v8/test/mjsunit/regress/large-indices.js
Jakob Kummerow 0445fa2971 [lookup] Refactor LookupIterator "property or element" creation
This CL factors out the decision-making logic whether a property key should
be treated as a "property" or "element" into LookupIterator::Key, which can
be constructed on its own, allowing use sites to take this distinction into
account before constructing a LookupIterator from the Key, without needing
to duplicate the logic.
This also makes the assortment of LookupIterator constructors more uniform.

Bug: chromium:1031175
Change-Id: I81d7b11ab7e4915f5c05668138e6e0c51ae11821
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962272
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65672}
2020-01-09 18:39:11 +00:00

140 lines
3.1 KiB
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
// crbug.com/1026974
(function() {
function store(obj, key) {
obj[key] = 10;
}
%PrepareFunctionForOptimization(store);
for (let i = 0; i < 3; i++) {
let obj = {}
store(obj, 1152921506754330624);
assertEquals(["1152921506754330600"], Object.keys(obj));
}
})();
(function() {
function store(obj, key) {
obj[key] = 10;
}
%PrepareFunctionForOptimization(store);
for (let i = 0; i < 3; i++) {
let obj2 = new Int32Array(0);
store(obj2, 1152921506754330624);
assertEquals([], Object.keys(obj2));
store(obj2, "1152921506754330624");
assertEquals(["1152921506754330624"], Object.keys(obj2));
}
})();
// crbug.com/1026729
(function() {
let key = 0xFFFFFFFF;
let object = {};
assertFalse(object.hasOwnProperty(key));
let proxy = new Proxy({}, {});
assertFalse(proxy.hasOwnProperty(key));
})();
// crbug.com/1026909
(function() {
function load(obj, key) {
return obj[key];
}
%PrepareFunctionForOptimization(load);
const array = new Float64Array();
assertEquals(undefined, load(array, 'monomorphic'));
assertEquals(undefined, load(array, '4294967296'));
})();
// crbug.com/1026856
(function() {
let key = 0xFFFFFFFF;
let receiver = new Int32Array();
var value = {};
var target = {};
Reflect.set(target, key, value, receiver);
})();
// crbug.com/1028213
(function() {
function load(obj, key) {
return obj[key];
}
%PrepareFunctionForOptimization(load);
let obj = function() {};
obj.__proto__ = new Int8Array(1);
let key = Object(4294967297);
for (let i = 0; i < 3; i++) {
load(obj, key);
}
})();
(function() {
function load(obj, key) {
return obj[key];
}
%PrepareFunctionForOptimization(load);
let obj = new String("abc");
obj.__proto__ = new Int8Array(1);
let key = Object(4294967297);
for (let i = 0; i < 3; i++) {
load(obj, key);
}
})();
// crbug.com/1027461#c12
(function() {
let arr = new Int32Array(2);
Object.defineProperty(arr, "foo", {get:function() { this.valueOf = 1; }});
arr[9007199254740991] = 1;
Object.values(arr);
let obj = [1, 2, 3];
Object.defineProperty(obj, 2, {get:function() { this.valueOf = 1; }});
obj[9007199254740991] = 1;
Object.values(obj);
})();
// crbug.com/1027461#c18
(function() {
const v7 = Object(1);
v7[4294967297] = 1;
const v8 = Object.assign({}, v7);
})();
// crbug.com/1029369
(function () {
let obj = {};
function AddProperty(o, k) {
Object.defineProperty(o, k, {});
if (!o.hasOwnProperty(k)) throw "Bug!";
}
AddProperty(obj, "1"); // Force dictionary-mode elements.
AddProperty(obj, 4294967295);
})();
// crbug.com/1029338
(function() {
var __v_11 = {};
__v_11.__defineGetter__(4294967295, function () {});
__v_12 = Object.entries(__v_11);
})();
// crbug.com/1031175
(function() {
var key = 4294967295;
var obj = {
boom() {
super[key]++;
},
bang() {
super["4294967295"]++;
}
}
obj.boom();
obj.bang();
})();