v8/test/mjsunit/es6
Caitlin Potter 6c585ef0e8 [runtime] perform type conversion earlier in IntegerIndexedElementSet
When storing an indexed property in a typed array, it's necessary to
convert the value to a Number (or to a Bigint) before performing the
bounds check, per
https://tc39.github.io/ecma262/#sec-integerindexedelementset.

This CL adds appropriate type conversions in
Object::SetPropertyInternal (which technically is reached after the
bounds check has already occurred, but this isn't observable yet ---
In the future, once OOB accesses on TypedArrays actually throw, this
will need to be refactored again), and in StoreFastElementStub, and
ElementsTransitionAndStoreStub (via CSA::EmitElementStore).

The change was not necessary in TurboFan, as
JSNativeContextSpecialization already performs the value conversion
before the boundscheck.

The result is some fixed test262 tests, and some new test coverage
for this behaviour in mjsunit.

BUG=v8:7896, v8:5327
R=neis@chromium.org, jkummerow@chromium.org, gsathya@chromium.org

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ibe6bec24c72ef6a4fd3e77d5bcafa03737f4c5e3
Reviewed-on: https://chromium-review.googlesource.com/1117372
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54096}
2018-06-28 18:28:33 +00:00
..
debug-promises
regress Do not throw if the array is empty in Map constructor 2018-05-02 12:03:26 +00:00
arguments-iterator.js
array-concat-revoked-proxy-1.js
array-concat-revoked-proxy-2.js
array-concat.js
array-copywithin.js
array-fill.js
array-find.js [builtins] Port Array.p.{find,findIndex} to CSA 2017-12-05 07:23:13 +00:00
array-findindex.js [builtins] Port Array.p.{find,findIndex} to CSA 2017-12-05 07:23:13 +00:00
array-from.js [builtins] Implement Array.from in CodeStubAssembler 2018-02-09 14:01:06 +00:00
array-iterator-detached.js
array-iterator-turbo.js [test] Disable --force-slow-path for mjsunit/es6/array-iterator-turbo 2017-11-30 09:05:57 +00:00
array-iterator.js Remove %_ClassOf and SharedFunctionInfo::instance_class_name 2018-02-15 11:52:08 +00:00
array-length.js
array-of.js
array-prototype-values.js
array-reverse-order.js
array-species-constructor-accessor.js Reland "[builtins] Separate species protectors for Array, TypedArray, Promise" 2018-04-23 17:52:50 +00:00
array-species-constructor-delete.js Reland "[builtins] Separate species protectors for Array, TypedArray, Promise" 2018-04-23 17:52:50 +00:00
array-species-constructor.js Reland "[builtins] Separate species protectors for Array, TypedArray, Promise" 2018-04-23 17:52:50 +00:00
array-species-delete.js Reland "[builtins] Separate species protectors for Array, TypedArray, Promise" 2018-04-23 17:52:50 +00:00
array-species-modified.js Reland "[builtins] Separate species protectors for Array, TypedArray, Promise" 2018-04-23 17:52:50 +00:00
array-species-neg-zero.js
array-species-parent-constructor.js Reland "[builtins] Separate species protectors for Array, TypedArray, Promise" 2018-04-23 17:52:50 +00:00
array-species-proto.js Reland "[builtins] Separate species protectors for Array, TypedArray, Promise" 2018-04-23 17:52:50 +00:00
array-species.js [builtins] Array.prototype.concat should set length on return value 2017-08-28 18:02:48 +00:00
array-tostring.js
arraybuffer-species.js
arrow-functions-lexical-arguments.js
arrow-functions-this.js
arrow-functions.js
arrow-rest-params-lazy-parsing.js
arrow-rest-params.js
block-conflicts-sloppy.js
block-conflicts.js
block-const-assign-sloppy.js
block-const-assign.js
block-eval-var-over-let.js
block-for-sloppy.js
block-for.js
block-leave-sloppy.js
block-leave.js
block-let-contextual-sloppy.js
block-let-crankshaft-sloppy.js
block-let-crankshaft.js
block-let-declaration-sloppy.js
block-let-declaration.js
block-let-semantics-sloppy.js
block-let-semantics.js
block-scope-class.js
block-scoping-sloppy.js
block-scoping-top-level-sloppy.js
block-scoping-top-level.js
block-scoping.js
block-sloppy-function.js [scopes] Fix sloppy-mode block-scoped function hoisting edge case 2017-06-22 08:18:55 +00:00
