Diff
Modified: trunk/JSTests/ChangeLog (235900 => 235901)
--- trunk/JSTests/ChangeLog 2018-09-11 17:54:58 UTC (rev 235900)
+++ trunk/JSTests/ChangeLog 2018-09-11 17:59:37 UTC (rev 235901)
@@ -1,5 +1,17 @@
2018-09-11 Mark Lam <[email protected]>
+ Test for array memcpy'ing when JSGlobalObject::haveABadTime.
+ https://bugs.webkit.org/show_bug.cgi?id=169889
+ <rdar://problem/31155607>
+
+ Reviewed by Saam Barati.
+
+ * stress/regress-169889-array-concat.js: Added.
+ * stress/regress-169889-array-concat1.js: Added.
+ * stress/regress-169889-array-slice.js: Added.
+
+2018-09-11 Mark Lam <[email protected]>
+
Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
https://bugs.webkit.org/show_bug.cgi?id=169445
<rdar://problem/30957435>
Added: trunk/JSTests/stress/regress-169889-array-concat.js (0 => 235901)
--- trunk/JSTests/stress/regress-169889-array-concat.js (rev 0)
+++ trunk/JSTests/stress/regress-169889-array-concat.js 2018-09-11 17:59:37 UTC (rev 235901)
@@ -0,0 +1,28 @@
+//@ runFTLNoCJIT
+
+Array.prototype.__defineGetter__(100, () => 1);
+
+let childGlobal = createGlobalObject();
+let a = new childGlobal.Array(2.3023e-320, 2.3023e-320);
+let b = new childGlobal.Array(2.3023e-320, 2.3023e-320);
+
+var tierWarmUpIterations = [
+ 1, // LLInt
+ 50, // baseline JIT
+ 500, // DFG
+ 10000, // FTL
+];
+
+function doTest(warmUpIterations) {
+ var test = new Function("a", "b", "return Array.prototype.concat.call(a, b).toString();");
+ noInline(test);
+
+ for (var i = 0; i < warmUpIterations; i++)
+ test([1, 2], [3, 4]);
+
+ test(a, b);
+}
+
+for (var warmUpIterations of tierWarmUpIterations)
+ doTest(warmUpIterations);
+
Added: trunk/JSTests/stress/regress-169889-array-concat1.js (0 => 235901)
--- trunk/JSTests/stress/regress-169889-array-concat1.js (rev 0)
+++ trunk/JSTests/stress/regress-169889-array-concat1.js 2018-09-11 17:59:37 UTC (rev 235901)
@@ -0,0 +1,28 @@
+//@ runFTLNoCJIT
+
+Array.prototype.__defineGetter__(100, () => 1);
+
+let childGlobal = createGlobalObject();
+let a = new childGlobal.Array(2.3023e-320, 2.3023e-320);
+let b = 2.3023e-320;
+
+var tierWarmUpIterations = [
+ 1, // LLInt
+ 50, // baseline JIT
+ 500, // DFG
+ 10000, // FTL
+];
+
+function doTest(warmUpIterations) {
+ var test = new Function("a", "b", "return Array.prototype.concat.call(a, b).toString();");
+ noInline(test);
+
+ for (var i = 0; i < warmUpIterations; i++)
+ test([1, 2], [3, 4]);
+
+ test(a, b);
+}
+
+for (var warmUpIterations of tierWarmUpIterations)
+ doTest(warmUpIterations);
+
Added: trunk/JSTests/stress/regress-169889-array-slice.js (0 => 235901)
--- trunk/JSTests/stress/regress-169889-array-slice.js (rev 0)
+++ trunk/JSTests/stress/regress-169889-array-slice.js 2018-09-11 17:59:37 UTC (rev 235901)
@@ -0,0 +1,27 @@
+//@ runFTLNoCJIT
+
+Array.prototype.__defineGetter__(100, () => 1);
+
+let childGlobal = createGlobalObject();
+let a = new childGlobal.Array(2.3023e-320, 2.3023e-320, 2.3023e-320, 2.3023e-320, 2.3023e-320, 2.3023e-320);
+
+var tierWarmUpIterations = [
+ 1, // LLInt
+ 50, // baseline JIT
+ 500, // DFG
+ 10000, // FTL
+];
+
+function doTest(warmUpIterations) {
+ var test = new Function("a", "return Array.prototype.slice.call(a).toString();");
+ noInline(test);
+
+ for (var i = 0; i < warmUpIterations; i++)
+ test([1, 2, 3]);
+
+ test(a);
+}
+
+for (var warmUpIterations of tierWarmUpIterations)
+ doTest(warmUpIterations);
+
