15 files changed, 613 insertions, 0 deletions
diff --git a/js/src/tests/js1_5/Function/10.1.6-01.js b/js/src/tests/js1_5/Function/10.1.6-01.js
new file mode 100644
index 000000000..fbb98616e
--- /dev/null
+++ b/js/src/tests/js1_5/Function/10.1.6-01.js
@@ -0,0 +1,29 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 293782;
+var summary = 'Local variables should not be enumerable properties of the function';
+var actual = '';
+var expect = '';
+
+printBugNumber(BUGNUMBER);
+printStatus (summary);
+
+function f()
+{
+  var x,y
+    }
+
+var p;
+actual = '';
+
+for (p in f)
+{
+  actual += p + ',';
+}
+expect = '';
+ 
+reportCompare(expect, actual, summary);
diff --git a/js/src/tests/js1_5/Function/10.1.6.js b/js/src/tests/js1_5/Function/10.1.6.js
new file mode 100644
index 000000000..504001cb1
--- /dev/null
+++ b/js/src/tests/js1_5/Function/10.1.6.js
@@ -0,0 +1,23 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 293782;
+var summary = 'Local variables can cause predefined function object properties to be undefined';
+var actual = '';
+var expect = '';
+
+printBugNumber(BUGNUMBER);
+printStatus (summary);
+
+function f()
+{
+  var name=1;
+}
+
+expect = 'f';
+actual = f.name;
+ 
+reportCompare(expect, actual, summary);
diff --git a/js/src/tests/js1_5/Function/browser.js b/js/src/tests/js1_5/Function/browser.js
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/js/src/tests/js1_5/Function/browser.js
diff --git a/js/src/tests/js1_5/Function/regress-123371.js b/js/src/tests/js1_5/Function/regress-123371.js
new file mode 100644
index 000000000..58294c6a0
--- /dev/null
+++ b/js/src/tests/js1_5/Function/regress-123371.js
@@ -0,0 +1,19 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 123371;
+var summary = 'Do not crash when newline separates function name from arglist';
+var actual = 'No Crash';
+var expect = 'No Crash';
+
+
+printBugNumber(BUGNUMBER);
+printStatus (summary);
+ 
+printStatus
+('function call succeeded');
+
+reportCompare(expect, actual, summary);
diff --git a/js/src/tests/js1_5/Function/regress-178389.js b/js/src/tests/js1_5/Function/regress-178389.js
new file mode 100644
index 000000000..e1735adf8
--- /dev/null
+++ b/js/src/tests/js1_5/Function/regress-178389.js
@@ -0,0 +1,26 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 178389;
+var summary = 'Function.prototype.toSource should not override Function.prototype.toString';
+var actual = '';
+var expect = '';
+
+printBugNumber(BUGNUMBER);
+printStatus (summary);
+ 
+function f()
+{
+  var g = function (){};
+}
+
+expect = f.toString();
+
+Function.prototype.toSource = function () { return ''; };
+
+actual = f.toString();
+
+reportCompare(expect, actual, summary);
diff --git a/js/src/tests/js1_5/Function/regress-222029-001.js b/js/src/tests/js1_5/Function/regress-222029-001.js
new file mode 100644
index 000000000..18d9abfca
--- /dev/null
+++ b/js/src/tests/js1_5/Function/regress-222029-001.js
@@ -0,0 +1,126 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ *
+ * Date:    13 Oct 2003
+ * SUMMARY: Make our f.caller property match IE's wrt f.apply and f.call
+ * See http://bugzilla.mozilla.org/show_bug.cgi?id=222029
+ *
+ * Below, when gg calls f via |f.call|, we have this call chain:
+ *
+ *          calls                                  calls
+ *   gg() --------->  Function.prototype.call()  --------->  f()
+ *
+ *
+ * The question this bug addresses is, "What should we say |f.caller| is?"
+ *
+ * Before this fix, SpiderMonkey said it was |Function.prototype.call|.
