1169271 - Improve code coverage for AtomicsObject.cpp

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[Lars T Hansen [:lth]]

This shows the current coverage:
https://www.tjhsst.edu/~jcranmer/m-ccov/js/src/builtin/AtomicsObject.cpp.html

Coverage is quite low, mainly because:
- some of the atomics callouts for asm.js is not tested, because they are
  only needed for ARMv6
- the futex code is not tested by the current test suite

Additionally:
- error branches (wrong array type, out of bounds) are not exercised

Landing bug 1135026 will help with the futex coverage.  It should also be easy to test the error branches.

The asm.js callouts for ARMv6 can probably only be exercised on other platforms by changing some conditions for their enabling; will need investigating.

Comment 1

[Lars T Hansen [:lth]]

On a related note, in MCallOptimize.cpp there is a lack of coverage for double-precision arguments, and for the wrong number of arguments, when inlining atomics:
https://www.tjhsst.edu/~jcranmer/m-ccov/js/src/jit/MCallOptimize.cpp.html

Comment 2

[Lars T Hansen [:lth]]

In CodeGenerator.cpp (search for "atomic") there are some untaken paths, one in CMPXCHG but more notably there appear to be no test cases that trigger the use of LAtomicTypedArrayElementBinopForEffect.
https://www.tjhsst.edu/~jcranmer/m-ccov/js/src/jit/CodeGenerator.cpp.html

Comment 3

[Lars T Hansen [:lth]]

No test case touches the useRegisterAtStart case in LIRGeneratorX86::visitAsmJSAtomicBinopHeap in https://www.tjhsst.edu/~jcranmer/m-ccov/js/src/jit/x86/Lowering-x86.cpp.html.

Comment 4

[Lars T Hansen [:lth]]

Several lacunae in LIRGeneratorX86Shared::lowerAtomicTypedArrayElementBinop in https://www.tjhsst.edu/~jcranmer/m-ccov/js/src/jit/x86-shared/Lowering-x86-shared.cpp.html, one having to do with uint32 I think and another having to do with operations for effect.