Bug 1122338 - test case. r=gkw
authorLars T Hansen <lhansen@mozilla.com>
Mon, 26 Jan 2015 11:08:50 +0100
changeset 239084 a0db598f71a5b9a2c63430f6cf064f88c247409b
parent 238952 5f52e0321f3c85b9bd37d0ebb635a7b214f3e30c
child 239085 02cac0756bc1042a958248bf9b462620bcf42fad
push id487
push userbcampen@mozilla.com
push dateMon, 26 Jan 2015 23:32:56 +0000
reviewersgkw
bugs1122338
milestone38.0a1
Bug 1122338 - test case. r=gkw
js/src/jit-test/tests/asm.js/bug1122338.js
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/asm.js/bug1122338.js
@@ -0,0 +1,38 @@
+// The bug was that the asm.js linker did not catch that an unshared
+// view was created on a shared buffer.  (Nor did it catch the vice
+// versa case.)  As a consequence the code was not rejected (and run
+// as plain JS) as it should be.  That gave rise to a difference in
+// output.
+
+// Original test
+
+g = (function(stdlib, n, heap) {
+    "use asm";
+    var Float32ArrayView = new stdlib.Float32Array(heap);
+    function f() {
+        return +Float32ArrayView[0]
+    }
+    return f
+})(this, {}, new SharedArrayBuffer(4096));
+assertEq(g(), NaN);
+
+// Additional test: vice versa case.
+
+try {
+    g = (function(stdlib, n, heap) {
+	"use asm";
+	var Float32ArrayView = new stdlib.SharedFloat32Array(heap);
+	function f() {
+            return +Float32ArrayView[0]
+	}
+	return f
+    })(this, {}, new ArrayBuffer(4096));
+    // If the code runs, as it would with the bug present, it must return NaN.
+    assertEq(g(), NaN);
+}
+catch (e) {
+    // If the code throws then that's OK too.  The current (January 2015)
+    // semantics is for the SharedFloat32Array constructor to throw if
+    // handed an ArrayBuffer, but asm.js does not execute that constructor
+    // and before the fix it would not throw.
+}