[strong] Implement strong mode restrictions on property access

test/mjsunit/strong/load-element.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --strong-mode --allow-natives-syntax
+
+// TODO(conradw): Track implementation of strong bit for other objects, add

[rossberg, 2015/06/10 08:28:08]

Currently, the semantics does not rely on that, does it?

[conradw, 2015/06/10 12:03:23]

Err, this was just a mindless copy and paste mistake.

+// tests.
+
+function getObjects() {

[rossberg, 2015/06/10 08:28:08]

Other interesting cases to add:

- arguments (both strict and sloppy)
- typed arrays
- a non-standard builtin instance (e.g. of Date)
- some builtins (Object, Array, Function)
- primitives (numbers, bools, which should be wrapped implicitly)
- proxies (in a separate test file)

[conradw, 2015/06/10 12:03:23]

Done, the plan right now is to do proxies in a followup, along with the other
"odd" cases mentioned in this CL description.

[rossberg, 2015/06/11 09:36:34]

Can you also add

- a typed array instance
- Object, Array, Function
- and I forogt an important one: the global object

What about strings, btw?

[conradw, 2015/06/11 13:48:31]

Done, strings are handled in the "literals" list of the latest patch.

+  "use strict";
+  return [
+    {},
+    [],
+    (function(){}),
+    (class Foo {})
+  ];
+}
+
+function readFromObjectElementSloppy(o) {
+  return o[0];
+}
+
+function readFromObjectElementSparseSloppy(o) {
+  return o[100000];
+}
+
+function readFromObjectElementNonSmiSloppy(o) {
+  return o[3000000000];
+}
+
+function readFromObjectNonIndexSloppy(o) {
+  return o[5000000000];
+}
+
+function readFromObjectElementVarSloppy(o) {
+  var a = 0;
+  return o[a];
+}
+
+function readFromObjectElementSparseVarSloppy(o) {
+  var a = 100000;
+  return o[a];
+}
+
+function readFromObjectElementNonSmiVarSloppy(o) {
+  var a = 3000000000;
+  return o[a];
+}
+
+function readFromObjectNonIndexVarSloppy(o) {
+  var a = 5000000000;
+  return o[a];
+}
+
+function readFromObjectElementStrong(o) {
+  "use strong";
+  return o[0];
+}
+
+function readFromObjectElementSparseStrong(o) {
+  "use strong";
+  return o[100000];
+}
+
+function readFromObjectElementNonSmiStrong(o) {
+  "use strong";
+  return o[3000000000];
+}
+
+function readFromObjectNonIndexStrong(o) {
+  "use strong";
+  return o[5000000000];
+}
+
+function readFromObjectElementLetStrong(o) {
+  "use strong";
+  let a = 0;
+  return o[a];
+}
+
+function readFromObjectElementSparseLetStrong(o) {
+  "use strong";
+  let a = 100000;
+  return o[a];
+}
+
+function readFromObjectElementNonSmiLetStrong(o) {
+  "use strong";
+  let a = 3000000000;
+  return o[a];
+}
+
+function readFromObjectNonIndexLetStrong(o) {
+  "use strong";
+  let a = 5000000000;
+  return o[a];
+}
+
+function getDescs(x) {
+  return [
+    {value: x},
+    {configurable: true, value: x},
+    {configurable: true, enumerable: true, writable: true, value: x},
+    {configurable: true, enumerable: true, get: (function() {return x}) },
+  ];
+}
+
+function assertStrongSemantics(func, object) {
+  %DeoptimizeFunction(func);
+  %ClearFunctionTypeFeedback(func);
+  assertThrows(function(){func(object)}, TypeError);
+  assertThrows(function(){func(object)}, TypeError);
+  assertThrows(function(){func(object)}, TypeError);
+  %OptimizeFunctionOnNextCall(func);
+  assertThrows(function(){func(object)}, TypeError);
+  %DeoptimizeFunction(func);
+  assertThrows(function(){func(object)}, TypeError);
+}
+
+function assertSloppySemantics(func, object) {
+  %DeoptimizeFunction(func);
+  %ClearFunctionTypeFeedback(func);
+  assertDoesNotThrow(function(){func(object)});
+  assertDoesNotThrow(function(){func(object)});
+  assertDoesNotThrow(function(){func(object)});
+  %OptimizeFunctionOnNextCall(func);
+  assertDoesNotThrow(function(){func(object)});
+  %DeoptimizeFunction(func);
+  assertDoesNotThrow(function(){func(object)});
+}
+
+(function () {
+  "use strict";
+
+  let goodKeys = [
+    "0",
+    "100000",
+    "3000000000",
+    "5000000000"
+  ]
+
+  let badKeys = [
+    "bar",
+    "1",
+    "100001",
+    "3000000001",
+    "5000000001"
+  ];
+
+  let values = [
+    "string",
+    1,
+    100001,
+    30000000001,
+    50000000001,
+    NaN,
+    {},
+    undefined
+  ];
+
+  let badAccessorDescs = [
+    { set: (function(){}) },
+    { configurable: true, set: (function(){}) },
+    { configurable: true, enumerable: true, set: (function(){}) }
+  ];
+
+  let readSloppy = [
+    readFromObjectElementSloppy,
+    readFromObjectElementSparseSloppy,
+    readFromObjectElementNonSmiSloppy,
+    readFromObjectNonIndexSloppy,
+    readFromObjectElementVarSloppy,
+    readFromObjectElementSparseVarSloppy,
+    readFromObjectElementNonSmiVarSloppy,
+    readFromObjectNonIndexVarSloppy
+  ];
+
+  let readStrong = [
+    readFromObjectElementStrong,
+    readFromObjectElementSparseStrong,
+    readFromObjectElementNonSmiStrong,
+    readFromObjectNonIndexStrong,
+    readFromObjectElementLetStrong,
+    readFromObjectElementSparseLetStrong,
+    readFromObjectElementNonSmiLetStrong,
+    readFromObjectNonIndexLetStrong
+  ];
+
+  let dummyProto = {};
+  for (let key of goodKeys) {
+    Object.defineProperty(dummyProto, key, { value: undefined });
+  }
+
+  let dummyAccessorProto = {};
+  for (let key of goodKeys) {
+    Object.defineProperty(dummyAccessorProto, key, { set: (function(){}) })
+  }
+
+  // Attempting to access a property on an objects with no defined properties

