summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/self-hosting
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
commit36d22d82aa202bb199967e9512281e9a53db42c9 (patch)
tree105e8c98ddea1c1e4784a60a5a6410fa416be2de /js/src/jit-test/tests/self-hosting
parentInitial commit. (diff)
downloadfirefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz
firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'js/src/jit-test/tests/self-hosting')
-rw-r--r--js/src/jit-test/tests/self-hosting/GetStringDataProperty.js23
-rw-r--r--js/src/jit-test/tests/self-hosting/bug1264575.js7
-rw-r--r--js/src/jit-test/tests/self-hosting/bug957004.js3
-rw-r--r--js/src/jit-test/tests/self-hosting/define-value-property.js8
-rw-r--r--js/src/jit-test/tests/self-hosting/get-backtrace-in-constructing-bound-function.js6
-rw-r--r--js/src/jit-test/tests/self-hosting/get-intrinsic.js19
-rw-r--r--js/src/jit-test/tests/self-hosting/intl-fallback-original.js9
-rw-r--r--js/src/jit-test/tests/self-hosting/invoke-self-hosted-function.js9
-rw-r--r--js/src/jit-test/tests/self-hosting/invoke-self-hosted-with-primitive-this.js7
-rw-r--r--js/src/jit-test/tests/self-hosting/is-constructor-inlined.js16
-rw-r--r--js/src/jit-test/tests/self-hosting/is-constructor-on-wrapper.js17
-rw-r--r--js/src/jit-test/tests/self-hosting/is-possibly-wrapped-typed-array.js91
-rw-r--r--js/src/jit-test/tests/self-hosting/makeconstructible-function-inherited-prototype-property.js3
-rw-r--r--js/src/jit-test/tests/self-hosting/method-called-on-incompatible.js9
-rw-r--r--js/src/jit-test/tests/self-hosting/object-define-hazard.js18
-rw-r--r--js/src/jit-test/tests/self-hosting/object-lookup-hazard.js8
-rw-r--r--js/src/jit-test/tests/self-hosting/oom-delazify.js5
-rw-r--r--js/src/jit-test/tests/self-hosting/oom-toplevel.js25
-rw-r--r--js/src/jit-test/tests/self-hosting/relazify.js16
-rw-r--r--js/src/jit-test/tests/self-hosting/tolength.js13
20 files changed, 312 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/self-hosting/GetStringDataProperty.js b/js/src/jit-test/tests/self-hosting/GetStringDataProperty.js
new file mode 100644
index 0000000000..3eb2a9be7e
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/GetStringDataProperty.js
@@ -0,0 +1,23 @@
+// Bug 1267364 - GetStringDataProperty should return undefined when the object
+// is non-native.
+
+var GetStringDataProperty = getSelfHostedValue("GetStringDataProperty");
+
+function testProxy() {
+ var obj = new Proxy({"foo": "10"}, {});
+ var v = GetStringDataProperty(obj, "foo");
+ assertEq(v, undefined);
+}
+
+function testMaybeUnboxed() {
+ // Use JSON.parse to create unboxed object if availbale.
+ var obj = JSON.parse("[" + '{"foo": "10"},'.repeat(100) +"{}]");
+
+ // GetStringDataProperty may return "10" or undefined, depending on whether
+ // `obj` is unboxed or not
+ var v = GetStringDataProperty(obj[0], "foo");
+ assertEq(v == undefined || v == "10", true);
+}
+
+testProxy();
+testMaybeUnboxed();
diff --git a/js/src/jit-test/tests/self-hosting/bug1264575.js b/js/src/jit-test/tests/self-hosting/bug1264575.js
new file mode 100644
index 0000000000..db74ef48c1
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/bug1264575.js
@@ -0,0 +1,7 @@
+function f(x, [y]) {}
+f(0, []);
+// jsfunfuzz-generated
+let i = 0;
+for (var z of [0, 0, 0]) {
+ verifyprebarriers();
+}
diff --git a/js/src/jit-test/tests/self-hosting/bug957004.js b/js/src/jit-test/tests/self-hosting/bug957004.js
new file mode 100644
index 0000000000..ce767a9a4a
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/bug957004.js
@@ -0,0 +1,3 @@
+// No result, just mustn't crash.
