForOptimization(foo);
assertEquals([42,153,42], foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals([42,153,42], foo());
})();