Bug 929786 - Add shell function to neutering (r=sfink)
authorLuke Wagner <luke@mozilla.com>
Thu, 24 Oct 2013 08:59:59 -0500
changeset 151968 6d4ff510c117
parent 151967 42f131becd2f
child 151969 dc598f50a09a
push id25514
push usercbook@mozilla.com
push dateFri, 25 Oct 2013 08:12:42 +0000
treeherdermozilla-central@186e834d87dc [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink
bugs929786
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 929786 - Add shell function to neutering (r=sfink)
js/src/builtin/TestingFunctions.cpp
js/src/jit-test/tests/basic/testNeutering.js
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -1313,16 +1313,34 @@ Deserialize(JSContext *cx, unsigned argc
     args.rval().set(deserialized);
 
     if (hasTransferable)
         obj->discard();
 
     return true;
 }
 
+static bool
+Neuter(JSContext *cx, unsigned argc, jsval *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    RootedObject obj(cx);
+    if (!JS_ValueToObject(cx, args.get(0), &obj))
+        return false;
+
+    void *contents;
+    uint8_t *data;
+    if (!JS_StealArrayBufferContents(cx, obj, &contents, &data))
+        return false;
+
+    js_free(contents);
+    return true;
+}
+
 static const JSFunctionSpecWithHelp TestingFunctions[] = {
     JS_FN_HELP("gc", ::GC, 0, 0,
 "gc([obj] | 'compartment')",
 "  Run the garbage collector. When obj is given, GC only its compartment.\n"
 "  If 'compartment' is given, GC any compartments that were scheduled for\n"
 "  GC via schedulegc."),
 
     JS_FN_HELP("minorgc", ::MinorGC, 0, 0,
@@ -1527,16 +1545,20 @@ static const JSFunctionSpecWithHelp Test
 "serialize(data, [transferables])",
 "  Serialize 'data' using JS_WriteStructuredClone. Returns a structured\n"
 "  clone buffer object."),
 
     JS_FN_HELP("deserialize", Deserialize, 1, 0,
 "deserialize(clonebuffer)",
 "  Deserialize data generated by serialize."),
 
+    JS_FN_HELP("neuter", Neuter, 1, 0,
+"neuter(buffer)",
+"  Neuter the given ArrayBuffer object as if it had been transferred to a WebWorker."),
+
     JS_FS_HELP_END
 };
 
 bool
 js::DefineTestingFunctions(JSContext *cx, HandleObject obj, bool fuzzingSafe_)
 {
     fuzzingSafe = fuzzingSafe_;
     if (getenv("MOZ_FUZZING_SAFE") && getenv("MOZ_FUZZING_SAFE")[0] != '0')
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testNeutering.js
@@ -0,0 +1,23 @@
+var ab = new ArrayBuffer(4);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);
+
+var ab = new ArrayBuffer(12);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);
+
+var ab = new ArrayBuffer(4096);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);