+Array.prototype.push(0);
+Array.prototype.indexOf();
diff --git a/js/src/jit-test/tests/self-hosting/define-value-property.js b/js/src/jit-test/tests/self-hosting/define-value-property.js
new file mode 100644
index 0000000000..b5ffebde21
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/define-value-property.js
@@ -0,0 +1,8 @@
+// These tests just mustn't trigger asserts.
+if (!this.hasOwnProperty('Intl'))
+ quit();
+
+Object.prototype.get = 5;
+new Intl.Collator().resolvedOptions();
+
+Intl.DateTimeFormat.supportedLocalesOf('en');
diff --git a/js/src/jit-test/tests/self-hosting/get-backtrace-in-constructing-bound-function.js b/js/src/jit-test/tests/self-hosting/get-backtrace-in-constructing-bound-function.js
new file mode 100644
index 0000000000..10cc1b3217
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/get-backtrace-in-constructing-bound-function.js
@@ -0,0 +1,6 @@
+function t() {
+ getBacktrace({ locals: true });
+}
+var f = t.bind();
+new f();
+f();
diff --git a/js/src/jit-test/tests/self-hosting/get-intrinsic.js b/js/src/jit-test/tests/self-hosting/get-intrinsic.js
new file mode 100644
index 0000000000..8cff55a5cd
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/get-intrinsic.js
@@ -0,0 +1,19 @@
+
+var intrinsic_names = [
+ "IsConstructor", // Implementation in C++
+ "ArrayMap", // Implementation in JS
+ "localeCache", // Self-hosting variable
+];
+
+for (var name of intrinsic_names) {
+ // GetIntrinsic in same global should have consistent values
+ assertEq(getSelfHostedValue(name), getSelfHostedValue(name));
+
+ // Different globals shouldn't reuse intrinsics.
+ for (var newCompartment of [true, false]) {
+ let g = newGlobal({newCompartment});
+ let a = evaluate(`getSelfHostedValue("${name}")`, { global: g })
+ let b = getSelfHostedValue(name);
+ assertEq(a === b, false);
+ }
+}
diff --git a/js/src/jit-test/tests/self-hosting/intl-fallback-original.js b/js/src/jit-test/tests/self-hosting/intl-fallback-original.js
new file mode 100644
index 0000000000..456084d5d6
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/intl-fallback-original.js
@@ -0,0 +1,9 @@
+// |jit-test| skip-if: typeof Intl === 'undefined'; skip-if: getBuildConfiguration()['wasi']
+
+// Clobbering `Symbol` should not impact creation of %Intl%.[[FallbackSymbol]]
+globalThis.Symbol = null;
+
+const IntlFallbackSymbol =
+ Object.getOwnPropertySymbols(
+ Intl.DateTimeFormat.call(
+ Object.create(Intl.DateTimeFormat.prototype)))[0];
diff --git a/js/src/jit-test/tests/self-hosting/invoke-self-hosted-function.js b/js/src/jit-test/tests/self-hosting/invoke-self-hosted-function.js
new file mode 100644
index 0000000000..88893c58bd
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/invoke-self-hosted-function.js
@@ -0,0 +1,9 @@
+var callees = [function a() {}, function b() {}, function c() {}, function d() {}, Array.prototype.forEach];
+
+function f() {
+ for (var i = 0; i < callees.length; ++i) {
+ callees[i](function(){});
+ }
+}
+
+f(); \ No newline at end of file
diff --git a/js/src/jit-test/tests/self-hosting/invoke-self-hosted-with-primitive-this.js b/js/src/jit-test/tests/self-hosting/invoke-self-hosted-with-primitive-this.js
new file mode 100644
index 0000000000..24130e0f01
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/invoke-self-hosted-with-primitive-this.js
@@ -0,0 +1,7 @@