[rossberg, 2015/06/10 08:28:08]

Nit: typo

[conradw, 2015/06/10 12:03:23]

Done.

+  // should throw.
+  for (let object of getObjects()) {
+    for (let func of readStrong) {
+      assertStrongSemantics(func, object);
+    }
+    for (let func of readSloppy) {
+      assertSloppySemantics(func, object);
+    }
+    // Accessing a property which is on the prototype chain of the object should
+    // not throw.
+    object.__proto__ = dummyProto;
+    for (let key of goodKeys) {
+      for (let func of readStrong.concat(readSloppy)) {
+        assertSloppySemantics(func, object);
+      }
+    }
+  }
+  // Properties with accessor descriptors missing 'get' should throw on access.
+  for (let desc of badAccessorDescs) {
+    for (let key of goodKeys) {
+      for (let object of getObjects()) {
+        Object.defineProperty(object, key, desc);
+        for (let func of readStrong) {
+          assertStrongSemantics(func, object);
+        }
+        for (let func of readSloppy) {
+          assertSloppySemantics(func, object);
+        }
+      }
+    }
+  }
+  // The same behaviour should be expected for bad accessor properties on the
+  // prototype chain.
+  for (let object of getObjects()) {
+    object.__proto__ = dummyAccessorProto;
+    for (let func of readStrong) {
+      assertStrongSemantics(func, object);
+    }
+    for (let func of readSloppy) {
+      assertSloppySemantics(func, object);
+    }
+  }
+})();