Merge remote-tracking branch 'upstream'

Author: Jarred-Sumner

JSTests/stress/array-prototype-splice-deleteCount-not-int32.js

@@ -0,0 +1,44 @@
+function sameArray(a, b) {
+    if (a.length !== b.length)
+        throw new Error(`Expected length is ${b.length} but got length ${a.length}`);
+    for (let i = 0; i < a.length; i++) {
+        if (a[i] !== b[i])
+            throw new Error(`Expected ${b[i]} but got ${a[i]} (${i})`);
+    }
+}
+
+{
+    const array = [1, 2, 3, 4, 5];
+    array.splice(1, true);
+    sameArray(array, [1, 3, 4, 5]);
+}
+
+{
+    const array = [1, 2, 3, 4, 5];
+    array.splice(1, false);
+    sameArray(array, [1, 2, 3, 4, 5]);
+}
+
+{
+    const array = [1, 2, 3, 4, 5];
+    array.splice(1, null);
+    sameArray(array, [1, 2, 3, 4, 5]);
+}
+
+{
+    const array = [1, 2, 3, 4, 5];
+    array.splice(1, undefined);
+    sameArray(array, [1, 2, 3, 4, 5]);
+}
+
+{
+    const array = [1, 2, 3, 4, 5];
+    array.splice(1, NaN);
+    sameArray(array, [1, 2, 3, 4, 5]);
+}
+
+{
+    const array = [1, 2, 3, 4, 5];
+    array.splice(1, 1.24);
+    sameArray(array, [1, 3, 4, 5]);
+}

JSTests/stress/get-own-property-descriptors-oom.js

@@ -0,0 +1,42 @@
+//@ skip if $memoryLimited
+//@ runDefault("--watchdog=1000", "--watchdog-exception-ok")
+
+try {
+    var var_12_ = new Intl.RelativeTimeFormat();
+    var var_13_ = isNaN.toString;
+    for (let var_1_ = {}.var_2_; var_1_ < 100000; var_1_++) {
+      ArrayBuffer.prototype.transfer.__proto__ = Object.prototype.__defineGetter__;
+    }
+    function func_1_() {
+      {
+        this.g ??= createGlobalObject();
+        var var_3_ = new this.g.WebAssembly.Memory({initial: 4096}, {'g': 5});
+      }
+      try {
+        const z685250 = [0.4, 1145324612];
+        const z302037 = [0.4, 1145324612];
+        func_1_();
+        const z84237 = [0.4, 1145324612];
+        const z436279 = [0.4, 1145324612];
+        var var_8_ = BigInt(-1.7976931348623157e+308);
+        const z995009 = [0.4, 1145324612];
+        const z377832 = [0.4, 1145324612];
+      } catch {}
+      try {
+        function func_2_(var_9_) {
+          try {
+            Object.getOwnPropertyDescriptors(var_9_);
+          } catch (var_11_) {}
+          var_9_ = new Int32Array(5);
+        }
+        func_2_('var var_10_ = { null} ' + '\u2593\uD809\uDC2B\u200B\u180E\u180Eﾉ\u2032\uFF06stßﷺııN̯̱̣͇̖̦̦̣ͥͮͩͪ̐͑͂̈̅ͦ͋̆̔͆̀̆̀̚̚̕a#\uFF06ffiN̯̱̣͇̖̦̦̣ͥͮͩͪ̐͑͂̈̅ͦ͋̆̔͆̀̆̀̚̚̕?ㅤΐKßㅤ\u2004ſa\u2032a\u200B\u2032İ\uFF1F\uFF0F\uFFFC\uFF06ㅤKN̯̱̣͇̖̦̦̣ͥͮͩͪ̐͑͂̈̅ͦ͋̆̔͆̀̆̀̚̚̕#\uFFFC\u202E\uFE64\u2004\uD809\uDC2B\u202E\uFE64ſ\u200Bıſ\t#ffiſffiㅤ\u3000?ſ\u2593Kﷺﾉ ffiN̯̱̣͇̖̦̦̣ͥͮͩͪ̐͑͂̈̅ͦ͋̆̔͆̀̆̀̚̚̕\uFF1Fσᴮᴮ\u3000\u2032\u3000N̯̱̣͇̖̦̦̣ͥͮͩͪ̐͑͂̈̅ͦ͋̆̔͆̀̆̀̚̚̕\u3000ᴮㅤ\uD809\uDC2B?\u202E\uFFFC\uFF06\u202EN̯̱̣͇̖̦̦̣ͥͮͩͪ̐͑͂̈̅ͦ͋̆̔͆̀̆̀̚̚̕ßᅟ\u180E\u2004stst\uFE64\u3000\uFFFD?AKσ\t ffi\u2004ffi\u2593 \u180E \uFFFCAᅟ\uFDFDᴮᅟ\u180E\uFF1F#\uFDFD\u2032ΐſ.\u2593ΐ.\u200B?ᴮffi.\u3000ß.జ్ఞాㅤᅟA\u200BKᅟᴮa\u2032ffiﷺ?K\uFF1Fßß \uFF06\u200B \u2593\uFFFC\u2593\u202E\u3000ᴮᴮ\uFF0F1&Math.fround(-0)+0.0?#ㅤN̯̱̣͇̖̦̦̣ͥͮͩͪ̐͑͂̈̅ͦ͋̆̔͆̀̆̀̚̚̕1ﷺ ㅤ.\u2004\u2032ffi\uFF06ſᅟ\uFF0F?ᴮᴮİ\uFF1F\u3000a\uFF06\u180E\u3000\u200Bstᅟ?ㅤ\uFFFCffiﷺıßİ\uFF06#stσ\uFFFC\u200B\uFF1F\uFF0Fİſ1ffi\uFF0F\u200B\tſst\u180EſᴮᴮΐAKK.\u2004.\u3000జ్ఞా\uFFFD\uFFFD\u2593.ᴮA\u3000\uFF0Fᴮ\tAstİ?ı.ſ\uFDFDßN̯̱̣͇̖̦̦̣ͥͮͩͪ̐͑͂̈̅ͦ͋̆̔͆̀̆̀̚̚̕ﾉ\u200Bı\uFF06Aΐᴮ\u2004\u202Effi?\uFFFCa\u2032ﷺ\u2004ı\t?ᅟß ㅤ \u180E\u2004\uFE64σ\u2004ᴮ\u200B\uD809\uDC2Bㅤ\uFF0F\u2032\u202E\uFFFDast?..AKﷺA\u2593\uD809\uDC2B\uFFFD\u202E?ﷺ\uD809\uDC2B\u2593.ㅤ\uD809\uDC2B\u2032a#.?\uFF0F?\u202EN̯̱̣͇̖̦̦̣ͥͮͩͪ̐͑͂̈̅ͦ͋̆̔͆̀̆̀̚̚̕\uD809\uDC2Bı\u3000ㅤΐ\uFF0Fſﾉffi\uFF06\uFFFCa\uFFFD\t\u202Effiı\u3000ᅟ\u3000N̯̱̣͇̖̦̦̣ͥͮͩͪ̐͑͂̈̅ͦ͋̆̔͆̀̆̀̚̚̕\uFF1Fﷺ\uFDFD.\uFF1Fᅟᅟ1ㅤ#a#ㅤ\uFFFCffi\u2032\uFFFD#Kσ\u2593\u3000\u180EﷺㅤﾉıKAst\u2593\u2593\u200Bſﷺᅟ\u180EN̯̱̣͇̖̦̦̣ͥͮͩͪ̐͑͂̈̅ͦ͋̆̔͆̀̆̀̚̚̕\uFF0F\uFDFD\uFF06σ\t\uD809\uDC2B#\uFF0611ß\u2004\uFF0F?#\uFF06σ\uFE64ᅟ#İ..Kffi\uFE64\u2004\u180E\uFF1F\uFFFDజ్ఞాK1.ᅟİ\u180E st\t\uFF0F');
+        for (let var_6_ = 0; var_6_ <= 100000 || null; var_6_++) {
+          var var_7_ = new Float32Array(var_6_);
+          func_1_.__proto__ = Number.EPSILON;
+        }
+        var_3_.grow(var_5_ - 4096 + 1);
+      } catch (var_4_) {}
+      var_8_, 30n, 3n + '' + 10n + '\uFF0F' + '' + var_8_;
+    }
+    func_1_();
+} catch { }