built-in-accessor-names.js
call-with-spread-modify-array-iterator.js [tests] Change '% OptimizeFunctionOnNextCall' to ' %OptimizeFunctionOnNextCall'. 2017-06-02 17:53:48 +00:00
call-with-spread-modify-next.js Reland "[esnext] load iterator.next only once at beginning of iteration" 2018-01-11 20:27:13 +00:00
call-with-spread.js [tests] Change '% OptimizeFunctionOnNextCall' to ' %OptimizeFunctionOnNextCall'. 2017-06-02 17:53:48 +00:00
catch-parameter-redeclaration.js
class-computed-property-names-super.js Reland^2 "[runtime] Slightly optimize creation of class literals." 2017-11-17 18:15:34 +00:00
class-property-name-eval-arguments.js
classes-derived-return-type.js
classes-experimental.js
classes-lazy-parsing.js
classes-maps.js
classes-proxy.js
classes-subclass-arrays.js
classes-subclass-builtins.js
classes-super.js
classes.js [runtime] Fix class literal boilerplates 2018-01-15 16:30:57 +00:00
collection-iterator.js Remove %_ClassOf and SharedFunctionInfo::instance_class_name 2018-02-15 11:52:08 +00:00
collections-constructor-custom-iterator.js [builtins] Fix Collection constructor when entries have custom iteration. 2018-01-25 11:11:29 +00:00
collections-constructor-iterator-side-effect.js [builtins] Re-enable Set and WeakSet constructor fast path. 2018-01-18 15:35:47 +00:00
collections-constructor-with-modified-array-prototype.js [builtins] Fix Collection constructor when entries have custom iteration. 2018-01-25 11:11:29 +00:00
collections-constructor-with-modified-protoype.js [builtins] Re-enable Set and WeakSet constructor fast path. 2018-01-18 15:35:47 +00:00
collections.js Remove %_ClassOf and SharedFunctionInfo::instance_class_name 2018-02-15 11:52:08 +00:00
completion.js [parsing] Fix bug in rewriter concerning a breakable try-finally. 2017-11-28 09:07:51 +00:00
computed-property-names-classes.js
computed-property-names-deopt.js
computed-property-names-object-literals-methods.js Remove always-true --harmony-async-iteration runtime flag 2018-01-12 20:14:34 +00:00
computed-property-names-super.js
computed-property-names.js
dataview-length.js Reland "[builtins] set DataView.length to 1" 2018-06-12 21:54:47 +00:00
default-parameters-destructuring.js
default-parameters.js
destructuring-assignment-lazy.js
destructuring-assignment.js [runtime] Harden JSFunction::CalculateInstanceSizeHelper(...) 2018-02-12 20:54:29 +00:00
destructuring-parameters-literalcount-nolazy.js
destructuring-parameters-literalcount.js
destructuring.js
empty-for.js
for-each-in-catch.js
for-of.js
function-length-configurable.js
function-name-configurable.js
function-name.js [parser] Improve propagation of SharedFunctionInfo::has_shared_name(). 2017-06-20 09:27:49 +00:00
function-prototype-name.js
generator-destructuring.js
generators-iteration.js
generators-objects.js Remove %_ClassOf and SharedFunctionInfo::instance_class_name 2018-02-15 11:52:08 +00:00
generators-parsing.js
generators-poisoned-properties.js
generators-runtime.js
generators-states.js
global-proto-proxy.js
hasinstance-symbol.js
indexed-integer-exotics.js
instanceof-proxies.js
instanceof.js
iteration-semantics.js Reland "[esnext] load iterator.next only once at beginning of iteration" 2018-01-11 20:27:13 +00:00
iteration-syntax.js
iterator-close.js
iterator-prototype.js
json.js
map-constructor-entry-side-effect2.js [builtins] Re-enable Set and WeakSet constructor fast path. 2018-01-18 15:35:47 +00:00
map-constructor-entry-side-effect3.js [builtins] Re-enable Set and WeakSet constructor fast path. 2018-01-18 15:35:47 +00:00
map-constructor-entry-side-effect4.js [builtins] Re-enable Set and WeakSet constructor fast path. 2018-01-18 15:35:47 +00:00
map-constructor-entry-side-effect.js [builtins] Re-enable Set and WeakSet constructor fast path. 2018-01-18 15:35:47 +00:00
map-minus-zero.js
math-cbrt.js
math-clz32.js
math-expm1.js
math-fround.js
math-hyperbolic.js
math-hypot.js
math-log1p.js
math-log2-log10.js
math-sign.js
math-trunc.js
math.js
method-name-eval-arguments.js