+ * After this fix, SpiderMonkey emulates IE and says |gg| instead.
+ *
+ */
+//-----------------------------------------------------------------------------
+var UBound = 0;
+var BUGNUMBER = 222029;
+var summary = "Make our f.caller property match IE's wrt f.apply and f.call";
+var status = '';
+var statusitems = [];
+var actual = '';
+var actualvalues = [];
+var expect= '';
+var expectedvalues = [];
+
+
+function f()
+{
+  return f.caller.p ;
+}
+
+
+/*
+ * Call |f| directly
+ */
+function g()
+{
+  return f();
+}
+g.p = "hello";
+
+
+/*
+ * Call |f| via |f.call|
+ */
+function gg()
+{
+  return f.call(this);
+}
+gg.p = "hello";
+
+
+/*
+ * Call |f| via |f.apply|
+ */
+function ggg()
+{
+  return f.apply(this);
+}
+ggg.p = "hello";
+
+
+/*
+ * Shadow |p| on |Function.prototype.call|, |Function.prototype.apply|.
+ * In Sections 2 and 3 below, we no longer expect to recover this value -
+ */
+Function.prototype.call.p = "goodbye";
+Function.prototype.apply.p = "goodbye";
+
+
+
+status = inSection(1);
+actual = g();
+expect = "hello";
+addThis();
+
+status = inSection(2);
+actual = gg();
+expect = "hello";
+addThis();
+
+status = inSection(3);
+actual = ggg();
+expect = "hello";
+addThis();
+
+
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+
+
+function addThis()
+{
+  statusitems[UBound] = status;
+  actualvalues[UBound] = actual;
+  expectedvalues[UBound] = expect;
+  UBound++;
+}
+
+
+function test()
+{
+  enterFunc('test');
+  printBugNumber(BUGNUMBER);
+  printStatus(summary);
+
+  for (var i=0; i<UBound; i++)
+  {
+    reportCompare(expectedvalues[i], actualvalues[i], statusitems[i]);
+  }
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_5/Function/regress-222029-002.js b/js/src/tests/js1_5/Function/regress-222029-002.js
new file mode 100644
index 000000000..e5d88aa94
--- /dev/null
+++ b/js/src/tests/js1_5/Function/regress-222029-002.js
@@ -0,0 +1,135 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ *
+ * Date:    13 Oct 2003
+ * SUMMARY: Make our f.caller property match IE's wrt f.apply and f.call
+ * See http://bugzilla.mozilla.org/show_bug.cgi?id=222029
+ *
+ * Below, when gg calls f via |f.call|, we have this call chain:
+ *
+ *          calls                                  calls
+ *   gg() --------->  Function.prototype.call()  --------->  f()
+ *
+ *
+ * The question this bug addresses is, "What should we say |f.caller| is?"
+ *
+ * Before this fix, SpiderMonkey said it was |Function.prototype.call|.
+ * After this fix, SpiderMonkey emulates IE and says |gg| instead.
+ *
+ */
+//-----------------------------------------------------------------------------
+var UBound = 0;
+var BUGNUMBER = 222029;
+var summary = "Make our f.caller property match IE's wrt f.apply and f.call";
+var status = '';
+var statusitems = [];
+var actual = '';
+var actualvalues = [];
+var expect= '';
+var expectedvalues = [];
+
+/*
+ * Try to confuse the engine by adding a |p| property to everything!
+ */
+var p = 'global';
+var o = {p:'object'};
+
+
+function f(obj)
+{
+  return f.caller.p ;
+}
+
+
+/*
+ * Call |f| directly
+ */
+function g(obj)
+{
+  var p = 'local';
+  return f(obj);
+}
+g.p = "hello";
+
+
+/*
+ * Call |f| via |f.call|
+ */
+function gg(obj)
+{
+  var p = 'local';
+  return f.call(obj, obj);
+}
+gg.p = "hello";
+
+
+/*
+ * Call |f| via |f.apply|
+ */
+function ggg(obj)
+{
+  var p = 'local';
+  return f.apply(obj, [obj]);
+}
+ggg.p = "hello";
+
+
+/*
+ * Shadow |p| on |Function.prototype.call|, |Function.prototype.apply|.
