[tests] Introduce %HeapObjectVerify runtime function for tests

Bug: v8/6024
Change-Id: Iff8a1b7a75e9f8f18ac24f31a5275e91aa16a272
Reviewed-on: https://chromium-review.googlesource.com/469347
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44439}

src/runtime/runtime-test.cc

@@ -947,7 +947,7 @@ RUNTIME_FUNCTION(Runtime_ValidateWasmOrphanedInstance) {
   return isolate->heap()->ToBoolean(true);
 }
 
-RUNTIME_FUNCTION(Runtime_Verify) {
+RUNTIME_FUNCTION(Runtime_HeapObjectVerify) {
   HandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);

src/runtime/runtime.h

@@ -609,7 +609,7 @@ namespace internal {
   F(ValidateWasmOrphanedInstance, 1, 1)       \
   F(SetWasmCompileControls, 2, 1)             \
   F(SetWasmInstantiateControls, 0, 1)         \
-  F(Verify, 1, 1)                             \
+  F(HeapObjectVerify, 1, 1)                   \
   F(WasmNumInterpretedCalls, 1, 1)            \
   F(RedirectToWasmInterpreter, 2, 1)
 

test/mjsunit/debugPrint.js

@@ -7,6 +7,25 @@
 var largeArray = [];
 largeArray[0xFFFF00] = 123;
 
+function sloppyArguments() {
+  return arguments;
+}
+
+function sloppyArguments2(a, b) {
+  return arguments;
+}
+
+function slowSloppyArguments() {
+  arguments[0xFFFFF] = -1;
+  return arguments;
+}
+
+function slowSloppyArguments2(a, b) {
+  arguments[0xFFFFF] = -1;
+  return arguments;
+}
+
+
 var objects = [
     this,
     true, false, null, undefined,
@@ -17,13 +36,18 @@ var objects = [
     [], [{}, {}], [1, 1, 1], [1.1, 1.1, 1.1, 1.1, 2], largeArray,
     new Proxy({},{}),
     new Date(), new String(" a"),
-    new Uint8Array(12),
+    new Uint8Array(12), new Float32Array([1, 2, 4, 5]),
+    new Uint8ClampedArray(2048),
     /asdf/, new RegExp(),
     Object.create, Object, Array,
     Symbol.iterator,
     [][Symbol.iterator](),
     new Map(), new Set(),
-    (new Map()).entries(), (new Set()).entries()
+    (new Map()).entries(), (new Set()).entries(),
+    sloppyArguments(), sloppyArguments(1, 2, 3, 4),
+    sloppyArguments2(), sloppyArguments2(1, 2, 3, 4),
+    slowSloppyArguments(), slowSloppyArguments(1, 2, 3, 4),
+    slowSloppyArguments2(), slowSloppyArguments2(1, 2, 3, 4),
 
 ];
 for (var o of objects) %DebugPrint(o);

test/mjsunit/heapObjectVerify.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var largeArray = [];
+largeArray[0xFFFF00] = 123;
+
+function sloppyArguments() {
+  return arguments;
+}
+
+function sloppyArguments2(a, b) {
+  return arguments;
+}
+
+function slowSloppyArguments() {
+  arguments[0xFFFFF] = -1;
+  return arguments;
+}
+
+function slowSloppyArguments2(a, b) {
+  arguments[0xFFFFF] = -1;
+  return arguments;
+}
+
+
+var objects = [
+    this,
+    true, false, null, undefined,
+    1, -1, 1.1, -2.2, -0, 0,
+    Infinity, -Infinity, NaN,
+    "aasdfasdfasdfasdf", "a"+"b",
+    {}, {1:1}, {a:1}, {1:1, 2:2}, Object.create(null),
+    [], [{}, {}], [1, 1, 1], [1.1, 1.1, 1.1, 1.1, 2], largeArray,
+    new Proxy({},{}),
+    new Date(), new String(" a"),
+    new Uint8Array(12), new Float32Array([1, 2, 4, 5]),
+    new Uint8ClampedArray(2048),
+    /asdf/, new RegExp(),
+    Object.create, Object, Array,
+    Symbol.iterator,
+    [][Symbol.iterator](),
+    new Map(), new Set(),
+    (new Map()).entries(), (new Set()).entries(),
+    sloppyArguments(), sloppyArguments(1, 2, 3, 4),
+    sloppyArguments2(), sloppyArguments2(1, 2, 3, 4),
+    slowSloppyArguments(), slowSloppyArguments(1, 2, 3, 4),
+    slowSloppyArguments2(), slowSloppyArguments2(1, 2, 3, 4),
+
+];
+for (var o of objects) %HeapObjectVerify(o);