39d2ab58ce
It indexes a FixedArray out of bounds, accessing an arbitrary object which happens to be in that location. Now the object can also be an in-place weak ref, which will cause a crash when trying to use it. BUG=v8:5651 Change-Id: I73e4169e573ecb23e383970d7db336be08f5903c Reviewed-on: https://chromium-review.googlesource.com/1148055 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#54632}
109 lines
4.3 KiB
Plaintext
109 lines
4.3 KiB
Plaintext
# Copyright 2016 the V8 project authors. All rights reserved.
|
|
# Use of this source code is governed by a BSD-style license that can be
|
|
# found in the LICENSE file.
|
|
|
|
[
|
|
[ALWAYS, {
|
|
# All tests in the bug directory are expected to fail.
|
|
'bugs/*': [FAIL],
|
|
|
|
# Issue 3660: Replacing activated TurboFan frames by unoptimized code does
|
|
# not work, but we expect it to not crash.
|
|
'debug/debug-step-turbofan': [PASS, FAIL],
|
|
|
|
# Issue 3641: The new 'then' semantics suppress some exceptions.
|
|
# These tests may be changed or removed when 'chain' is deprecated.
|
|
'debug/es6/debug-promises/reject-with-throw-in-reject': [FAIL],
|
|
'debug/es6/debug-promises/reject-with-undefined-reject': [FAIL],
|
|
'debug/es6/debug-promises/reject-with-invalid-reject': [FAIL],
|
|
|
|
# Issue 5651: Context mismatch in ScopeIterator::Type() for eval default
|
|
# parameter value (the test causes indexing a FixedArray out of bounds ->
|
|
# CRASH is also a reasonable outcome).
|
|
'debug/es6/debug-scope-default-param-with-eval': [FAIL, CRASH],
|
|
|
|
# Slow tests
|
|
'debug/debug-scopes': [PASS, SLOW],
|
|
'debug/debug-stepout-scope-part*': [PASS, SLOW],
|
|
'debug/ignition/debug-step-prefix-bytecodes': [PASS, SLOW, ['mode == debug', SKIP]],
|
|
|
|
# Too slow in debug mode and on slow platforms.
|
|
'regress/regress-2318': [PASS, SLOW, ['mode == debug or (arch != ia32 and arch != x64) or asan == True or msan == True', SKIP]],
|
|
|
|
# forcing weak callback in asan build change break order
|
|
'debug/debug-stepin-builtin-callback': [['asan == True or msan == True', SKIP]],
|
|
}], # ALWAYS
|
|
|
|
##############################################################################
|
|
['variant == stress', {
|
|
# TODO(jarin/mstarzinger): Functions with eval or debugger now get optimized
|
|
# with Turbofan, which has issues with the debugger issues.
|
|
'debug/debug-evaluate-locals': [FAIL],
|
|
|
|
# Very slow in stress mode.
|
|
'regress/regress-2318': [SKIP],
|
|
}], # variant == stress
|
|
|
|
##############################################################################
|
|
['variant == stress_incremental_marking', {
|
|
# BUG(chromium:772010).
|
|
'debug/debug-*': [PASS, ['system == windows', SKIP]],
|
|
}], # variant == stress_incremental_marking
|
|
|
|
##############################################################################
|
|
['gc_stress == True', {
|
|
# Skip tests not suitable for GC stress.
|
|
# Tests taking too long
|
|
'debug/debug-stepout-scope-part1': [SKIP],
|
|
'debug/debug-stepout-scope-part2': [SKIP],
|
|
'debug/debug-stepout-scope-part3': [SKIP],
|
|
'debug/debug-stepout-scope-part4': [SKIP],
|
|
'debug/debug-stepout-scope-part5': [SKIP],
|
|
'debug/debug-stepout-scope-part6': [SKIP],
|
|
'debug/debug-stepout-scope-part7': [SKIP],
|
|
'debug/debug-stepout-scope-part8': [SKIP],
|
|
|
|
# Async function tests taking too long
|
|
# https://bugs.chromium.org/p/v8/issues/detail?id=5411
|
|
'debug/es8/async-debug-caught-exception-cases0': [SKIP],
|
|
'debug/es8/async-debug-caught-exception-cases1': [SKIP],
|
|
'debug/es8/async-debug-caught-exception-cases2': [SKIP],
|
|
'debug/es8/async-debug-caught-exception-cases3': [SKIP],
|
|
'debug/es8/async-function-debug-scopes': [SKIP],
|
|
}], # 'gc_stress == True'
|
|
|
|
##############################################################################
|
|
['variant == no_wasm_traps', {
|
|
'*': [SKIP],
|
|
}], # variant == no_wasm_traps
|
|
|
|
##############################################################################
|
|
['arch == arm and not simulator_run', {
|
|
# Too slow on chromebooks.
|
|
'debug/ignition/debug-step-prefix-bytecodes': [SKIP],
|
|
}], # 'arch == arm and not simulator_run'
|
|
|
|
##############################################################################
|
|
['arch == arm and mode == debug', {
|
|
# Tests taking too long
|
|
'debug/debug-stepout-scope-part1': [SKIP],
|
|
'debug/debug-stepout-scope-part2': [SKIP],
|
|
'debug/debug-stepout-scope-part3': [SKIP],
|
|
'debug/debug-stepout-scope-part4': [SKIP],
|
|
'debug/debug-stepout-scope-part5': [SKIP],
|
|
'debug/debug-stepout-scope-part6': [SKIP],
|
|
'debug/debug-stepout-scope-part7': [SKIP],
|
|
'debug/debug-stepout-scope-part8': [SKIP],
|
|
}], # 'arch == arm and mode == debug'
|
|
|
|
##############################################################################
|
|
['arch == s390 or arch == s390x', {
|
|
|
|
# Stack manipulations in LiveEdit is not implemented for this arch.
|
|
'debug/debug-liveedit-check-stack': [SKIP],
|
|
'debug/debug-liveedit-double-call': [SKIP],
|
|
'debug/debug-liveedit-restart-frame': [SKIP],
|
|
}], # 'arch == s390 or arch == s390x'
|
|
|
|
]
|