Commit c7ea07b2 authored by André Bargull's avatar André Bargull
Browse files

Bug 1660599: Only StoreDenseElementHole with handleAdd=true guarantees...

Bug 1660599: Only StoreDenseElementHole with handleAdd=true guarantees writable array length. r=jandem, a=RyanVM

We can only assert that the array length is writable for the
`handleTrue = true` case. This also requires to reintroduce the writable array
length check to the Ion IC code.

Added tests to cover multiple scenarios where the StoreDenseElementHole IC is
used.

Differential Revision: https://phabricator.services.mozilla.com/D88031
parent 200de7f4
// Add dense elements to packed and non-packed arrays. Cover both mono- and
// polymorphic call sites. Change array to non-extensible during execution.
function testAddDenseEmpty() {
var array = [];
function store(ar, index) {
ar[index] = index;
}
for (var i = 0; i < 10; ++i) {
if (i === 5) {
Object.preventExtensions(array);
}
store(array, i);
}
assertEq(array.length, 5);
for (var i = 0; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDenseEmpty();
function testAddDensePacked() {
var array = [0, 1];
function store(ar, index) {
ar[index] = index;
}
for (var i = 2; i < 10; ++i) {
if (i === 5) {
Object.preventExtensions(array);
}
store(array, i);
}
assertEq(array.length, 5);
for (var i = 0; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDensePacked();
function testAddDenseNonPacked() {
var array = [/* hole */, 1];
function store(ar, index) {
ar[index] = index;
}
for (var i = 2; i < 10; ++i) {
if (i === 5) {
Object.preventExtensions(array);
}
store(array, i);
}
assertEq(array.length, 5);
assertEq(0 in array, false);
for (var i = 1; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDenseNonPacked();
function testAddDenseEmptyPoly() {
var array = [];
function store(ar, index) {
ar[index] = index;
}
var objects = [array, {}];
for (var i = 0; i < 10; ++i) {
if (i === 5) {
Object.preventExtensions(array);
}
for (var j = 0; j < objects.length; ++j) {
store(objects[j], i);
}
}
assertEq(array.length, 5);
for (var i = 0; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDenseEmptyPoly();
function testAddDensePackedPoly() {
var array = [0, 1];
function store(ar, index) {
ar[index] = index;
}
var objects = [array, {}];
for (var i = 2; i < 10; ++i) {
if (i === 5) {
Object.preventExtensions(array);
}
for (var j = 0; j < objects.length; ++j) {
store(objects[j], i);
}
}
assertEq(array.length, 5);
for (var i = 0; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDensePackedPoly();
function testAddDenseNonPackedPoly() {
var array = [/* hole */, 1];
function store(ar, index) {
ar[index] = index;
}
var objects = [array, {}];
for (var i = 2; i < 10; ++i) {
if (i === 5) {
Object.preventExtensions(array);
}
for (var j = 0; j < objects.length; ++j) {
store(objects[j], i);
}
}
assertEq(array.length, 5);
assertEq(0 in array, false);
for (var i = 1; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDenseNonPackedPoly();
// Add dense elements to packed and non-packed arrays. Cover both mono- and
// polymorphic call sites. Change array length to non-writable during execution.
function testAddDenseEmpty() {
var array = [];
function store(ar, index) {
ar[index] = index;
}
for (var i = 0; i < 10; ++i) {
if (i === 5) {
Object.defineProperty(array, "length", {writable: false});
}
store(array, i);
}
assertEq(array.length, 5);
for (var i = 0; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDenseEmpty();
function testAddDensePacked() {
var array = [0, 1];
function store(ar, index) {
ar[index] = index;
}
for (var i = 2; i < 10; ++i) {
if (i === 5) {
Object.defineProperty(array, "length", {writable: false});
}
store(array, i);
}
assertEq(array.length, 5);
for (var i = 0; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDensePacked();
function testAddDenseNonPacked() {
var array = [/* hole */, 1];
function store(ar, index) {
ar[index] = index;
}
for (var i = 2; i < 10; ++i) {
if (i === 5) {
Object.defineProperty(array, "length", {writable: false});
}
store(array, i);
}
assertEq(array.length, 5);
assertEq(0 in array, false);
for (var i = 1; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDenseNonPacked();
function testAddDenseEmptyPoly() {
var array = [];
function store(ar, index) {
ar[index] = index;
}
var objects = [array, {}];
for (var i = 0; i < 10; ++i) {
if (i === 5) {
Object.defineProperty(array, "length", {writable: false});
}
for (var j = 0; j < objects.length; ++j) {
store(objects[j], i);
}
}
assertEq(array.length, 5);
for (var i = 0; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDenseEmptyPoly();
function testAddDensePackedPoly() {
var array = [0, 1];
function store(ar, index) {
ar[index] = index;
}
var objects = [array, {}];
for (var i = 2; i < 10; ++i) {
if (i === 5) {
Object.defineProperty(array, "length", {writable: false});
}
for (var j = 0; j < objects.length; ++j) {
store(objects[j], i);
}
}
assertEq(array.length, 5);
for (var i = 0; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDensePackedPoly();
function testAddDenseNonPackedPoly() {
var array = [/* hole */, 1];