microtask-delivery.js
new-target.js delete new.target should return true 2017-10-06 15:29:15 +00:00
numeric-literals.js
object-assign.js
object-literals-method.js
object-literals-property-shorthand.js
object-literals-super.js
object-tostring.js
pattern-brand-check.js
promise-all-overflow-1.js [builtins] Reduce resolve element closure overhead in Promise.all. 2018-03-22 10:55:20 +00:00
promise-all-overflow-2.js [builtins] Reduce resolve element closure overhead in Promise.all. 2018-03-22 10:55:20 +00:00
promise-all.js [builtins] Reduce resolve element closure overhead in Promise.all. 2018-03-22 10:55:20 +00:00
promise-internal-setter.js
promise-lookup-getter-setter.js
promise-resolve-thenable-job.js [builtins] Optimize PromiseResolveThenableJob for the common case. 2018-02-13 05:36:39 +00:00
promise-species.js
promise-thenable-proxy.js
promises.js [promise] Promise.all with broken iterable rejects rather than throwing 2018-03-13 12:31:35 +00:00
prototype-ordinary-objects.js
proxies-accesschecks.js
proxies-apply.js [builtins] Introduce CallProxy builtin based on CSA 2017-07-14 11:22:48 +00:00
proxies-bind.js
proxies-construct.js [builtins] Introduce ConstructProxy builtin based on CSA 2017-07-19 05:21:13 +00:00
proxies-constructor.js [builtins] Port Proxy constructor to CSA. 2017-07-10 12:15:53 +00:00
proxies-cross-realm-exception.js
proxies-define-property.js
proxies-delete-property.js
proxies-example-membrane.js
proxies-for.js
proxies-function.js
proxies-get-own-property-descriptor.js
proxies-get-prototype-of.js
proxies-get.js Reland "[builtins] Port Proxy set trap to CSA" 2017-09-01 13:45:54 +00:00
proxies-global-reference.js
proxies-has-own-property.js
proxies-has.js [builtins] Port Proxy has trap to CSA 2017-08-16 13:05:45 +00:00
proxies-hash.js
proxies-integrity.js
proxies-is-extensible.js
proxies-json.js
proxies-keys.js
proxies-object-assign.js
proxies-ownkeys.js
proxies-prevent-extensions.js
proxies-property-is-enumerable.js
proxies-prototype-handler-stackoverflow.js
proxies-prototype-target-stackoverflow.js
proxies-revocable.js
proxies-set-prototype-of.js
proxies-set.js Reland "[builtins] Port Proxy set trap to CSA" 2017-09-01 13:45:54 +00:00
proxies-with-unscopables.js
proxies-with.js
proxies.js ToString of a Proxied function should not throw 2018-02-22 22:55:50 +00:00
proxy-function-tostring.js ToString of a Proxied function should not throw 2018-02-22 22:55:50 +00:00
reflect-apply.js
reflect-construct.js Remove always-true --harmony-async-iteration runtime flag 2018-01-12 20:14:34 +00:00
reflect-define-property.js Fix common misspellings 2017-08-02 09:35:28 +00:00
reflect-get-own-property-descriptor.js
reflect-get-prototype-of.js
reflect-own-keys.js
reflect-prevent-extensions.js
reflect-set-prototype-of.js
reflect.js [cleanup] Remove some obsolete TODOs. 2018-04-27 10:27:27 +00:00
regexp-constructor.js
regexp-flags.js
regexp-match-lastindex.js
regexp-prototype.js
regexp-replace-lastindex.js
regexp-sticky.js [builtins] Port String.prototype.{search, match} to CSA 2017-10-11 12:05:22 +00:00
regexp-tolength.js
regexp-tostring.js
rest-params-lazy-parsing.js
rest-params.js
set-minus-zero.js
sloppy-no-duplicate-generators.js [parser] Remove always-true flag --harmony-restrictive-generators 2017-10-25 18:08:40 +00:00
sloppy-restrictive-block-function.js
species.js
spread-array-misc.js [ic] Introduce new IC for storing into array literals. 2018-03-02 21:12:57 +00:00
spread-array-mutated-prototype.js Add more tests for array spread literals. 2018-01-18 12:29:34 +00:00
spread-array-pristine-prototype.js Add more tests for array spread literals. 2018-01-18 12:29:34 +00:00
spread-array-prototype-proxy.js Add more tests for array spread literals. 2018-01-18 12:29:34 +00:00
spread-array-prototype-setter1.js Add more tests for array spread literals. 2018-01-18 12:29:34 +00:00
spread-array-prototype-setter2.js Add more tests for array spread literals. 2018-01-18 12:29:34 +00:00
spread-call-new-class.js
spread-call-new.js
