929786 - Add shell function to test neutering

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Luke Wagner [:luke]]

Attachment: add-neuter

A neuter() function that just calls JS_StealArrayBufferContents() and immediately free()s the results should allow easily testing many neutering corner cases without requiring a full-blown way to simulate transferring an ArrayBuffer between workers.

Comment 1

[Steve Fink [:sfink] [:s:]]

Comment on attachment 820688 [details] [diff] [review]
add-neuter

Review of attachment 820688 [details] [diff] [review]:
-----------------------------------------------------------------

WFM! Thanks!

::: js/src/builtin/TestingFunctions.cpp
@@ +1315,5 @@
>  "  (asm.js) programs."),
>  
> +    JS_FN_HELP("neuter", Neuter, 1, 0,
> +"neuter(buffer)",
> +"  Neuter the given ArrayBuffer object as if it had been transfered to a WebWorker."),

*transferred

::: js/src/jit-test/tests/basic/testNeutering.js
@@ +3,5 @@
> +i32[0] = 42;
> +neuter(ab);
> +assertEq(i32.length, 0);
> +assertEq(ab.byteLength, 0);
> +assertEq(i32[0], undefined);

While you're at it, can you test all 3 of (1) short inline buffer, (2) larger buffer, and (3) asm.js buffer?

Comment 2

[Luke Wagner [:luke]]

(In reply to Steve Fink [:sfink] from comment #1)
> While you're at it, can you test all 3 of (1) short inline buffer, (2)
> larger buffer, and (3) asm.js buffer?

A rather involved test for (3) is coming in bug 925233, but I'll add the other 2.

Comment 3

[Jason Orendorff [:jorendorff]]

Can't you already do this with serialize?

   serialize(ta, [ta.buffer])

Comment 4

[Steve Fink [:sfink] [:s:]]

(In reply to Jason Orendorff [:jorendorff] from comment #3)
> Can't you already do this with serialize?
> 
>    serialize(ta, [ta.buffer])

You can, but it's sort of messy. You have more objects around (eg the temporary transferable array) that have references to the neutered array buffer, and there's a lot more going on that could make failures more cryptic.

  serialize(buffer, [buffer])

is a bit simpler, since you don't have a typed array and the bizarre ways that typed array <-> buffer references interact (eg the buffer has a weak ref to the typed array). But it still goes through structured clone, and it'd be nice to have a targeted neutering operation that isolates only that.

Comment 5

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6d4ff510c117

Comment 6

[Luke Wagner [:luke]]

Oops, JS_ValueToObject can return null:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c24460e2b77d

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/6d4ff510c117
https://hg.mozilla.org/mozilla-central/rev/c24460e2b77d