1/* 2 * Copyright (c) 2023 Huawei Device Co., Ltd. 3 * Licensed under the Apache License, Version 2.0 (the "License"); 4 * you may not use this file except in compliance with the License. 5 * You may obtain a copy of the License at 6 * 7 * http://www.apache.org/licenses/LICENSE-2.0 8 * 9 * Unless required by applicable law or agreed to in writing, software 10 * distributed under the License is distributed on an "AS IS" BASIS, 11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 * See the License for the specific language governing permissions and 13 * limitations under the License. 14 */ 15//mjsunit/regress/regress-3135.js 16// Properties are serialized once. 17print(JSON.stringify({ x : 1 }, ["x", 1, "x", 1])); 18print(JSON.stringify({ 1 : 1 }, ["x", 1, "x", 1])); 19print(JSON.stringify({ 1 : 1 }, ["1", 1, "1", 1])); 20print(JSON.stringify({ 1 : 1 }, [1, "1", 1, "1"])); 21// Properties are visited at most once. 22var fired = 0; 23var getter_obj = { get x() { fired++; return 2; } }; 24print(JSON.stringify(getter_obj, ["x", "y", "x"])); 25print(1 == fired); 26// Order of the replacer array is followed. 27print(JSON.stringify({ x : 3, y : 4}, ["y", "x"])); 28print(JSON.stringify({ x : 3, y : 4, 1 : 2 }, ["y", 1, "x"])); 29// With a replacer array the value of the property is retrieved using [[Get]] 30// ignoring own and enumerability. 31var a = { x : 8 }; 32print(JSON.stringify(a, ["__proto__", "x", "__proto__"])); 33a.__proto__ = { x : 7 }; 34print(JSON.stringify(a, ["__proto__", "x"])); 35var b = { __proto__: { x: 9 } }; 36print(JSON.stringify(b)); 37print(JSON.stringify(b, ["x"])); 38var c = {x: 10}; 39Object.defineProperty(c, 'x', { enumerable: false }); 40print(JSON.stringify(c)); 41print(JSON.stringify(c, ["x"])); 42// Arrays are not affected by the replacer array. 43print(JSON.stringify([9, 8, 7], [1, 1])); 44var mixed_arr = [11,12,13]; 45mixed_arr.x = 10; 46print(JSON.stringify(mixed_arr, [1, 0, 1])); 47// Array elements of objects are affected. 48var mixed_obj = { x : 3 }; 49mixed_obj[0] = 6; 50mixed_obj[1] = 5; 51print(JSON.stringify(mixed_obj, [1, 0, 1])); 52// Nested object. 53print(JSON.stringify({ x: 1, y:2, z: {x:3, b:4}}, ["z","x"])); 54// Objects in the replacer array are ignored. 55print(JSON.stringify({ x : 1, "1": 1 }, [{}])); 56print(JSON.stringify({ x : 1, "1": 1 }, [true, undefined, null])); 57print(JSON.stringify({ x : 1, "1": 1 }, [{ toString: function() { return "x";} }])); 58print(JSON.stringify({ x : 1, "1": 1 }, [{ valueOf: function() { return 1;} }])); 59// Make sure that property names that clash with the names of Object.prototype 60// still works. 61print(JSON.stringify({ toString: 42 }, ["toString"])); 62// Number wrappers and String wrappers should be unwrapped. 