Fix materialization of captured objects with field tracking.

test/mjsunit/compiler/escape-analysis-representation.js

Index: test/mjsunit/compiler/escape-analysis-representation.js
diff --git a/test/intl/date-format/property-override.js b/test/mjsunit/compiler/escape-analysis-representation.js
similarity index 56%
copy from test/intl/date-format/property-override.js
copy to test/mjsunit/compiler/escape-analysis-representation.js
index a2bc2d9a30030d2e80065ad7d686cb3311eb0eaa..8e21a36b40920a9f23d12102562e722223d769f2 100644
--- a/test/intl/date-format/property-override.js
+++ b/test/mjsunit/compiler/escape-analysis-representation.js
@@ -25,46 +25,49 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Checks for security holes introduced by Object.property overrides.
-// For example:
-// Object.defineProperty(Array.prototype, 'locale', {
-//   set: function(value) {
-//     throw new Error('blah');
-//   },
-//   configurable: true,
-//   enumerable: false
-// });
-//
-// would throw in case of (JS) x.locale = 'us' or (C++) x->Set('locale', 'us').
-//
-// Update both date-format.js and date-format.cc so they have the same list of
-// properties.
+// Flags: --allow-natives-syntax --use-escape-analysis --max-opt-count=100
 
-// First get supported properties.
-// Some of the properties are optional, so we request them.
-var properties = [];
-var options = Intl.DateTimeFormat(
-  'en-US', {weekday: 'short', era: 'short', year: 'numeric', month: 'short',
-            day: 'numeric', hour: 'numeric', minute: 'numeric',
-            second: 'numeric', timeZoneName: 'short'}).resolvedOptions();
-for (var prop in options) {
-  if (options.hasOwnProperty(prop)) {
-    properties.push(prop);
-  }
+// This tests that captured objects materialized through the deoptimizer
+// have field descriptors with a representation matching the values that
+// have actually been stored in the object.
+
+var values = [ function() { return {}; },
+               function() { return 23; },
+               function() { return 4.2; } ];
+
+function constructor(value_track) {
+  this.x = value_track();
 }
 
-var expectedProperties = [
-  'calendar', 'day', 'era', 'hour12', 'hour', 'locale',
-  'minute', 'month', 'numberingSystem',
-  'second', 'timeZone', 'timeZoneName', 'weekday', 'year'
-];
+function access(value_track, value_break, deopt) {
+  var o = new constructor(value_track);
+  o.x = value_break;
+  deopt.deopt
+  assertEquals(value_break, o.x);
+}
 
-assertEquals(expectedProperties.length, properties.length);
+function test(value_track, value_break) {
+  var deopt = { deopt:false };
 
-properties.forEach(function(prop) {
-  assertFalse(expectedProperties.indexOf(prop) === -1);
-});
+  // Warm-up field tracking to a certain representation.
+  access(value_track, value_track(), deopt);
+  access(value_track, value_track(), deopt);
+  %OptimizeFunctionOnNextCall(access);
+  access(value_track, value_track(), deopt);
 
-taintProperties(properties);
+  // Deoptimize on a run with a different representation.
+  delete deopt.deopt;
+  access(value_track, value_break(), deopt);
 
-var locale = Intl.DateTimeFormat().resolvedOptions().locale;
+  // Clear type feedback of the access function for next run.
+  %ClearFunctionTypeFeedback(access);
+
+  // Also make sure the initial map of the constructor is reset.
+  constructor.prototype = {};
+}
+
+for (var i = 0; i < values.length; i++) {
+  for (var j = 0; j < values.length; j++) {
+    test(values[i], values[j])
+  }
+}