Add shell function to test neutering

RESOLVED FIXED in mozilla27

Status

()

defect
RESOLVED FIXED
6 years ago
4 years ago

People

(Reporter: luke, Assigned: luke)

Tracking

unspecified
mozilla27
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

6 years ago
Posted patch add-neuterSplinter Review
A neuter() function that just calls JS_StealArrayBufferContents() and immediately free()s the results should allow easily testing many neutering corner cases without requiring a full-blown way to simulate transferring an ArrayBuffer between workers.
Attachment #820688 - Flags: review?(sphink)
(Assignee)

Updated

6 years ago
Blocks: 925233
Comment on attachment 820688 [details] [diff] [review]
add-neuter

Review of attachment 820688 [details] [diff] [review]:
-----------------------------------------------------------------

WFM! Thanks!

::: js/src/builtin/TestingFunctions.cpp
@@ +1315,5 @@
>  "  (asm.js) programs."),
>  
> +    JS_FN_HELP("neuter", Neuter, 1, 0,
> +"neuter(buffer)",
> +"  Neuter the given ArrayBuffer object as if it had been transfered to a WebWorker."),

*transferred

::: js/src/jit-test/tests/basic/testNeutering.js
@@ +3,5 @@
> +i32[0] = 42;
> +neuter(ab);
> +assertEq(i32.length, 0);
> +assertEq(ab.byteLength, 0);
> +assertEq(i32[0], undefined);

While you're at it, can you test all 3 of (1) short inline buffer, (2) larger buffer, and (3) asm.js buffer?
Attachment #820688 - Flags: review?(sphink) → review+
(Assignee)

Comment 2

6 years ago
(In reply to Steve Fink [:sfink] from comment #1)
> While you're at it, can you test all 3 of (1) short inline buffer, (2)
> larger buffer, and (3) asm.js buffer?

A rather involved test for (3) is coming in bug 925233, but I'll add the other 2.
Can't you already do this with serialize?

   serialize(ta, [ta.buffer])
(In reply to Jason Orendorff [:jorendorff] from comment #3)
> Can't you already do this with serialize?
> 
>    serialize(ta, [ta.buffer])

You can, but it's sort of messy. You have more objects around (eg the temporary transferable array) that have references to the neutered array buffer, and there's a lot more going on that could make failures more cryptic.

  serialize(buffer, [buffer])

is a bit simpler, since you don't have a typed array and the bizarre ways that typed array <-> buffer references interact (eg the buffer has a weak ref to the typed array). But it still goes through structured clone, and it'd be nice to have a targeted neutering operation that isolates only that.
(Assignee)

Comment 6

6 years ago
Oops, JS_ValueToObject can return null:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c24460e2b77d
https://hg.mozilla.org/mozilla-central/rev/6d4ff510c117
https://hg.mozilla.org/mozilla-central/rev/c24460e2b77d
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
(Assignee)

Updated

6 years ago
Duplicate of this bug: 854603
Depends on: 936013
Duplicate of this bug: 893863
You need to log in before you can comment on or make changes to this bug.