Bug 929786 - Add shell function to neutering (r=sfink)
authorLuke Wagner <luke@mozilla.com>
Thu, 24 Oct 2013 08:59:59 -0500
changeset 165783 6d4ff510c1179135cbda49e3568924bb7b18f0a2
parent 165782 42f131becd2fad742b11b2dab09016e2cfd304a9
child 165784 dc598f50a09a29c7d8999c6988af4a4545c708d3
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink
bugs929786
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 929786 - Add shell function to neutering (r=sfink)
js/src/builtin/TestingFunctions.cpp
js/src/jit-test/tests/basic/testNeutering.js
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -1313,16 +1313,34 @@ Deserialize(JSContext *cx, unsigned argc
     args.rval().set(deserialized);
 
     if (hasTransferable)
         obj->discard();
 
     return true;
 }
 
+static bool
+Neuter(JSContext *cx, unsigned argc, jsval *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    RootedObject obj(cx);
+    if (!JS_ValueToObject(cx, args.get(0), &obj))
+        return false;
+
+    void *contents;
+    uint8_t *data;
+    if (!JS_StealArrayBufferContents(cx, obj, &contents, &data))
+        return false;
+
+    js_free(contents);
+    return true;
+}
+
 static const JSFunctionSpecWithHelp TestingFunctions[] = {
     JS_FN_HELP("gc", ::GC, 0, 0,
 "gc([obj] | 'compartment')",
 "  Run the garbage collector. When obj is given, GC only its compartment.\n"
 "  If 'compartment' is given, GC any compartments that were scheduled for\n"
 "  GC via schedulegc."),
 
     JS_FN_HELP("minorgc", ::MinorGC, 0, 0,
@@ -1527,16 +1545,20 @@ static const JSFunctionSpecWithHelp Test
 "serialize(data, [transferables])",
 "  Serialize 'data' using JS_WriteStructuredClone. Returns a structured\n"
 "  clone buffer object."),
 
     JS_FN_HELP("deserialize", Deserialize, 1, 0,
 "deserialize(clonebuffer)",
 "  Deserialize data generated by serialize."),
 
+    JS_FN_HELP("neuter", Neuter, 1, 0,
+"neuter(buffer)",
+"  Neuter the given ArrayBuffer object as if it had been transferred to a WebWorker."),
+
     JS_FS_HELP_END
 };
 
 bool
 js::DefineTestingFunctions(JSContext *cx, HandleObject obj, bool fuzzingSafe_)
 {
     fuzzingSafe = fuzzingSafe_;
     if (getenv("MOZ_FUZZING_SAFE") && getenv("MOZ_FUZZING_SAFE")[0] != '0')
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testNeutering.js
@@ -0,0 +1,23 @@
+var ab = new ArrayBuffer(4);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);
+
+var ab = new ArrayBuffer(12);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);
+
+var ab = new ArrayBuffer(4096);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);