63print(JSON.stringify({ 1: 1, s: "s" },[new Number(1), new String("s")])); 64// bigint/regress-minuszero.js 65print(BigInt("-0 ") == -0); 66print("-0 " == 0n); 67print(BigInt("-0") == -0); 68print(-0n == -0); 69print(-0n == 0n); 70 71print(BigInt("-0 ") > -1); 72print("-0 " > -1n); 73print(BigInt("-0") > -1); 74print(-0n > -1); 75 76print(BigInt("-0 ") & 1n); 77print(BigInt("-0") & 1n); 78print(-0n & 1n); 79var zero = BigInt("-0 "); 80print(++zero == 1n); 81zero = BigInt("-0"); 82print(++zero == 1n); 83zero = -0n; 84print(++zero == 1n); 85// mjsunit/regress/regress-5974.js 86(function() { 87 var a = Array(...Array(5)).map(() => 1); 88 print(a); 89})(); 90//mjsunit/regress/regress-416.js 91print(isNaN(new Date(1e81).getTime())); 92print(isNaN(new Date(1e81).getTime())); 93print(isNaN(new Date(-1e81).getTime())); 94print(isNaN(new Date(1e81, "").getTime())); 95print(isNaN(new Date(-1e81, "").getTime())); 96print(isNaN(new Date(Number.NaN).getTime())); 97print(isNaN(new Date(Number.NaN, "").getTime())); 98 99function assertArrayEquals(expected, found) { 100 if (expected.length != found.length) { 101 return false 102 } else{ 103 for (var i = 0; i < expected.length; ++i) { 104 if (expected[i] != found[i]) { 105 return false 106 } 107 } 108 return true 109 } 110}; 111 112// regress/regress-crbug-658691.js 113function f(a, b, c) { 114 "use strict"; 115 return Reflect.set({}); 116 } 117 118 // The {g} function is compiled using Ignition. 119 // 1) The call to {f} requires arguments adaptation. 120 // 2) The call to {f} is not in tail position. 121 ; 122 ArkTools.prepareFunctionForOptimization(f); 123 function g() { 124 return f() + '-no-tail'; 125 } 126 127 print(g()); 128 ArkTools.optimizeFunctionOnNextCall(f); 129 // regress/regress-4654.js 130 print(g()); 131 print('hello\u0000foobar' == 'hello\u0000foobar'.normalize('NFC')); 132 133// regress/regress-6223.js 134var ab = new Int8Array(20).map((v, i) => i).buffer; 135var ta = new Int8Array(ab, 0, 10); 136var seen_length = -1; 137ta.constructor = { 138 [Symbol.species]: function(len) { 139 seen_length = len; 140 return new Int8Array(ab, 1, len); 141 } 142}; 143 144print(-1 == seen_length); 145print(assertArrayEquals([0,1,2,3,4,5,6,7,8,9], ta)); 146var tb = ta.slice(); 147print(10 == seen_length); 148print(assertArrayEquals([0,0,0,0,0,0,0,0,0,0], ta)); 149print(assertArrayEquals([0,0,0,0,0,0,0,0,0,0], tb)); 150// regress/regress-crbug-1404820.js 151(function array_iterator() { 152 let array_iterator_prototype = [].values().__proto__; 153 let iter; 154 array_iterator_prototype.return = function(value) { 155 iter = this; 156 return {value: value, done: true}; 157 }; 158 159 let array = [["good1"], ["good2"], "bad", "next", 5, 6, 7, 8]; 160 161 // Aborted iteration in a builtin. 162 try { 163 new WeakSet(array); 164 } catch (e) {} 165 // iter points at "bad" item, so next() must return "next" value. 166 print(iter.next().value == "next"); 167 })(); 168 169// mjsunit/regress/regress-857.js 170print(1283326536000 == Date.parse("2010-08-31T22:35:36-09:00")); 171print(1283261736000 == Date.parse("2010-08-31T22:35:36+09:00")); 172print(1283326536000 == Date.parse("2010-08-31T22:35:36.0-09:00")); 173print(1283261736000 == Date.parse("2010-08-31T22:35:36.0+09:00")); 174// colon-less time expressions in time zone offsets are not conformant 175// with ES5 15.9.1.15 but are nonetheless supported in V8 176print(1283326536000 == Date.parse("2010-08-31T22:35:36-0900")); 177print(1283261736000 == Date.parse("2010-08-31T22:35:36+0900")); 178 179//mjsunit/compiler/regress-5538.js 180(function() { 181 function foo(x) { 182 x = x | 0; 183 return Number.parseInt(x + 1); 