Version 3.5.5.

test/mjsunit/external-array.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 172 matching lines @@
   %OptimizeFunctionOnNextCall(test_func);
   var sum = 0;
   for (var i = 0; i < kRuns; i++) {
     sum = test_func(array, sum);
   }
   assertEquals(expected_result, sum);
   %DeoptimizeFunction(test_func);
   gc();  // Makes V8 forget about type information for test_func.
 }
 
+function run_bounds_test(test_func, array, expected_result) {
+  assertEquals(undefined, a[kElementCount]);
+  a[kElementCount] = 456;
+  assertEquals(undefined, a[kElementCount]);
+  assertEquals(undefined, a[kElementCount+1]);
+  a[kElementCount+1] = 456;
+  assertEquals(undefined, a[kElementCount+1]);
+}
+
 for (var t = 0; t < types.length; t++) {
   var type = types[t];
   var a = new type(kElementCount);
+
   for (var i = 0; i < kElementCount; i++) {
     a[i] = i;
   }
 
   // Run test functions defined above.
   run_test(test_load, a, 780 * kRuns);
   run_test(test_load_const_key, a, 3 * kRuns);
   run_test(test_store, a, 820 * kRuns);
   run_test(test_store_const_key, a, 6 * kRuns);
   run_test(test_store_low_int, a, test_result_low_int[t]);
   run_test(test_store_low_double, a, test_result_low_double[t]);
   run_test(test_store_low_tagged, a, test_result_low_double[t]);
   run_test(test_store_high_int, a, test_result_high_int[t]);
   run_test(test_store_nan, a, test_result_nan[t]);
   run_test(test_store_middle_double, a, test_result_middle[t]);
   run_test(test_store_middle_tagged, a, test_result_middle[t]);
   run_test(test_store_high_double, a, test_result_high_double[t]);
   run_test(test_store_high_tagged, a, test_result_high_double[t]);
 
   // Test the correct behavior of the |length| property (which is read-only).
   if (t != 0) {
     assertEquals(kElementCount, a.length);
     a.length = 2;
     assertEquals(kElementCount, a.length);
     assertTrue(delete a.length);
     a.length = 2;
     assertEquals(2, a.length);
+
+    // Make sure bounds checks are handled correctly for external arrays.
+    run_bounds_test(a);
+    run_bounds_test(a);
+    run_bounds_test(a);
+    %OptimizeFunctionOnNextCall(run_bounds_test);
+    run_bounds_test(a);
+    %DeoptimizeFunction(run_bounds_test);
+    gc();  // Makes V8 forget about type information for test_func.
+
   }
 
   function array_load_set_smi_check(a) {
     return a[0] = a[0] = 1;
   }
 
   array_load_set_smi_check(a);
   array_load_set_smi_check(0);
 
   function array_load_set_smi_check2(a) {
     return a[0] = a[0] = 1;
   }
 
   array_load_set_smi_check2(a);
   %OptimizeFunctionOnNextCall(array_load_set_smi_check2);
   array_load_set_smi_check2(a);
   array_load_set_smi_check2(0);
   %DeoptimizeFunction(array_load_set_smi_check2);
   gc();  // Makes V8 forget about type information for array_load_set_smi_check.
 }