JSTests/stress/own-property-names-oom.js

@@ -0,0 +1,43 @@
+//@ skip if $memoryLimited
+//@ slow!
+//@ runDefault
+try {
+    this.g ??= createGlobalObject();
+    for (let var_1_ = {}.var_2_; var_1_ < 100000; var_1_++) {}
+    function func_1_() {
+      const var_9_ = ''?.[-4294967295];
+      var var_10_ = [var_9_];
+      {
+        var var_3_ = new WebAssembly.Memory({initial: 4096});
+      }
+      try {
+        func_1_();
+        'flags', var_10_, 0, var_10_;
+        var var_8_ = BigInt(-1.7976931348623157e+308, {'g': 5}, {'g': 5}, {'g': 5}, {'g': 5}, {'g': 5});
+      } catch {}
+      try {
+        for (let var_6_ = 0; var_6_ <= 100000 || null; var_6_++) {
+          String.prototype.substr.__proto__ = Math.E;
+          var var_7_ = new Float32Array(var_6_);
+          var_8_.__proto__ = Set.prototype.entries;
+        }
+        var_3_.grow(var_5_ - 4096 + 1);
+      } catch (var_4_) {
+        optimizeNextInvocation?.(var_13_);
+      }
+      var_8_, 30n, 3n + '' + 10n + '' + var_8_;
+      var var_11_ = new this.g.Float32Array(new ArrayBuffer(4384));
+      var var_12_ = ''.includes(var_7_);
+      var var_13_ = Float32Array.prototype.lastIndexOf.call(var_7_, undefined);
+      var var_14_ = ''.includes(var_11_);
+      var keys = Object.keys(var_7_);
+      var keys = Object.keys(var_11_);
+      const var_15_ = makeMasquerader();
+      var_15_, 0, 41690, var_7_;
+      const var_16_ = makeMasquerader();
+      var_16_, (tmp = null, tmp ??= -0), 41690, var_7_;
+      describe(var_13_);
+    }
+    func_1_?.();
+    Math.SQRT2.__proto__ = Date.prototype;
+} catch { }