Index: test/mjsunit/setters-on-elements.js |
diff --git a/test/mjsunit/setters-on-elements.js b/test/mjsunit/setters-on-elements.js |
new file mode 100644 |
index 0000000000000000000000000000000000000000..641b8b78dbea7ebf96631d3ff866627e87fa2d48 |
--- /dev/null |
+++ b/test/mjsunit/setters-on-elements.js |
@@ -0,0 +1,175 @@ |
+// Copyright 2011 the V8 project authors. All rights reserved. |
+// Redistribution and use in source and binary forms, with or without |
+// modification, are permitted provided that the following conditions are |
+// met: |
+// |
+// * Redistributions of source code must retain the above copyright |
+// notice, this list of conditions and the following disclaimer. |
+// * Redistributions in binary form must reproduce the above |
+// copyright notice, this list of conditions and the following |
+// disclaimer in the documentation and/or other materials provided |
+// with the distribution. |
+// * Neither the name of Google Inc. nor the names of its |
+// contributors may be used to endorse or promote products derived |
+// from this software without specific prior written permission. |
+// |
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
+ |
+// Flags: --allow-natives-syntax |
+ |
+// It's nice to run this in Firefox too. |
+var standalone = false; |
+if (standalone) { |
+ assertTrue = function(val) { |
+ if (val != true) { |
+ print("FAILURE"); |
+ } |
+ } |
+ |
+ assertFalse = function(val) { |
+ if (val != false) { |
+ print("FAILURE"); |
+ } |
+ } |
+ |
+ optimize = function(name) { } |
+} else { |
+ optimize = function(name) { |
+ %OptimizeFunctionOnNextCall(name); |
+ } |
+} |
+ |
+var calls = 0; |
+ |
+// Verify that we can't "sneak in" an element setter by modifying the prototype |
+// chain. |
+(function() { |
+ function run(array) { |
+ var runlength = 10; |
+ calls = 0; |
+ for (var i = 0; i < runlength; ++i) { |
+ array[0] = 3; |
+ } |
+ return calls == runlength; |
+ } |
+ |
+ var a_prototype = []; |
+ a_prototype.__defineSetter__(0, function(val) { |
+ calls++; |
+ }); |
+ |
+ // No callback installed. Drive the setter to monomorphic. |
+ var a = [, 3]; |
+ assertFalse(run(a)); |
+ run(a); |
+ run(a); |
+ delete a[0]; |
+ a.__proto__ = a_prototype; |
+ // Altering the prototype chain causes a miss and then we go generic. |
+ assertTrue(run(a)); |
+ assertTrue(run(a)); |
+ |
+ |
+ // Now throw away the IC information by defining a throw-away setter. And try |
+ // to crankshaft before we discover we shouldn't be monomorphic. |
+ a = []; |
+ a.__defineSetter__(0, function() { }); |
+ |
+ a = [,3]; |
+ run(a); |
+ run(a); |
+ run(a); // keyed store IC is monomorphic |
+ optimize(run); |
+ run(a); |
+ delete a[0]; |
+ a.__proto__ = a_prototype; |
+ assertTrue(run(a)); |
+ assertTrue(run(a)); |
+})(); |
+ |
+ |
+Array.prototype.__defineSetter__(0, function(val) { |
+ calls++; |
+}); |
+ |
+ |
+(function() { |
+ function run(array, index, value) { |
+ var runlength = 10; |
+ calls = 0; |
+ for (var i = 0; i < runlength; ++i) { |
+ array[index] = value; |
+ } |
+ return calls == runlength; |
+ } |
+ |
+ // Try "warming up" the ic into a monomorphic state to see if we can trick it |
+ // into ignoring the callback. The object map doesn't have the setter callback. |
+ run({}, 0, true); |
+ run({}, 0, true); |
+ run({}, 0, true); |
+ |
+ // Make sure the setter is called if the element is not defined, |
+ // but is not called if the element is defined. |
+ var typeArray = [1,2.5,true]; |
+ for (var types = 0; types < 3; types++) { |
+ value = typeArray[types]; |
+ for (var i = 0; i < 2; i++) { |
+ assertTrue(run([], 0, value)); // undefined |
+ assertFalse(run([0], 0, value)); // defined. |
+ assertTrue(run([,3], 0, value)); // undefined |
+ assertTrue(run(new Array(10), 0, value)); // undefined |
+ // "sneak" an element in with shift. |
+ o = []; o[1] = 0; o.shift(1); |
+ assertFalse(run(o, 0, value)); |
+ optimize(run); |
+ run([], 0, value); |
+ } |
+ } |
+ |
+ // Make sure we can turn it off. |
+ delete Array.prototype[0]; |
+ assertFalse(run([], 0, true)); |
+})(); |
+ |
+Object.prototype.__defineSetter__(0, function(val) { |
+ calls++; |
+}); |
+ |
+(function() { |
+ function run(obj) { |
+ var runlength = 10; |
+ calls = 0; |
+ for (var i = 0; i < runlength; ++i) { |
+ obj[0] = true; |
+ } |
+ return calls == runlength; |
+ } |
+ |
+ for (var i = 0; i < 2; i++) { |
+ assertTrue(run({})); |
+ o = { foo: 3 }; |
+ assertTrue(run(o)); |
+ o = {}; o[1] = 3; |
+ assertTrue(run(o)); |
+ o = { 0: 0 }; |
+ assertFalse(run(o)); |
+ delete o[0]; |
+ assertTrue(run(o)); |
+ optimize(run); |
+ run([]); |
+ } |
+ |
+ delete Object.prototype[0]; |
+ assertFalse(run({})); |
+})(); |