function store(ar, index) {
ar[index] = index;
}
var objects = [array, {}];
for (var i = 2; i < 10; ++i) {
if (i === 5) {
Object.defineProperty(array, "length", {writable: false});
}
for (var j = 0; j < objects.length; ++j) {
store(objects[j], i);
}
}
assertEq(array.length, 5);
assertEq(0 in array, false);
for (var i = 1; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testAddDenseNonPackedPoly();
// Add dense elements to packed and non-packed arrays. Cover both mono- and
// polymorphic call sites.
function testAddDenseEmpty() {
var array = [];
function store(ar, index) {
ar[index] = index;
}
for (var i = 0; i < 10; ++i) {
store(array, i);
}
assertEq(array.length, 10);
for (var i = 0; i < 10; ++i) {
assertEq(array[i], i);
}
}
testAddDenseEmpty();
function testAddDensePacked() {
var array = [0, 1];
function store(ar, index) {
ar[index] = index;
}
for (var i = 2; i < 10; ++i) {
store(array, i);
}
assertEq(array.length, 10);
for (var i = 0; i < 10; ++i) {
assertEq(array[i], i);
}
}
testAddDensePacked();
function testAddDenseNonPacked() {
var array = [/* hole */, 1];
function store(ar, index) {
ar[index] = index;
}
for (var i = 2; i < 10; ++i) {
store(array, i);
}
assertEq(array.length, 10);
assertEq(0 in array, false);
for (var i = 1; i < 10; ++i) {
assertEq(array[i], i);
}
}
testAddDenseNonPacked();
function testAddDenseEmptyPoly() {
var array = [];
function store(ar, index) {
ar[index] = index;
}
var objects = [array, {}];
for (var i = 0; i < 10; ++i) {
for (var j = 0; j < objects.length; ++j) {
store(objects[j], i);
}
}
assertEq(array.length, 10);
for (var i = 0; i < 10; ++i) {
assertEq(array[i], i);
}
}
testAddDenseEmptyPoly();
function testAddDensePackedPoly() {
var array = [0, 1];
function store(ar, index) {
ar[index] = index;
}
var objects = [array, {}];
for (var i = 2; i < 10; ++i) {
for (var j = 0; j < objects.length; ++j) {
store(objects[j], i);
}
}
assertEq(array.length, 10);
for (var i = 0; i < 10; ++i) {
assertEq(array[i], i);
}
}
testAddDensePackedPoly();
function testAddDenseNonPackedPoly() {
var array = [/* hole */, 1];
function store(ar, index) {
ar[index] = index;
}
var objects = [array, {}];
for (var i = 2; i < 10; ++i) {
for (var j = 0; j < objects.length; ++j) {
store(objects[j], i);
}
}
assertEq(array.length, 10);
assertEq(0 in array, false);
for (var i = 1; i < 10; ++i) {
assertEq(array[i], i);
}
}
testAddDenseNonPackedPoly();
// Store an element into a previous hole value and later add more elements
// exceeding the initialised length. Cover both mono- and polymorphic call
// sites. Change array length to non-extensible during execution.
function testStoreDenseHole() {
var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
function store(ar, index) {
ar[index] = index;
}
for (var i = 0; i < 10; ++i) {
if (i === 5) {
Object.preventExtensions(array);
}
store(array, i);
}
assertEq(array.length, 5);
for (var i = 0; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testStoreDenseHole();
function testStoreDenseHolePoly() {
var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
function store(ar, index) {
ar[index] = index;
}
var objects = [array, {}];
for (var i = 0; i < 10; ++i) {
if (i === 5) {
Object.preventExtensions(array);
}
for (var j = 0; j < objects.length; ++j) {
store(objects[j], i);
}
}
assertEq(array.length, 5);
for (var i = 0; i < 5; ++i) {
assertEq(array[i], i);
}
for (var i = 5; i < 10; ++i) {
assertEq(i in array, false);
}
}
testStoreDenseHolePoly();
// Store an element into a previous hole value and later add more elements
// exceeding the initialised length. Cover both mono- and polymorphic call
// sites. The array has a non-writable length at the start.
function testStoreDenseHole() {
var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
Object.defineProperty(array, "length", {
writable: false
});
function store(ar, index) {
ar[index] = index;
}
for (var i = 0; i < 10; ++i) {
store(array, i);
}
assertEq(array.length, 4);
for (var i = 0; i < 4; ++i) {
assertEq(array[i], i);
}
for (var i = 4; i < 10; ++i) {
assertEq(i in array, false);
}
}
testStoreDenseHole();
function testStoreDenseHolePoly() {
var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
Object.defineProperty(array, "length", {
writable: false
});
function store(ar, index) {
ar[index] = index;
}
var objects = [array, {}];
for (var i = 0; i < 10; ++i) {
for (var j = 0; j < objects.length; ++j) {
store(objects[j], i);
}
}
assertEq(array.length, 4);
for (var i = 0; i < 4; ++i) {
assertEq(array[i], i);
}
for (var i = 4; i < 10; ++i) {
assertEq(i in array, false);
}
}
testStoreDenseHolePoly();
// Store an element into a previous hole value and later add more elements
// exceeding the initialised length. Cover both mono- and polymorphic call
// sites. Change array length to non-writable during execution.
function testStoreDenseHole() {
var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
function store(ar, index) {
ar[index] = index;
}
for (var i = 0; i < 10; ++i) {
if (i === 5) {
Object.defineProperty(array, "length", {writable: false});
}
store(array, i);