Bug 991981 - Test for asm.js ArrayBuffer heap neutering during arguments coercion. r=luke
authorJeff Walden <jwalden@mit.edu>
Thu, 01 May 2014 14:30:19 -0700
changeset 234604 541ca516d9ca5ff59e7f710e7d110947a6f005ce
parent 234603 0f8cc6e38a1e0f8e3985d77c3569598ef198a3b7
child 234605 08018668136ea90fd1c126641849cb9c1878288b
push id611
push userraliiev@mozilla.com
push dateMon, 05 Jan 2015 23:23:16 +0000
treeherdermozilla-release@345cd3b9c445 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersluke
bugs991981
milestone35.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 991981 - Test for asm.js ArrayBuffer heap neutering during arguments coercion. r=luke
js/src/jit-test/tests/asm.js/neuter-during-arguments-coercion.js
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/asm.js/neuter-during-arguments-coercion.js
@@ -0,0 +1,27 @@
+load(libdir + "asm.js");
+
+function f(stdlib, foreign, buffer)
+{
+  "use asm";
+  var i32 = new stdlib.Int32Array(buffer);
+  function set(v)
+  {
+    v=v|0;
+    i32[5] = v;
+  }
+  return set;
+}
+if (isAsmJSCompilationAvailable())
+  assertEq(isAsmJSModule(f), true);
+
+var i32 = new Int32Array(4096);
+var buffer = i32.buffer;
+var set = f(this, null, buffer);
+if (isAsmJSCompilationAvailable())
+  assertEq(isAsmJSFunction(set), true);
+
+try
+{
+  set({ valueOf: function() { neuter(buffer, "same-data"); return 17; } });
+}
+catch (e) { /* if an exception thrown, swallow */ }