+ * In Sections 2 and 3 below, we no longer expect to recover this value -
+ */
+Function.prototype.call.p = "goodbye";
+Function.prototype.apply.p = "goodbye";
+
+
+
+status = inSection(1);
+actual = g(o);
+expect = "hello";
+addThis();
+
+status = inSection(2);
+actual = gg(o);
+expect = "hello";
+addThis();
+
+status = inSection(3);
+actual = ggg(o);
+expect = "hello";
+addThis();
+
+
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+
+
+function addThis()
+{
+  statusitems[UBound] = status;
+  actualvalues[UBound] = actual;
+  expectedvalues[UBound] = expect;
+  UBound++;
+}
+
+
+function test()
+{
+  enterFunc('test');
+  printBugNumber(BUGNUMBER);
+  printStatus(summary);
+
+  for (var i=0; i<UBound; i++)
+  {
+    reportCompare(expectedvalues[i], actualvalues[i], statusitems[i]);
+  }
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_5/Function/regress-292215.js b/js/src/tests/js1_5/Function/regress-292215.js
new file mode 100644
index 000000000..c264b7417
--- /dev/null
+++ b/js/src/tests/js1_5/Function/regress-292215.js
@@ -0,0 +1,37 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 292215;
+var summary = 'Set arguments';
+var actual = '';
+var expect = '00012';
+
+printBugNumber(BUGNUMBER);
+printStatus (summary);
+ 
+
+function zeroArguments () {
+  arguments[1] = '0';
+  actual += arguments[1];
+}
+
+function oneArgument (x) {
+  arguments[1] = '1';
+  actual += arguments[1];
+}
+
+function twoArguments (x,y) {
+  arguments[1] = '2';
+  actual += arguments[1];
+}
+
+zeroArguments();
+zeroArguments(1);
+zeroArguments('a', 'b');
+oneArgument();
+twoArguments();
+
+reportCompare(expect, actual, summary);
diff --git a/js/src/tests/js1_5/Function/regress-338001.js b/js/src/tests/js1_5/Function/regress-338001.js
new file mode 100644
index 000000000..d8b2b772f
--- /dev/null
+++ b/js/src/tests/js1_5/Function/regress-338001.js
@@ -0,0 +1,42 @@
+// |reftest| skip-if(Android) silentfail skip -- disabled pending bug 657444
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 338001;
+var summary = 'integer overflow in jsfun.c:Function';
+var actual = 'No Crash';
+var expect = /No Crash|InternalError: allocation size overflow/;
+
+printBugNumber(BUGNUMBER);
+printStatus (summary);
+
+expectExitCode(0);
+expectExitCode(5);
+
+var fe="f";
+
+try
+{
+  for (i=0; i<25; i++)
+    fe += fe;
+
+  var fu=new Function(
+    fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe,
+    fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe,
+    fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe,
+    fe, fe, fe, fe, fe, fe, fe, fe, fe, fe,
+    "done"
+    );
+}
+catch(ex)
+{
+  // handle changed 1.9 branch behavior. see bug 422348
+  actual = ex + '';
+}
+ 
+print('Done: ' + actual);
+
+reportMatch(expect, actual, summary);
diff --git a/js/src/tests/js1_5/Function/regress-338121-01.js b/js/src/tests/js1_5/Function/regress-338121-01.js
new file mode 100644
index 000000000..3271c38af
--- /dev/null
+++ b/js/src/tests/js1_5/Function/regress-338121-01.js
@@ -0,0 +1,32 @@
+// |reftest| skip-if(Android) silentfail skip -- disabled pending bug 657444
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 338121;
+var summary = 'Issues with JS_ARENA_ALLOCATE_CAST';
+var actual = 'No Crash';
+var expect = 'No Crash';
+
+printBugNumber(BUGNUMBER);
+printStatus (summary);
+
+expectExitCode(0);
+expectExitCode(5);
+
+var fe="v";
+
+for (i=0; i<25; i++)
+  fe += fe;
+
+var fu=new Function(
+  fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe,
+  fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe,
