Index: test/fuzz-natives/base.js |
diff --git a/test/fuzz-natives/base.js b/test/fuzz-natives/base.js |
new file mode 100644 |
index 0000000000000000000000000000000000000000..ee2fbd4a8eac457695e9ee0fa5be9afb48cb69d5 |
--- /dev/null |
+++ b/test/fuzz-natives/base.js |
@@ -0,0 +1,94 @@ |
+// Copyright 2014 the V8 project authors. All rights reserved. |
+// Use of this source code is governed by a BSD-style license that can be |
+// found in the LICENSE file. |
+ |
+var RUN_WITH_ALL_ARGUMENT_ENTRIES = false; |
+var kOnManyArgumentsRemove = 5; |
+ |
+function makeArguments() { |
+ var result = [ ]; |
+ result.push(17); |
+ result.push(-31); |
+ result.push(new Array(100)); |
+ result.push(new Array(100003)); |
+ result.push(Number.MIN_VALUE); |
+ result.push("whoops"); |
+ result.push("x"); |
+ result.push({"x": 1, "y": 2}); |
+ var slowCaseObj = {"a": 3, "b": 4, "c": 5}; |
+ delete slowCaseObj.c; |
+ result.push(slowCaseObj); |
+ result.push(function () { return 8; }); |
+ return result; |
+} |
+ |
+var kArgObjects = makeArguments().length; |
+ |
+function makeFunction(name, argc) { |
+ var args = []; |
+ for (var i = 0; i < argc; i++) |
+ args.push("x" + i); |
+ var argsStr = args.join(", "); |
+ return new Function(args.join(", "), |
Michael Achenbach
2014/04/29 15:51:53
args.join(", ") == argsStr
Jakob Kummerow
2014/04/30 13:46:12
Done.
|
+ "return %" + name + "(" + argsStr + ");"); |
+} |
+ |
+function testArgumentCount(name, argc) { |
+ for (var i = 0; i < 10; i++) { |
Michael Achenbach
2014/04/29 15:51:53
Should we not better just loop until argc + 1?
|
+ var func = null; |
+ try { |
+ func = makeFunction(name, i); |
+ } catch (e) { |
+ if (e != "SyntaxError: Illegal access") throw e; |
+ } |
+ if (func === null && i == argc) { |
+ throw "unexpected exception"; |
Michael Achenbach
2014/04/29 15:51:53
Could we not already "continue" in all other cases
|
+ } |
+ var args = [ ]; |
+ for (var j = 0; j < i; j++) |
+ args.push(0); |
+ try { |
+ func.apply(void 0, args); |
+ } catch (e) { |
+ // we don't care what happens as long as we don't crash |
+ } |
+ } |
+} |
+ |
+function testArgumentTypes(name, argc) { |
+ var type = 0; |
+ var hasMore = true; |
+ var func = makeFunction(name, argc); |
+ while (hasMore) { |
+ var argPool = makeArguments(); |
+ // When we have 5 or more arguments we lower the amount of tests cases |
Michael Achenbach
2014/04/29 15:51:53
...which is always the case.
|
+ // by randomly removing kOnManyArgumentsRemove entries |
Michael Achenbach
2014/04/29 15:51:53
Wouldn't it be better to always choose, 5 instead
|
+ var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ? |
+ kArgObjects : kArgObjects-kOnManyArgumentsRemove; |
Michael Achenbach
2014/04/29 15:51:53
nit: space around -
Jakob Kummerow
2014/04/30 13:46:12
Done.
|
+ if (kArgObjects >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) { |
+ for (var i = 0; i < kOnManyArgumentsRemove; i++) { |
+ var rand = Math.floor(Math.random() * (kArgObjects - i)); |
Michael Achenbach
2014/04/29 15:51:53
Might be easier readable when calling repeatedly a
|
+ argPool.splice(rand,1); |
+ } |
+ } |
+ var current = type; |
+ var hasMore = false; |
Michael Achenbach
2014/04/29 15:51:53
var hasMore exists in the outer scope. Remove var?
Jakob Kummerow
2014/04/30 13:46:12
Done.
|
+ var argList = [ ]; |
+ for (var i = 0; i < argc; i++) { |
Michael Achenbach
2014/04/29 15:51:53
Maybe add a TODO about improving the complexity, s
|
+ var index = current % numArguments; |
+ current = (current / numArguments) << 0; |
+ if (index != (numArguments - 1)) |
+ hasMore = true; |
+ argList.push(argPool[index]); |
+ } |
+ try { |
+ func.apply(void 0, argList); |
+ } catch (e) { |
+ // we don't care what happens as long as we don't crash |
+ } |
+ type++; |
+ } |
+} |
+ |
+testArgumentCount(NAME, ARGC); |
+testArgumentTypes(NAME, ARGC); |