Various test cases for cross-browser compliance bugs

test/annexB/language/function-code/block-decl-nested-blocks-with-fun-decl.js

@@ -0,0 +1,40 @@
+// Copyright (C) 2018 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-web-compat-functiondeclarationinstantiation
+description: >
+  Nested function declarations, the second declaration is not Annex-B applicable.
+info: |
+  B.3.3.1 Changes to FunctionDeclarationInstantiation
+
+  1. If strict is false, then
+    a. For each FunctionDeclaration f that is directly contained in the
+       StatementList of a Block, CaseClause, or DefaultClause, do
+      i. Let F be StringValue of the BindingIdentifier of FunctionDeclaration f.
+      ii. If replacing the FunctionDeclaration f with a VariableStatement that
+          has F as a BindingIdentifier would not produce any Early Errors for
+          func and F is not an element of parameterNames, then
+       ...
+flags: [noStrict]
+---*/
+
+function g() {
+    // Create an outer block-statement.
+    {
+        // A lexically declared function declaration.
+        // This function is applicable for Annex-B semantics.
+        function f() { return 1; }
+
+        // An inner block-statement with another function declaration.
+        // This function is not applicable for Annex-B semantics, because
+        // replacing it with |var f| would result in a SyntaxError.
+        {
+            function f() { return 2; }
+        }
+    }
+
+    assert.sameValue(f(), 1);
+}
+
+g();

test/built-ins/Array/prototype/filter/target-array-with-non-writable-property.js

@@ -0,0 +1,37 @@
+// Copyright (C) 2018 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.filter
+description: >
+  Non-writable properties are overwritten by CreateDataPropertyOrThrow.
+info: |
+  22.1.3.7 Array.prototype.filter ( callbackfn [ , thisArg ] )
+
+  ...
+  8. Repeat, while k < len
+    ...
+    c. If kPresent is true, then
+      ...
+      iii. If selected is true, then
+        1. Perform ? CreateDataPropertyOrThrow(A, ! ToString(to), kValue).
+        ...
+features: [Symbol.species]
+includes: [propertyHelper.js]
+---*/
+
+var a = [1];
+a.constructor = {};
+a.constructor[Symbol.species] = function(len) {
+    var q = new Array(0);
+    Object.defineProperty(q, 0, {
+        value: 0, writable: false, configurable: true, enumerable: false,
+    });
+    return q;
+};
+
+var r = a.filter(function(){ return true; });
+
+verifyProperty(r, 0, {
+    value: 1, writable: true, configurable: true, enumerable: true,
+});

test/built-ins/Array/prototype/indexOf/calls-only-has-on-prototype-after-length-zeroed.js

@@ -0,0 +1,43 @@
+// Copyright (C) 2018 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.indexof
+description: >
+  Calls [[HasProperty]] on the prototype to check for existing elements.
+info: |
+  22.1.3.12 Array.prototype.indexOf ( searchElement [ , fromIndex ] )
+
+  ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  ...
+  4. Let n be ? ToInteger(fromIndex). (If fromIndex is undefined, this step produces the value 0.)
+  ...
+  8. Repeat, while k < len
+    a. Let kPresent be ? HasProperty(O, ! ToString(k)).
+    b. If kPresent is true, then
+      i. Let elementK be ? Get(O, ! ToString(k)).
+      ...
+includes: [proxyTrapsHelper.js]
+features: [Proxy]
+---*/
+
+var array = [1, null, 3];
+
+Object.setPrototypeOf(array, new Proxy(Array.prototype, allowProxyTraps({
+    has: function(t, pk) {
+        return pk in t;
+    }
+})));
+
+var fromIndex = {
+    valueOf: function() {
+        // Zero the array's length. The loop in step 8 iterates over the original
+        // length value of 100, but the only prototype MOP method which should be
+        // called is [[HasProperty]].
+        array.length = 0;
+        return 0;
+    }
+};
+
+Array.prototype.indexOf.call(array, 100, fromIndex);

test/built-ins/Array/prototype/lastIndexOf/calls-only-has-on-prototype-after-length-zeroed.js

@@ -0,0 +1,43 @@
+// Copyright (C) 2018 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.lastindexof
+description: >
+  Calls [[HasProperty]] on the prototype to check for existing elements.
+info: |
+  22.1.3.15 Array.prototype.lastIndexOf ( searchElement [ , fromIndex ] )
+
+  ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  ...
+  4. If fromIndex is present, let n be ? ToInteger(fromIndex); else let n be len-1.
+  ...
+  7. Repeat, while k ≥ 0
+    a. Let kPresent be ? HasProperty(O, ! ToString(k)).
+    b. If kPresent is true, then
+      i. Let elementK be ? Get(O, ! ToString(k)).
+      ...
+includes: [proxyTrapsHelper.js]
+features: [Proxy]
+---*/
+
+var array = [5, undefined, 7];
+
+Object.setPrototypeOf(array, new Proxy(Array.prototype, allowProxyTraps({
+    has: function(t, pk) {
+        return pk in t;
+    }
+})));
+
+var fromIndex = {
+    valueOf: function() {
+        // Zero the array's length. The loop in step 8 iterates over the original
+        // length value of 100, but the only prototype MOP method which should be
+        // called is [[HasProperty]].
+        array.length = 0;
+        return 2;
+    }
+};
+
+Array.prototype.lastIndexOf.call(array, 100, fromIndex);