spread-call-super-property.js
spread-call.js Reland "[esnext] load iterator.next only once at beginning of iteration" 2018-01-11 20:27:13 +00:00
string-codepointat.js
string-endswith.js
string-fromcodepoint.js [turbofan] Improve performance of mjsunit test 2018-03-26 11:34:58 +00:00
string-html.js [builtins] Convert String HTML functions (ex. anchor, big, bold) to CSA 2017-09-16 07:18:32 +00:00
string-includes.js
string-iterator.js
string-match.js [builtins] Port String.prototype.{search, match} to CSA 2017-10-11 12:05:22 +00:00
string-raw.js
string-repeat.js [builtins] Port String.prototype.repeat to CSA 2017-09-15 06:51:56 +00:00
string-replace.js
string-search.js [builtins] Port String.prototype.{search, match} to CSA 2017-10-11 12:05:22 +00:00
string-split.js
string-startswith.js
super-with-spread-modify-array-iterator.js [tests] Change '% OptimizeFunctionOnNextCall' to ' %OptimizeFunctionOnNextCall'. 2017-06-02 17:53:48 +00:00
super-with-spread-modify-next.js Reland "[esnext] load iterator.next only once at beginning of iteration" 2018-01-11 20:27:13 +00:00
super-with-spread.js [tests] Change '% OptimizeFunctionOnNextCall' to ' %OptimizeFunctionOnNextCall'. 2017-06-02 17:53:48 +00:00
super.js
symbols.js Remove %_ClassOf and SharedFunctionInfo::instance_class_name 2018-02-15 11:52:08 +00:00
templates.js [esnext] fix tagged template caching strategy for eval caching 2018-02-19 15:15:01 +00:00
throw-type-error-function-restrictions.js
typed-array-iterator.js
typedarray-construct-by-array-like-prototype-element-added.js
typedarray-construct-by-array-like.js [typedarrays] Throw on construction of a detached typed array. 2018-05-07 15:30:48 +00:00
typedarray-construct-by-buffer-ordering.js
typedarray-construct-offset-not-smi.js [tests] Use mock arraybuffer allocator in test to avoid huge allocation. 2017-07-03 08:11:00 +00:00
typedarray-copywithin.js
typedarray-every.js Remove %_ClassOf and SharedFunctionInfo::instance_class_name 2018-02-15 11:52:08 +00:00
typedarray-fill.js
typedarray-filter.js [typedarray] Port TA.p.filter to CSA 2018-02-14 12:20:09 +00:00
typedarray-find.js
typedarray-findindex.js
typedarray-foreach.js Remove %_ClassOf and SharedFunctionInfo::instance_class_name 2018-02-15 11:52:08 +00:00
typedarray-from.js [typedarray] Fix IterableToList when Number has an iterator 2018-02-22 10:23:32 +00:00
typedarray-indexing.js
typedarray-iteration.js
typedarray-keyedstore-tonumber.js [runtime] perform type conversion earlier in IntegerIndexedElementSet 2018-06-28 18:28:33 +00:00
typedarray-map.js [builtins] Enable %TypedArray%.prototype.{some,every,reduce,reduceRight,map} CSA builtins by default 2017-05-19 12:17:37 +00:00
typedarray-neutered.js
typedarray-of.js [typedarray] Migrate %TypedArray%.of to CSA 2018-02-07 12:45:37 +00:00
typedarray-proto.js
typedarray-reduce.js
typedarray-reverse.js
typedarray-set-bytelength-not-smi.js [typedarray] Widen set fast path for JSTypedArray source arguments 2017-11-27 17:32:15 +00:00
typedarray-set-length-internal.js
typedarray-set-length.js
typedarray-slice.js Fix common misspellings 2017-08-02 09:35:28 +00:00
typedarray-sort.js [typedarray] Change TypedArray.p.sort implementation. 2018-05-24 10:29:12 +00:00
typedarray-species.js
typedarray-tostring.js
typedarray.js Reland "[esnext] load iterator.next only once at beginning of iteration" 2018-01-11 20:27:13 +00:00
unicode-character-ranges.js Remove always-on flags for RegExp dotAll and lookbehind 2017-11-17 16:47:19 +00:00
unicode-escapes-in-regexps.js
unicode-escapes.js
unicode-regexp-backrefs.js Remove always-on flags for RegExp dotAll and lookbehind 2017-11-17 16:47:19 +00:00
unicode-regexp-ignore-case-noi18n.js
unicode-regexp-ignore-case.js
unicode-regexp-last-index.js Remove always-on flags for RegExp dotAll and lookbehind 2017-11-17 16:47:19 +00:00
unicode-regexp-restricted-syntax.js [regexp] make lookbehind assertions non-quantifiable. 2018-02-20 11:24:32 +00:00
unicode-regexp-unanchored-advance.js
unicode-regexp-zero-length.js
unscopables.js