+try {
+ [0,0].sort(Array.some)
+ "".replace(RegExp(), Array.reduce)
+} catch (error) {
+ if (!(error instanceof TypeError && /^\w is not a function$/.test(error.message)))
+ throw error;
+}
diff --git a/js/src/jit-test/tests/self-hosting/is-constructor-inlined.js b/js/src/jit-test/tests/self-hosting/is-constructor-inlined.js
new file mode 100644
index 0000000000..e801a4b58e
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/is-constructor-inlined.js
@@ -0,0 +1,16 @@
+var g = newGlobal();
+var w = g.eval("() => {}");
+var v = g.eval("Array");
+
+function f()
+{
+ try {
+ Reflect.construct(v, {}, w);
+ } catch (e) {
+ assertEq(e instanceof TypeError, true);
+ }
+}
+
+f();
+f();
+f();
diff --git a/js/src/jit-test/tests/self-hosting/is-constructor-on-wrapper.js b/js/src/jit-test/tests/self-hosting/is-constructor-on-wrapper.js
new file mode 100644
index 0000000000..51ece0fe4b
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/is-constructor-on-wrapper.js
@@ -0,0 +1,17 @@
+var g = newGlobal();
+var w = g.eval("() => {}");
+var v = g.eval("Array");
+
+try {
+ Reflect.construct(Array, [], w);
+ assertEq(true, false, "Expected exception above");
+} catch (e) {
+ assertEq(e.constructor, TypeError);
+}
+
+try {
+ Reflect.construct(v, [], w);
+ assertEq(true, false, "Expected exception above");
+} catch (e) {
+ assertEq(e.constructor, TypeError);
+}
diff --git a/js/src/jit-test/tests/self-hosting/is-possibly-wrapped-typed-array.js b/js/src/jit-test/tests/self-hosting/is-possibly-wrapped-typed-array.js
new file mode 100644
index 0000000000..fd2244be21
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/is-possibly-wrapped-typed-array.js
@@ -0,0 +1,91 @@
+var IsPossiblyWrappedTypedArray = getSelfHostedValue("IsPossiblyWrappedTypedArray");
+
+var declareSamples = `
+ var allTypedArraySamples = [
+ { value: new Int8Array(1), expected: true },
+ { value: new Uint8Array(1), expected: true },
+ { value: new Int16Array(1), expected: true },
+ { value: new Uint16Array(1), expected: true },
+ { value: new Int32Array(1), expected: true },
+ { value: new Uint32Array(1), expected: true },
+ { value: new Float32Array(1), expected: true },
+ { value: new Float64Array(1), expected: true },
+ { value: new Uint8ClampedArray(1), expected: true }
+ ];
+
+ var allObjectSamples = [
+ { value: new Array(1), expected: false },
+ { value: {}, expected: false },
+ { value: { length: 1 }, expected: false }
+ ];
+`;
+
+// Create a new global to wrap with cross compartment wrappers.
+var g = newGlobal();
+evaluate(declareSamples)
+g.evaluate(declareSamples);
+
+var assertCode = `function (value, expected) {
+ assertEq(IsPossiblyWrappedTypedArray(value), expected);
+ return inIon();
+}`;
+
+function checkSamples(samples) {
+ // Create the assert function anew every run so as not to share JIT code,
+ // type information, etc.
+ var assert = new Function(`return (${assertCode})`)();
+
+ // Prevent Ion compilation of this function so that we don't freeze the
+ // sample array's type. If we did, IonBuilder's typed-array-length inlining
+ // would always see a Mixed state, preventing IsPossiblyWrappedTypedArray
+ // from being inlined.
+ with ({}) {};
+
+ do {
+ // spinInJit is used to ensure that we at least test all elements in the
+ // sample vector while running a compiled version of the assert
+ // function.
