3ac7a3e5d4
(1) One more place in ic.cc must guard against "lookup->name()" calls when the LookupIterator might be in indexed mode. (2) Rather than burdening LookupIterator users with specifying "kGuaranteedNoTypedArray", we can do the corresponding calculation in the LookupIterator itself, which makes it robust towards any callers that haven't been updated (specifically, in Object.values). Bug: chromium:1027461,chromium:1028213 Change-Id: I76b5d08e309fc2a694955b537adbeb5a30e681f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936474 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#65177}
100 lines
2.4 KiB
JavaScript
100 lines
2.4 KiB
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
// crbug.com/1026974
|
|
(function() {
|
|
function store(obj, key) {
|
|
obj[key] = 10;
|
|
}
|
|
%PrepareFunctionForOptimization(store);
|
|
for (let i = 0; i < 3; i++) {
|
|
let obj = {}
|
|
store(obj, 1152921506754330624);
|
|
assertEquals(["1152921506754330600"], Object.keys(obj));
|
|
}
|
|
})();
|
|
(function() {
|
|
function store(obj, key) {
|
|
obj[key] = 10;
|
|
}
|
|
%PrepareFunctionForOptimization(store);
|
|
for (let i = 0; i < 3; i++) {
|
|
let obj2 = new Int32Array(0);
|
|
store(obj2, 1152921506754330624);
|
|
assertEquals([], Object.keys(obj2));
|
|
store(obj2, "1152921506754330624");
|
|
assertEquals(["1152921506754330624"], Object.keys(obj2));
|
|
}
|
|
})();
|
|
|
|
// crbug.com/1026729
|
|
(function() {
|
|
let key = 0xFFFFFFFF;
|
|
let object = {};
|
|
assertFalse(object.hasOwnProperty(key));
|
|
let proxy = new Proxy({}, {});
|
|
assertFalse(proxy.hasOwnProperty(key));
|
|
})();
|
|
|
|
// crbug.com/1026909
|
|
(function() {
|
|
function load(obj, key) {
|
|
return obj[key];
|
|
}
|
|
%PrepareFunctionForOptimization(load);
|
|
const array = new Float64Array();
|
|
assertEquals(undefined, load(array, 'monomorphic'));
|
|
assertEquals(undefined, load(array, '4294967296'));
|
|
})();
|
|
|
|
// crbug.com/1026856
|
|
(function() {
|
|
let key = 0xFFFFFFFF;
|
|
let receiver = new Int32Array();
|
|
var value = {};
|
|
var target = {};
|
|
Reflect.set(target, key, value, receiver);
|
|
})();
|
|
|
|
// crbug.com/1028213
|
|
(function() {
|
|
function load(obj, key) {
|
|
return obj[key];
|
|
}
|
|
%PrepareFunctionForOptimization(load);
|
|
let obj = function() {};
|
|
obj.__proto__ = new Int8Array(1);
|
|
let key = Object(4294967297);
|
|
for (let i = 0; i < 3; i++) {
|
|
load(obj, key);
|
|
}
|
|
})();
|
|
(function() {
|
|
function load(obj, key) {
|
|
return obj[key];
|
|
}
|
|
%PrepareFunctionForOptimization(load);
|
|
let obj = new String("abc");
|
|
obj.__proto__ = new Int8Array(1);
|
|
let key = Object(4294967297);
|
|
for (let i = 0; i < 3; i++) {
|
|
load(obj, key);
|
|
}
|
|
})();
|
|
|
|
// crbug.com/1027461#c12
|
|
(function() {
|
|
let arr = new Int32Array(2);
|
|
Object.defineProperty(arr, "foo", {get:function() { this.valueOf = 1; }});
|
|
arr[9007199254740991] = 1;
|
|
Object.values(arr);
|
|
|
|
let obj = [1, 2, 3];
|
|
Object.defineProperty(obj, 2, {get:function() { this.valueOf = 1; }});
|
|
obj[9007199254740991] = 1;
|
|
Object.values(obj);
|
|
})();
|