Chromium Code Reviews| Index: test/fuzz-natives/base.js |
| diff --git a/test/fuzz-natives/base.js b/test/fuzz-natives/base.js |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..ee2fbd4a8eac457695e9ee0fa5be9afb48cb69d5 |
| --- /dev/null |
| +++ b/test/fuzz-natives/base.js |
| @@ -0,0 +1,94 @@ |
| +// Copyright 2014 the V8 project authors. All rights reserved. |
| +// Use of this source code is governed by a BSD-style license that can be |
| +// found in the LICENSE file. |
| + |
| +var RUN_WITH_ALL_ARGUMENT_ENTRIES = false; |
| +var kOnManyArgumentsRemove = 5; |
| + |
| +function makeArguments() { |
| + var result = [ ]; |
| + result.push(17); |
| + result.push(-31); |
| + result.push(new Array(100)); |
| + result.push(new Array(100003)); |
| + result.push(Number.MIN_VALUE); |
| + result.push("whoops"); |
| + result.push("x"); |
| + result.push({"x": 1, "y": 2}); |
| + var slowCaseObj = {"a": 3, "b": 4, "c": 5}; |
| + delete slowCaseObj.c; |
| + result.push(slowCaseObj); |
| + result.push(function () { return 8; }); |
| + return result; |
| +} |
| + |
| +var kArgObjects = makeArguments().length; |
| + |
| +function makeFunction(name, argc) { |
| + var args = []; |
| + for (var i = 0; i < argc; i++) |
| + args.push("x" + i); |
| + var argsStr = args.join(", "); |
| + return new Function(args.join(", "), |
|
Michael Achenbach
2014/04/29 15:51:53
args.join(", ") == argsStr
Jakob Kummerow
2014/04/30 13:46:12
Done.
|
| + "return %" + name + "(" + argsStr + ");"); |
| +} |
| + |
| +function testArgumentCount(name, argc) { |
| + for (var i = 0; i < 10; i++) { |
|
Michael Achenbach
2014/04/29 15:51:53
Should we not better just loop until argc + 1?
|
| + var func = null; |
| + try { |
| + func = makeFunction(name, i); |
| + } catch (e) { |
| + if (e != "SyntaxError: Illegal access") throw e; |
| + } |
| + if (func === null && i == argc) { |
| + throw "unexpected exception"; |
|
Michael Achenbach
2014/04/29 15:51:53
Could we not already "continue" in all other cases
|
| + } |
| + var args = [ ]; |
| + for (var j = 0; j < i; j++) |
| + args.push(0); |
| + try { |
| + func.apply(void 0, args); |
| + } catch (e) { |
| + // we don't care what happens as long as we don't crash |
| + } |
| + } |
| +} |
| + |
| +function testArgumentTypes(name, argc) { |
| + var type = 0; |
| + var hasMore = true; |
| + var func = makeFunction(name, argc); |
| + while (hasMore) { |
| + var argPool = makeArguments(); |
| + // When we have 5 or more arguments we lower the amount of tests cases |
|
Michael Achenbach
2014/04/29 15:51:53
...which is always the case.
|
| + // by randomly removing kOnManyArgumentsRemove entries |
|
Michael Achenbach
2014/04/29 15:51:53
Wouldn't it be better to always choose, 5 instead
|
| + var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ? |
| + kArgObjects : kArgObjects-kOnManyArgumentsRemove; |
|
Michael Achenbach
2014/04/29 15:51:53
nit: space around -
Jakob Kummerow
2014/04/30 13:46:12
Done.
|
| + if (kArgObjects >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) { |
| + for (var i = 0; i < kOnManyArgumentsRemove; i++) { |
| + var rand = Math.floor(Math.random() * (kArgObjects - i)); |
|
Michael Achenbach
2014/04/29 15:51:53
Might be easier readable when calling repeatedly a
|
| + argPool.splice(rand,1); |
| + } |
| + } |
| + var current = type; |
| + var hasMore = false; |
|
Michael Achenbach
2014/04/29 15:51:53
var hasMore exists in the outer scope. Remove var?
Jakob Kummerow
2014/04/30 13:46:12
Done.
|
| + var argList = [ ]; |
| + for (var i = 0; i < argc; i++) { |
|
Michael Achenbach
2014/04/29 15:51:53
Maybe add a TODO about improving the complexity, s
|
| + var index = current % numArguments; |
| + current = (current / numArguments) << 0; |
| + if (index != (numArguments - 1)) |
| + hasMore = true; |
| + argList.push(argPool[index]); |
| + } |
| + try { |
| + func.apply(void 0, argList); |
| + } catch (e) { |
| + // we don't care what happens as long as we don't crash |
| + } |
| + type++; |
| + } |
| +} |
| + |
| +testArgumentCount(NAME, ARGC); |
| +testArgumentTypes(NAME, ARGC); |