+ var spinInJit = true;
+ for (var i = 0; i < samples.length; i++) {
+ var e = samples[i];
+ if (!e) continue;
+ spinInJit = spinInJit && assert(e.value, e.expected);
+ }
+ } while(!spinInJit);
+}
+
+// Check a mix of samples from each type.
+function test(a, b, c, d) {
+ var samples = [
+ a == -1 ? null : allTypedArraySamples[a],
+ b == -1 ? null : allObjectSamples[b],
+ c == -1 ? null : g.allTypedArraySamples[c],
+ d == -1 ? null : g.allObjectSamples[d],
+ ];
+
+ checkSamples(samples);
+}
+
+// Check all samples.
+checkSamples(allTypedArraySamples);
+checkSamples(allObjectSamples);
+checkSamples(g.allTypedArraySamples);
+checkSamples(g.allObjectSamples);
+
+// Check combinations mixing 2 elements from different types.
+test(-1, -1, 0, 0);
+test(-1, 0, -1, 0);
+test(-1, 0, 0, -1);
+test( 0, -1, -1, 0);
+test( 0, -1, 0, -1);
+test( 0, 0, -1, -1);
+test( 0, 0, -1, 0);
+
+// Check combinations mixing 3 elements from different types.
+test(-1, 0, 0, 0);
+test( 0, -1, 0, 0);
+test( 0, 0, -1, 0);
+test( 0, 0, 0, -1);
+
+// Check combinations mixing 4 elements from different types.
+test( 0, 0, 0, 0);
diff --git a/js/src/jit-test/tests/self-hosting/makeconstructible-function-inherited-prototype-property.js b/js/src/jit-test/tests/self-hosting/makeconstructible-function-inherited-prototype-property.js
new file mode 100644
index 0000000000..ff4d0c000a
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/makeconstructible-function-inherited-prototype-property.js
@@ -0,0 +1,3 @@
+var proxy = new Proxy({ get: function() { throw 42; } }, {});
+Function.prototype.__proto__ = proxy;
+this.hasOwnProperty("Intl");
diff --git a/js/src/jit-test/tests/self-hosting/method-called-on-incompatible.js b/js/src/jit-test/tests/self-hosting/method-called-on-incompatible.js
new file mode 100644
index 0000000000..2a48991f66
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/method-called-on-incompatible.js
@@ -0,0 +1,9 @@
+load(libdir + "asserts.js");
+
+assertTypeErrorMessage(() => Set.prototype.forEach.call({}), "forEach method called on incompatible Object");
+assertTypeErrorMessage(() => newGlobal({newCompartment: true}).Set.prototype.forEach.call({}), "forEach method called on incompatible Object");
+assertTypeErrorMessage(() => Set.prototype.forEach.call(15), "forEach method called on incompatible number");
+
+assertTypeErrorMessage(() => Int8Array.prototype.find.call({}), "find method called on incompatible Object");
+assertTypeErrorMessage(() => newGlobal({newCompartment: true}).Int8Array.prototype.find.call({}), "find method called on incompatible Object");
+assertTypeErrorMessage(() => Int8Array.prototype.find.call(15), "find method called on incompatible number");
diff --git a/js/src/jit-test/tests/self-hosting/object-define-hazard.js b/js/src/jit-test/tests/self-hosting/object-define-hazard.js
new file mode 100644
index 0000000000..7a1ccc2243
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/object-define-hazard.js
@@ -0,0 +1,18 @@
+// We shouldn't do the wrong thing in the face of an evil Object.prototype
+
+Object.prototype.get = function() {};
+var x = {};
+var setter = function () {};
+x.__defineSetter__("a", setter);
+var desc = Object.getOwnPropertyDescriptor(x, "a");
+assertEq(desc.get, undefined);
+assertEq(desc.set, setter);
+delete Object.prototype.get;
+
+Object.prototype.set = function() {};
+x = {};
+var getter = function () {};
+x.__defineGetter__("a", getter);
