Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(157)

Side by Side Diff: test/mjsunit/fuzz-natives-part2.js

Issue 11035053: Rollback trunk to bleeding_edge revision 12525 (Closed) Base URL: https://v8.googlecode.com/svn/trunk
Patch Set: Created 8 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « test/mjsunit/fuzz-natives-part1.js ('k') | test/mjsunit/fuzz-natives-part3.js » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
(Empty)
1 // Copyright 2011 the V8 project authors. All rights reserved.
2 // Redistribution and use in source and binary forms, with or without
3 // modification, are permitted provided that the following conditions are
4 // met:
5 //
6 // * Redistributions of source code must retain the above copyright
7 // notice, this list of conditions and the following disclaimer.
8 // * Redistributions in binary form must reproduce the above
9 // copyright notice, this list of conditions and the following
10 // disclaimer in the documentation and/or other materials provided
11 // with the distribution.
12 // * Neither the name of Google Inc. nor the names of its
13 // contributors may be used to endorse or promote products derived
14 // from this software without specific prior written permission.
15 //
16 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
17 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
18 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
19 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
20 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
21 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
22 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
26 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27
28 // Flags: --allow-natives-syntax
29
30 var RUN_WITH_ALL_ARGUMENT_ENTRIES = false;
31 var kOnManyArgumentsRemove = 5;
32
33 function makeArguments() {
34 var result = [ ];
35 result.push(17);
36 result.push(-31);
37 result.push(new Array(100));
38 result.push(new Array(100003));
39 result.push(Number.MIN_VALUE);
40 result.push("whoops");
41 result.push("x");
42 result.push({"x": 1, "y": 2});
43 var slowCaseObj = {"a": 3, "b": 4, "c": 5};
44 delete slowCaseObj.c;
45 result.push(slowCaseObj);
46 result.push(function () { return 8; });
47 return result;
48 }
49
50 var kArgObjects = makeArguments().length;
51
52 function makeFunction(name, argc) {
53 var args = [];
54 for (var i = 0; i < argc; i++)
55 args.push("x" + i);
56 var argsStr = args.join(", ");
57 return new Function(args.join(", "), "return %" + name + "(" + argsStr + ");") ;
58 }
59
60 function testArgumentCount(name, argc) {
61 for (var i = 0; i < 10; i++) {
62 var func = null;
63 try {
64 func = makeFunction(name, i);
65 } catch (e) {
66 if (e != "SyntaxError: Illegal access") throw e;
67 }
68 if (func === null && i == argc) {
69 throw "unexpected exception";
70 }
71 var args = [ ];
72 for (var j = 0; j < i; j++)
73 args.push(0);
74 try {
75 func.apply(void 0, args);
76 } catch (e) {
77 // we don't care what happens as long as we don't crash
78 }
79 }
80 }
81
82 function testArgumentTypes(name, argc) {
83 var type = 0;
84 var hasMore = true;
85 var func = makeFunction(name, argc);
86 while (hasMore) {
87 var argPool = makeArguments();
88 // When we have 5 or more arguments we lower the amount of tests cases
89 // by randomly removing kOnManyArgumentsRemove entries
90 var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ?
91 kArgObjects : kArgObjects-kOnManyArgumentsRemove;
92 if (argc >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) {
93 for (var i = 0; i < kOnManyArgumentsRemove; i++) {
94 var rand = Math.floor(Math.random() * (kArgObjects - i));
95 argPool.splice(rand,1);
96 }
97 }
98 var current = type;
99 var hasMore = false;
100 var argList = [ ];
101 for (var i = 0; i < argc; i++) {
102 var index = current % numArguments;
103 current = (current / numArguments) << 0;
104 if (index != (numArguments - 1))
105 hasMore = true;
106 argList.push(argPool[index]);
107 }
108 try {
109 func.apply(void 0, argList);
110 } catch (e) {
111 // we don't care what happens as long as we don't crash
112 }
113 type++;
114 }
115 }
116
117 var knownProblems = {
118 "Abort": true,
119
120 // Avoid calling the concat operation, because weird lengths
121 // may lead to out-of-memory. Ditto for StringBuilderJoin.
122 "StringBuilderConcat": true,
123 "StringBuilderJoin": true,
124
125 // These functions use pseudo-stack-pointers and are not robust
126 // to unexpected integer values.
127 "DebugEvaluate": true,
128
129 // These functions do nontrivial error checking in recursive calls,
130 // which means that we have to propagate errors back.
131 "SetFunctionBreakPoint": true,
132 "SetScriptBreakPoint": true,
133 "PrepareStep": true,
134
135 // Too slow.
136 "DebugReferencedBy": true,
137
138 // Calling disable/enable access checks may interfere with the
139 // the rest of the tests.
140 "DisableAccessChecks": true,
141 "EnableAccessChecks": true,
142
143 // These functions should not be callable as runtime functions.
144 "NewFunctionContext": true,
145 "NewArgumentsFast": true,
146 "NewStrictArgumentsFast": true,
147 "PushWithContext": true,
148 "PushCatchContext": true,
149 "PushBlockContext": true,
150 "LazyCompile": true,
151 "LazyRecompile": true,
152 "ParallelRecompile": true,
153 "NotifyDeoptimized": true,
154 "NotifyOSR": true,
155 "CreateObjectLiteralBoilerplate": true,
156 "CloneLiteralBoilerplate": true,
157 "CloneShallowLiteralBoilerplate": true,
158 "CreateArrayLiteralBoilerplate": true,
159 "IS_VAR": true,
160 "ResolvePossiblyDirectEval": true,
161 "Log": true,
162 "DeclareGlobals": true,
163
164 "PromoteScheduledException": true,
165 "DeleteHandleScopeExtensions": true,
166
167 // Vararg with minimum number > 0.
168 "Call": true,
169
170 // Requires integer arguments to be non-negative.
171 "Apply": true,
172
173 // That can only be invoked on Array.prototype.
174 "FinishArrayPrototypeSetup": true,
175
176 "_SwapElements": true,
177
178 // Performance critical functions which cannot afford type checks.
179 "_IsNativeOrStrictMode": true,
180 "_CallFunction": true,
181
182 // Tries to allocate based on argument, and (correctly) throws
183 // out-of-memory if the request is too large. In practice, the
184 // size will be the number of captures of a RegExp.
185 "RegExpConstructResult": true,
186 "_RegExpConstructResult": true,
187
188 // This functions perform some checks compile time (they require one of their
189 // arguments to be a compile time smi).
190 "_DateField": true,
191 "_GetFromCache": true,
192
193 // This function expects its first argument to be a non-smi.
194 "_IsStringWrapperSafeForDefaultValueOf" : true,
195
196 // Only applicable to strings.
197 "_HasCachedArrayIndex": true,
198 "_GetCachedArrayIndex": true
199 };
200
201 var currentlyUncallable = {
202 // We need to find a way to test this without breaking the system.
203 "SystemBreak": true
204 };
205
206 function testNatives() {
207 var allNatives = %ListNatives();
208 var start = allNatives.length >> 2;
209 var stop = (allNatives.length >> 2)*2;
210 for (var i = start; i < stop; i++) {
211 var nativeInfo = allNatives[i];
212 var name = nativeInfo[0];
213 if (name in knownProblems || name in currentlyUncallable)
214 continue;
215 print(name);
216 var argc = nativeInfo[1];
217 testArgumentCount(name, argc);
218 testArgumentTypes(name, argc);
219 }
220 }
221
222 testNatives();
OLDNEW
« no previous file with comments | « test/mjsunit/fuzz-natives-part1.js ('k') | test/mjsunit/fuzz-natives-part3.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698