+  "done"
+  );
+
+print('Done');
+
+reportCompare(expect, actual, summary);
diff --git a/js/src/tests/js1_5/Function/regress-338121-02.js b/js/src/tests/js1_5/Function/regress-338121-02.js
new file mode 100644
index 000000000..f051c00ce
--- /dev/null
+++ b/js/src/tests/js1_5/Function/regress-338121-02.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(Android) silentfail skip -- disabled pending bug 657444
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 338121;
+var summary = 'Issues with JS_ARENA_ALLOCATE_CAST';
+var actual = 'No Crash';
+var expect = 'No Crash';
+
+printBugNumber(BUGNUMBER);
+printStatus (summary);
+
+expectExitCode(0);
+expectExitCode(5);
+
+var fe="vv";
+
+for (i=0; i<24; i++)
+  fe += fe;
+
+var fu=new Function(
+  fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe,
+  fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe,
+  "done"
+  );
+
+//alert("fu="+fu);
+//print("fu="+fu);
+var fuout = 'fu=' + fu;
+
+print('Done');
+
+reportCompare(expect, actual, summary);
diff --git a/js/src/tests/js1_5/Function/regress-338121-03.js b/js/src/tests/js1_5/Function/regress-338121-03.js
new file mode 100644
index 000000000..b7f656af7
--- /dev/null
+++ b/js/src/tests/js1_5/Function/regress-338121-03.js
@@ -0,0 +1,38 @@
+// |reftest| skip-if(Android) silentfail skip -- disabled pending bug 657444
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 338121;
+var summary = 'Issues with JS_ARENA_ALLOCATE_CAST';
+var actual = 'No Crash';
+var expect = 'No Crash';
+
+printBugNumber(BUGNUMBER);
+printStatus (summary);
+
+expectExitCode(0);
+expectExitCode(5);
+
+var fe="vv";
+
+for (i=0; i<24; i++)
+  fe += fe;
+
+var fu=new Function(
+  fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe,
+  fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe,
+  fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe, fe,
+  fe, fe, fe,
+  "done"
+  );
+
+//alert("fu="+fu);
+//print("fu="+fu);
+var fuout = 'fu=' + fu;
+
+print('Done');
+
+reportCompare(expect, actual, summary);
diff --git a/js/src/tests/js1_5/Function/regress-344052.js b/js/src/tests/js1_5/Function/regress-344052.js
new file mode 100644
index 000000000..ce07f37b4
--- /dev/null
+++ b/js/src/tests/js1_5/Function/regress-344052.js
@@ -0,0 +1,30 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 344052;
+var summary = 'Function prototype - simple shared property';
+var actual = '';
+var expect = 'true';
+
+Function.prototype.foo = true;
+function y(){};
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  actual = String(y.foo);
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_5/Function/regress-364023.js b/js/src/tests/js1_5/Function/regress-364023.js
new file mode 100644
index 000000000..4a5cbb761
--- /dev/null
+++ b/js/src/tests/js1_5/Function/regress-364023.js
@@ -0,0 +1,40 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 364023;
+var summary = 'Do not crash in JS_GetPrivate';
+var actual = 'No Crash';
+var expect = 'No Crash';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+ 
+  function exploit() {
+    var code = "";
+    for(var i = 0; i < 0x10000; i++) {
+      if(i == 125) {
+        code += "void 0x10000050505050;\n";
+      } else {
+        code += "void " + (0x10000000000000 + i) + ";\n";
+      }
+    }
+    code += "function foo() {}\n";
+    eval(code);
+  }
+  exploit();
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_5/Function/shell.js b/js/src/tests/js1_5/Function/shell.js
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/js/src/tests/js1_5/Function/shell.js