+desc = Object.getOwnPropertyDescriptor(x, "a");
+assertEq(desc.set, undefined);
+assertEq(desc.get, getter);
diff --git a/js/src/jit-test/tests/self-hosting/object-lookup-hazard.js b/js/src/jit-test/tests/self-hosting/object-lookup-hazard.js
new file mode 100644
index 0000000000..5197a9113d
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/object-lookup-hazard.js
@@ -0,0 +1,8 @@
+// We shouldn't do the wrong thing in the face of an evil Object.prototype
+
+Object.prototype.get = function() {};
+assertEq(({a: 1}).__lookupGetter__("a"), undefined);
+delete Object.prototype.get;
+
+Object.prototype.set = function() {};
+assertEq(({a: 1}).__lookupSetter__("a"), undefined);
diff --git a/js/src/jit-test/tests/self-hosting/oom-delazify.js b/js/src/jit-test/tests/self-hosting/oom-delazify.js
new file mode 100644
index 0000000000..2c9bfc71e9
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/oom-delazify.js
@@ -0,0 +1,5 @@
+// |jit-test| --no-blinterp; skip-if: !('oomTest' in this)
+
+// Disable the JITs to make oomTest more reliable
+
+oomTest(() => Object.bind())
diff --git a/js/src/jit-test/tests/self-hosting/oom-toplevel.js b/js/src/jit-test/tests/self-hosting/oom-toplevel.js
new file mode 100644
index 0000000000..60f2be4e1e
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/oom-toplevel.js
@@ -0,0 +1,25 @@
+// |jit-test| skip-if: !('oomAtAllocation' in this)
+
+function code(n) {
+ return `
+ // Trigger top-level execution with an OOM in the middle.
+ oomAtAllocation(${n});
+ try { getSelfHostedValue("numberFormatCache") } catch (e) { }
+ resetOOMFailure();
+
+ // Read current value of "dateTimeFormatCache".
+ var initVal = getSelfHostedValue("dateTimeFormatCache");
+ assertEq(typeof initVal, "object");
+
+ // Retrigger top-level execution by reading a later value in the file.
+ // Then compare that "dateTimeFormatCache" was not clobbered.
+ getSelfHostedValue("collatorCache");
+ assertEq(initVal, getSelfHostedValue("dateTimeFormatCache"));
+ `;
+}
+
+// We cannot use `oomTest` here because of divergence issues from things like
+// `RegisterShapeCache` absorbing OOMs.
+for (var i = 1; i < 300; ++i) {
+ evaluate(code(i), { global: newGlobal() });
+}
diff --git a/js/src/jit-test/tests/self-hosting/relazify.js b/js/src/jit-test/tests/self-hosting/relazify.js
new file mode 100644
index 0000000000..b335f8026c
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/relazify.js
@@ -0,0 +1,16 @@
+// |jit-test| skip-if: isLcovEnabled()
+
+// Self-hosted builtins use a special form of lazy function, but still can be
+// delazified in some cases.
+
+let obj = [];
+let fun = obj.map;
+assertEq(isLazyFunction(fun), true);
+
+// Delazify
+fun.call(obj, x => x);
+assertEq(isLazyFunction(fun), false);
+
+// Relazify
+relazifyFunctions(obj);
+assertEq(isLazyFunction(fun), true);
diff --git a/js/src/jit-test/tests/self-hosting/tolength.js b/js/src/jit-test/tests/self-hosting/tolength.js
new file mode 100644
index 0000000000..06fda18a72
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/tolength.js
@@ -0,0 +1,13 @@
+let ToLength = getSelfHostedValue('ToLength');
+
+assertEq(ToLength(NaN), 0);
+assertEq(ToLength(-0), 0);
+assertEq(ToLength(0), 0);
+assertEq(ToLength(-Infinity), 0);
+assertEq(ToLength(-Math.pow(2, 31)), 0);
+
+const MAX = Math.pow(2, 53) - 1;
+assertEq(ToLength(Infinity), MAX);
+assertEq(ToLength(MAX + 1), MAX);
+assertEq(ToLength(3), 3);
+assertEq(ToLength(40.5), 40);