Bug 929786 - Add shell function to neutering (r=sfink)
authorLuke Wagner <luke@mozilla.com>
Thu, 24 Oct 2013 08:59:59 -0500
changeset 151967 6d4ff510c1179135cbda49e3568924bb7b18f0a2
parent 151966 42f131becd2fad742b11b2dab09016e2cfd304a9
child 151968 dc598f50a09a29c7d8999c6988af4a4545c708d3
push id35369
push userlwagner@mozilla.com
push dateThu, 24 Oct 2013 14:04:28 +0000
treeherdermozilla-inbound@dc598f50a09a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink
bugs929786
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 929786 - Add shell function to neutering (r=sfink)
js/src/builtin/TestingFunctions.cpp
js/src/jit-test/tests/basic/testNeutering.js
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -1313,16 +1313,34 @@ Deserialize(JSContext *cx, unsigned argc
     args.rval().set(deserialized);
 
     if (hasTransferable)
         obj->discard();
 
     return true;
 }
 
+static bool
+Neuter(JSContext *cx, unsigned argc, jsval *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    RootedObject obj(cx);
+    if (!JS_ValueToObject(cx, args.get(0), &obj))
+        return false;
+
+    void *contents;
+    uint8_t *data;
+    if (!JS_StealArrayBufferContents(cx, obj, &contents, &data))
+        return false;
+
+    js_free(contents);
+    return true;
+}
+
 static const JSFunctionSpecWithHelp TestingFunctions[] = {
     JS_FN_HELP("gc", ::GC, 0, 0,
 "gc([obj] | 'compartment')",
 "  Run the garbage collector. When obj is given, GC only its compartment.\n"
 "  If 'compartment' is given, GC any compartments that were scheduled for\n"
 "  GC via schedulegc."),
 
     JS_FN_HELP("minorgc", ::MinorGC, 0, 0,
@@ -1527,16 +1545,20 @@ static const JSFunctionSpecWithHelp Test
 "serialize(data, [transferables])",
 "  Serialize 'data' using JS_WriteStructuredClone. Returns a structured\n"
 "  clone buffer object."),
 
     JS_FN_HELP("deserialize", Deserialize, 1, 0,
 "deserialize(clonebuffer)",
 "  Deserialize data generated by serialize."),
 
+    JS_FN_HELP("neuter", Neuter, 1, 0,
+"neuter(buffer)",
+"  Neuter the given ArrayBuffer object as if it had been transferred to a WebWorker."),
+
     JS_FS_HELP_END
 };
 
 bool
 js::DefineTestingFunctions(JSContext *cx, HandleObject obj, bool fuzzingSafe_)
 {
     fuzzingSafe = fuzzingSafe_;
     if (getenv("MOZ_FUZZING_SAFE") && getenv("MOZ_FUZZING_SAFE")[0] != '0')
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testNeutering.js
@@ -0,0 +1,23 @@
+var ab = new ArrayBuffer(4);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);
+
+var ab = new ArrayBuffer(12);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);
+
+var ab = new ArrayBuffer(4096);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);