test/built-ins/Array/prototype/map/target-array-with-non-writable-property.js

@@ -0,0 +1,36 @@
+// Copyright (C) 2018 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.map
+description: >
+  Non-writable properties are overwritten by CreateDataPropertyOrThrow.
+info: |
+  22.1.3.16 Array.prototype.map ( callbackfn [ , thisArg ] )
+
+  ...
+  7. Repeat, while k < len
+    ...
+    c. If kPresent is true, then
+      ...
+      iii. Perform ? CreateDataPropertyOrThrow(A, Pk, mappedValue).
+    ...
+features: [Symbol.species]
+includes: [propertyHelper.js]
+---*/
+
+var a = [1];
+a.constructor = {};
+a.constructor[Symbol.species] = function(len) {
+    var q = new Array(0);
+    Object.defineProperty(q, 0, {
+        value: 0, writable: false, configurable: true, enumerable: false,
+    });
+    return q;
+};
+
+var r = a.map(function(){ return 2; });
+
+verifyProperty(r, 0, {
+    value: 2, writable: true, configurable: true, enumerable: true,
+});

test/built-ins/Array/prototype/slice/target-array-with-non-writable-property.js

@@ -0,0 +1,36 @@
+// Copyright (C) 2018 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.slice
+description: >
+  Non-writable properties are overwritten by CreateDataPropertyOrThrow.
+info: |
+  22.1.3.23 Array.prototype.slice ( start, end )
+
+  ...
+  10. Repeat, while k < final
+    ...
+    c. If kPresent is true, then
+      ...
+      ii. Perform ? CreateDataPropertyOrThrow(A, ! ToString(n), kValue).
+    ...
+features: [Symbol.species]
+includes: [propertyHelper.js]
+---*/
+
+var a = [1];
+a.constructor = {};
+a.constructor[Symbol.species] = function(len) {
+    var q = new Array(0);
+    Object.defineProperty(q, 0, {
+        value: 0, writable: false, configurable: true, enumerable: false,
+    });
+    return q;
+};
+
+var r = a.slice(0);
+
+verifyProperty(r, 0, {
+    value: 1, writable: true, configurable: true, enumerable: true,
+});

test/built-ins/Array/prototype/splice/property-traps-order-with-species.js

@@ -0,0 +1,38 @@
+// Copyright (C) 2018 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.splice
+description: >
+  Ensure the correct property traps are called on the new array.
+features: [Proxy, Symbol.species]
+includes: [compareArray.js]
+---*/
+
+var log = [];
+
+var a = [0, 1];
+a.constructor = {};
+
+a.constructor[Symbol.species] = function(len) {
+    return new Proxy(new Array(len), new Proxy({}, {
+        get(t, pk, r) {
+            log.push(pk);
+        }
+    }));
+};
+
+var r = a.splice(0);
+
+assert.compareArray([
+    // Step 11.c.ii: CreateDataPropertyOrThrow(A, ! ToString(k), fromValue).
+    "defineProperty",
+
+    // Step 11.c.ii: CreateDataPropertyOrThrow(A, ! ToString(k), fromValue).
+    "defineProperty",
+
+    // Step 12: Perform ? Set(A, "length", actualDeleteCount, true).
+    "set",
+    "getOwnPropertyDescriptor",
+    "defineProperty",
+], log);

test/built-ins/Array/prototype/splice/target-array-with-non-writable-property.js

@@ -0,0 +1,36 @@
+// Copyright (C) 2018 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.splice
+description: >
+  Non-writable properties are overwritten by CreateDataPropertyOrThrow.
+info: |
+  22.1.3.26 Array.prototype.splice ( start, deleteCount, ...items )
+
+  ...
+  11. Repeat, while k < actualDeleteCount
+    ...
+    c. If fromPresent is true, then
+      ...
+      ii. Perform ? CreateDataPropertyOrThrow(A, ! ToString(k), fromValue).
+    ...
+features: [Symbol.species]
+includes: [propertyHelper.js]
+---*/
+
+var a = [1];
+a.constructor = {};
+a.constructor[Symbol.species] = function(len) {
+    var q = new Array(0);
+    Object.defineProperty(q, 0, {
+        value: 0, writable: false, configurable: true, enumerable: false,
+    });
+    return q;
+};
+
+var r = a.splice(0);
+
+verifyProperty(r, 0, {
+    value: 1, writable: true, configurable: true, enumerable: true,
+});

test/built-ins/Function/prototype/bind/length-exceeds-int32.js

@@ -0,0 +1,26 @@
+// Copyright (C) 2018 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-function.prototype.bind
+description: >
+  The target function length can exceed 2**31-1.
+info: |
+  19.2.3.2 Function.prototype.bind ( thisArg, ...args )
+
+  ...
+  6. If targetHasLength is true, then
+    a. Let targetLen be ? Get(Target, "length").
+    b. If Type(targetLen) is not Number, let L be 0.
+    c. Else,
+      i. Let targetLen be ToInteger(targetLen).
+      ii. Let L be the larger of 0 and the result of targetLen minus the number of elements of args.
+  ...
+  8. Perform ! SetFunctionLength(F, L).
+  ...
+---*/
+
+function f(){}
+Object.defineProperty(f, "length", {value: 2147483648});
+
+assert.sameValue(f.bind().length, 2147483648);