Title: [255390] trunk/JSTests
- Revision
- 255390
- Author
- ysuz...@apple.com
- Date
- 2020-01-29 15:02:28 -0800 (Wed, 29 Jan 2020)
Log Message
Unreviewed, update tests
https://bugs.webkit.org/show_bug.cgi?id=206846
* stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-debug.js: Copied from JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js.
(shouldBe):
(putter):
(not_string.toString):
* stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js:
* stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten-debug.js: Copied from JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js.
(shouldBe):
(dictionary):
(putter):
(not_string.toString):
* stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js:
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (255389 => 255390)
--- trunk/JSTests/ChangeLog 2020-01-29 22:51:11 UTC (rev 255389)
+++ trunk/JSTests/ChangeLog 2020-01-29 23:02:28 UTC (rev 255390)
@@ -1,3 +1,20 @@
+2020-01-29 Yusuke Suzuki <ysuz...@apple.com>
+
+ Unreviewed, update tests
+ https://bugs.webkit.org/show_bug.cgi?id=206846
+
+ * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-debug.js: Copied from JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js.
+ (shouldBe):
+ (putter):
+ (not_string.toString):
+ * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js:
+ * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten-debug.js: Copied from JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js.
+ (shouldBe):
+ (dictionary):
+ (putter):
+ (not_string.toString):
+ * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js:
+
2020-01-28 Yusuke Suzuki <ysuz...@apple.com>
[JSC] Give up IC when unknown structure transition happens
Copied: trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-debug.js (from rev 255385, trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js) (0 => 255390)
--- trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-debug.js (rev 0)
+++ trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-debug.js 2020-01-29 23:02:28 UTC (rev 255390)
@@ -0,0 +1,28 @@
+//@ skip if $buildType != "debug"
+//@ crash!
+//@ runDefault("--useLLInt=true")
+
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+var putter = function(o) {
+ o._unsupported = not_string;
+}
+
+var object;
+var counter = 0;
+var not_string = {
+ toString() {
+ counter++;
+ object.ok = 42;
+ return "Hey";
+ }
+};
+
+for (var i = 0; i < 1000; ++i) {
+ object = $vm.createObjectDoingSideEffectPutWithoutCorrectSlotStatus();
+ putter(object);
+}
+shouldBe(counter, 1000);
Modified: trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js (255389 => 255390)
--- trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js 2020-01-29 22:51:11 UTC (rev 255389)
+++ trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js 2020-01-29 23:02:28 UTC (rev 255390)
@@ -1,3 +1,5 @@
+//@ skip if $buildType == "debug"
+
function shouldBe(actual, expected) {
if (actual !== expected)
throw new Error('bad value: ' + actual);
Copied: trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten-debug.js (from rev 255385, trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js) (0 => 255390)
--- trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten-debug.js (rev 0)
+++ trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten-debug.js 2020-01-29 23:02:28 UTC (rev 255390)
@@ -0,0 +1,35 @@
+//@ skip if $buildType != "debug"
+//@ crash!
+//@ runDefault("--useLLInt=true")
+
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function dictionary() {
+ var object = $vm.createObjectDoingSideEffectPutWithoutCorrectSlotStatus();
+ for(var i = 0; i < 66; i++)
+ object['p'+i] = i;
+ return object;
+}
+
+function putter(o) {
+ o._unsupported = not_string;
+}
+
+var d;
+var not_string = {
+ toString() {
+ for(var i = 3; i < 66; i++)
+ delete d['p'+i];
+ for(i in Object.create(d));
+ return null;
+ }
+};
+
+for (var i = 0; i < 100; ++i) {
+ d = dictionary();
+ putter(d);
+ shouldBe('p3' in d, false);
+}
Modified: trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js (255389 => 255390)
--- trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js 2020-01-29 22:51:11 UTC (rev 255389)
+++ trunk/JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js 2020-01-29 23:02:28 UTC (rev 255390)
@@ -1,3 +1,5 @@
+//@ skip if $buildType == "debug"
+
function shouldBe(actual, expected) {
if (actual !== expected)
throw new Error('bad value: ' + actual);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