184 } 185 186 ArkTools.prepareFunctionForOptimization(foo); 187 print(1 == foo(0)); 188 print(2 == foo(1)); 189 ArkTools.optimizeFunctionOnNextCall(foo); 190 print(Math.pow(2, 31) == foo(Math.pow(2, 31) - 1)); 191 })(); 192 193 (function() { 194 function foo(x) { 195 x = x | 0; 196 return Number.parseInt(x + 1, 0); 197 } 198 199 ArkTools.prepareFunctionForOptimization(foo); 200 print(1 == foo(0)); 201 print(2 == foo(1)); 202 ArkTools.optimizeFunctionOnNextCall(foo); 203 print(Math.pow(2, 31) == foo(Math.pow(2, 31) - 1)); 204 })(); 205 206 (function() { 207 function foo(x) { 208 x = x | 0; 209 return Number.parseInt(x + 1, 10); 210 } 211 212 ArkTools.prepareFunctionForOptimization(foo); 213 print(1 == foo(0)); 214 print(2 == foo(1)); 215 ArkTools.optimizeFunctionOnNextCall(foo); 216 print(Math.pow(2, 31) == foo(Math.pow(2, 31) - 1)); 217 })(); 218 219 (function() { 220 function foo(x) { 221 x = x | 0; 222 return Number.parseInt(x + 1, undefined); 223 } 224 ArkTools.prepareFunctionForOptimization(foo); 225 print(1 == foo(0)); 226 print(2 == foo(1)); 227 ArkTools.optimizeFunctionOnNextCall(foo); 228 print(Math.pow(2, 31) == foo(Math.pow(2, 31) - 1)); 229 })(); 230 231 // mjsunit/regress/regress-12256.js 232 const datesList = [{ year: '2021', month: '10', day: '22', hour: '10', minute: '12', second: '32' }, 233 { year: '2021', month: '8', day: '3', hour: '9', minute: '9', second: '6' }]; 234 const { year, month, day, hour, minute, second } = datesList[0]; 235 const s0 = `${year}-${month}-${day} ${hour}:${minute}:${second}Z`; 236 for (let i = 1; i < 10; i++) { 237 const s1 = `${'0'.repeat(i) + year}-${month}-${day} ${hour}:${minute}:${second}Z`; 238 print(new Date(s0).getTime() == new Date(s1).getTime()); 239 } 240 241 // mjsunit/regress/regress-crbug-1262007.js 242 function foo(...args) { 243 class C {} 244 C(...args); 245 } 246 Object.getPrototypeOf([])[Symbol.iterator] = () => {}; 247 ArkTools.prepareFunctionForOptimization(foo); 248 try { 249 foo() 250 } catch(e) { 251 print(e instanceof TypeError) 252 } 253 254// PoC 255let buffer = new ArrayBuffer(4); 256let int32View = new Int32Array(buffer); 257int32View[0] = -1; 258let floatView = new Float32Array(buffer); 259function func0() { 260 let tmp = floatView[0]; 261 if (tmp) { } 262} 263for (let i = 0; i < 100; ++i) { 264 func0(); 265} 266print("test success"); 267 268// PoC 269var arr = [1, 2] 270var obj = Object.create(arr); 271Reflect.set(obj, "length", 1062630713); 272Reflect.set(obj, "length", 1062630713, obj); 273print("test success"); 274 275// PoC 276var v0 = this; 277Reflect.defineProperty(v0, 'ok1', { 278 set: function (v15) { } 279}); 280function func1() { 281 v0.ok1 = 'Hello' 282} 283for (var v1 = 0; v1 < 1e3; ++v1) { 284 func1(); 285} 286Reflect.defineProperty(v0, 'ok1', { 287 set: function (v15) { } 288}); 289print("test success"); 290 291// mjsunit/regress/regress-121407.js 292var a = [0, 1, 2, 3]; 293a[2000000] = 2000000; 294a.length = 2000; 295for (var i = 0; i <= 256; i++) { 296 a[i] = new Object(); 297} 298 299a = [0.5, 1.5, 2.5, 3.5, 4.5, 5.5]; 300a[2000000] = 2000000; 301a.length = 2000; 302for (var i = 0; i <= 256; i++) { 303 a[i] = new Object(); 304} 305print("test success");