Bug 991981 - Test for asm.js ArrayBuffer heap neutering during arguments coercion. r=luke
authorJeff Walden <jwalden@mit.edu>
Thu, 01 May 2014 14:30:19 -0700
changeset 210069 541ca516d9ca5ff59e7f710e7d110947a6f005ce
parent 210068 0f8cc6e38a1e0f8e3985d77c3569598ef198a3b7
child 210070 08018668136ea90fd1c126641849cb9c1878288b
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewersluke
bugs991981
milestone35.0a1
Bug 991981 - Test for asm.js ArrayBuffer heap neutering during arguments coercion. r=luke
js/src/jit-test/tests/asm.js/neuter-during-arguments-coercion.js
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/asm.js/neuter-during-arguments-coercion.js
@@ -0,0 +1,27 @@
+load(libdir + "asm.js");
+
+function f(stdlib, foreign, buffer)
+{
+  "use asm";
+  var i32 = new stdlib.Int32Array(buffer);
+  function set(v)
+  {
+    v=v|0;
+    i32[5] = v;
+  }
+  return set;
+}
+if (isAsmJSCompilationAvailable())
+  assertEq(isAsmJSModule(f), true);
+
+var i32 = new Int32Array(4096);
+var buffer = i32.buffer;
+var set = f(this, null, buffer);
+if (isAsmJSCompilationAvailable())
+  assertEq(isAsmJSFunction(set), true);
+
+try
+{
+  set({ valueOf: function() { neuter(buffer, "same-data"); return 17; } });
+}
+catch (e) { /* if an exception thrown, swallow */ }