e63d74b117
This reverts commit b9194e93f2
.
Reason for revert: Makes old pipeline flaky with custom snapshot:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/14049
Original change's description:
> [heap-verification] Increase verification for arguments objects
>
> BUG: v8:6251
> Change-Id: I8a6dd528656a69c7910770acaf2133830b60c291
> Reviewed-on: https://chromium-review.googlesource.com/475651
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44609}
TBR=jkummerow@chromium.org,cbruni@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Change-Id: Iedfdad290bf4f5f6ec2534e8c5378a7cc195db82
Reviewed-on: https://chromium-review.googlesource.com/475719
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44616}
155 lines
4.1 KiB
JavaScript
155 lines
4.1 KiB
JavaScript
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
function f(a, b, c, d) { return arguments; }
|
|
|
|
// Ensure non-configurable argument elements stay non-configurable.
|
|
(function () {
|
|
var args = f(1);
|
|
Object.defineProperty(args, "0", {value: 10, configurable: false});
|
|
assertFalse(Object.getOwnPropertyDescriptor(args, "0").configurable);
|
|
for (var i = 0; i < 10; i++) {
|
|
args[i] = 1;
|
|
}
|
|
assertFalse(Object.getOwnPropertyDescriptor(args, "0").configurable);
|
|
})();
|
|
|
|
// Ensure read-only properties on the prototype chain cause TypeError.
|
|
|
|
// Newly added.
|
|
(function () {
|
|
var o = [];
|
|
var proto = {};
|
|
var index = 3;
|
|
function store(o, i, v) { "use strict"; o[i] = v; };
|
|
o.__proto__ = proto;
|
|
for (var i = 0; i < index; i++) {
|
|
store(o, i, 0);
|
|
}
|
|
Object.defineProperty(proto, index, {value: 100, writable: false});
|
|
assertThrows(function() { store(o, index, 0); });
|
|
assertEquals(100, o[index]);
|
|
})();
|
|
|
|
// Reconfigured.
|
|
(function () {
|
|
var o = [];
|
|
var proto = {3: 10000};
|
|
var index = 3;
|
|
function store(o, i, v) { "use strict"; o[i] = v; };
|
|
o.__proto__ = proto;
|
|
for (var i = 0; i < index; i++) {
|
|
store(o, i, 0);
|
|
}
|
|
Object.defineProperty(proto, index, {value: 100, writable: false});
|
|
assertThrows(function() { store(o, index, 0); });
|
|
assertEquals(100, o[index]);
|
|
})();
|
|
|
|
// Newly added to arguments object.
|
|
(function () {
|
|
var o = [];
|
|
var proto = f(100);
|
|
var index = 3;
|
|
function store(o, i, v) { "use strict"; o[i] = v; };
|
|
o.__proto__ = proto;
|
|
for (var i = 0; i < index; i++) {
|
|
store(o, i, 0);
|
|
}
|
|
Object.defineProperty(proto, index, {value: 100, writable: false});
|
|
assertThrows(function() { store(o, index, 0); });
|
|
assertEquals(100, o[index]);
|
|
})();
|
|
|
|
// Reconfigured on to arguments object.
|
|
(function () {
|
|
var o = [];
|
|
var proto = f(100, 200, 300, 400);
|
|
var index = 3;
|
|
function store(o, i, v) { "use strict"; o[i] = v; };
|
|
o.__proto__ = proto;
|
|
for (var i = 0; i < index; i++) {
|
|
store(o, i, 0);
|
|
}
|
|
Object.defineProperty(proto, index, {value: 100, writable: false});
|
|
assertThrows(function() { store(o, index, 0); });
|
|
assertEquals(100, o[index]);
|
|
})();
|
|
|
|
// Extensions prevented object.
|
|
(function () {
|
|
var o = [];
|
|
var proto = [0, 1, 2, 3];
|
|
var index = 3;
|
|
function store(o, i, v) { "use strict"; o[i] = v; };
|
|
o.__proto__ = proto;
|
|
for (var i = 0; i < index; i++) {
|
|
store(o, i, 0);
|
|
}
|
|
Object.preventExtensions(proto);
|
|
Object.defineProperty(proto, index, {value: 100, writable: false});
|
|
assertThrows(function() { store(o, index, 0); });
|
|
assertEquals(100, o[index]);
|
|
})();
|
|
|
|
// Extensions prevented arguments object.
|
|
(function () {
|
|
var o = [];
|
|
var proto = f(100, 200, 300, 400);
|
|
var index = 3;
|
|
function store(o, i, v) { "use strict"; o[i] = v; };
|
|
o.__proto__ = proto;
|
|
for (var i = 0; i < index; i++) {
|
|
store(o, i, 0);
|
|
}
|
|
Object.preventExtensions(proto);
|
|
Object.defineProperty(proto, index, {value: 100, writable: false});
|
|
assertThrows(function() { store(o, index, 0); });
|
|
assertEquals(100, o[index]);
|
|
})();
|
|
|
|
// Array with large index.
|
|
(function () {
|
|
var o = [];
|
|
var proto = [];
|
|
var index = 3;
|
|
function store(o, i, v) { "use strict"; o[i] = v; };
|
|
o.__proto__ = proto;
|
|
for (var i = 0; i < index; i++) {
|
|
store(o, i, 0);
|
|
}
|
|
proto[1 << 30] = 1;
|
|
Object.defineProperty(proto, index, {value: 100, writable: false});
|
|
assertThrows(function() { store(o, index, 0); });
|
|
assertEquals(100, o[index]);
|
|
})();
|
|
|
|
// Frozen object.
|
|
(function () {
|
|
var o = [];
|
|
var proto = [0, 1, 2, 3];
|
|
function store(o, i, v) { "use strict"; o[i] = v; };
|
|
o.__proto__ = proto;
|
|
for (var i = 0; i < 3; i++) {
|
|
store(o, i, 0);
|
|
}
|
|
Object.freeze(proto);
|
|
assertThrows(function() { store(o, 3, 0); });
|
|
assertEquals(3, o[3]);
|
|
})();
|
|
|
|
// Frozen arguments object.
|
|
(function () {
|
|
var o = [];
|
|
var proto = f(0, 1, 2, 3);
|
|
function store(o, i, v) { "use strict"; o[i] = v; };
|
|
o.__proto__ = proto;
|
|
for (var i = 0; i < 3; i++) {
|
|
store(o, i, 0);
|
|
}
|
|
Object.freeze(proto);
|
|
assertThrows(function() { store(o, 3, 0); });
|
|
assertEquals(3, o[3]);
|
|
})();
|