Skip to content

V
V8
Commit e1bbd267 authored by jkummerow@chromium.org's avatar jkummerow@chromium.org
Browse files
Options

Refactor mjsunit/fuzz-natives-* into a separate test suite. 

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/252143002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21190 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
parent 066955e4
Hide whitespace changes
Inline Side-by-side
Showing with 197 additions and 661 deletions
test/mjsunit/fuzz-natives-part4.js → test/fuzz-natives/base.js
View file @ e1bbd267
// Copyright 2011 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
// TODO(jkummerow): There are many ways to improve these tests, e.g.:
// - more variance in randomized inputs
// - better time complexity management
// - better code readability and documentation of intentions.
var RUN_WITH_ALL_ARGUMENT_ENTRIES = false;
var kOnManyArgumentsRemove = 5;
......@@ -54,7 +34,8 @@ function makeFunction(name, argc) {
for (var i = 0; i < argc; i++)
args.push("x" + i);
var argsStr = args.join(", ");
return new Function(args.join(", "), "return %" + name + "(" + argsStr + ");");
return new Function(argsStr,
"return %" + name + "(" + argsStr + ");");
}
function testArgumentCount(name, argc) {
......@@ -88,15 +69,15 @@ function testArgumentTypes(name, argc) {
// When we have 5 or more arguments we lower the amount of tests cases
// by randomly removing kOnManyArgumentsRemove entries
var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ?
kArgObjects : kArgObjects-kOnManyArgumentsRemove;
if (argc >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) {
kArgObjects : kArgObjects - kOnManyArgumentsRemove;
if (kArgObjects >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) {
for (var i = 0; i < kOnManyArgumentsRemove; i++) {
var rand = Math.floor(Math.random() * (kArgObjects - i));
argPool.splice(rand,1);
argPool.splice(rand, 1);
}
}
var current = type;
var hasMore = false;
hasMore = false;
var argList = [ ];
for (var i = 0; i < argc; i++) {
var index = current % numArguments;
......@@ -114,103 +95,5 @@ function testArgumentTypes(name, argc) {
}
}
var knownProblems = {
"Abort": true,
// Avoid calling the concat operation, because weird lengths
// may lead to out-of-memory. Ditto for StringBuilderJoin.
"StringBuilderConcat": true,
"StringBuilderJoin": true,
// These functions use pseudo-stack-pointers and are not robust
// to unexpected integer values.
"DebugEvaluate": true,
// These functions do nontrivial error checking in recursive calls,
// which means that we have to propagate errors back.
"SetFunctionBreakPoint": true,
"SetScriptBreakPoint": true,
"PrepareStep": true,
// Too slow.
"DebugReferencedBy": true,
// Calling disable/enable access checks may interfere with the
// the rest of the tests.
"DisableAccessChecks": true,
"EnableAccessChecks": true,
// IS_VAR is special.
"IS_VAR": true,
// Vararg with minimum number > 0.
"Call": true,
"SetAllocationTimeout": true,
// Requires integer arguments to be non-negative.
"Apply": true,
// That can only be invoked on Array.prototype.
"FinishArrayPrototypeSetup": true,
"_SwapElements": true,
// Performance critical functions which cannot afford type checks.
"_IsNativeOrStrictMode": true,
"_CallFunction": true,
// Tries to allocate based on argument, and (correctly) throws
// out-of-memory if the request is too large. In practice, the
// size will be the number of captures of a RegExp.
"RegExpConstructResult": true,
"_RegExpConstructResult": true,
// This functions perform some checks compile time (they require one of their
// arguments to be a compile time smi).
"_DateField": true,
"_GetFromCache": true,
// This function expects its first argument to be a non-smi.
"_IsStringWrapperSafeForDefaultValueOf" : true,
// Only applicable to strings.
"_HasCachedArrayIndex": true,
"_GetCachedArrayIndex": true,
"_OneByteSeqStringSetChar": true,
"_TwoByteSeqStringSetChar": true,
// Only applicable to TypedArrays.
"_TypedArrayInitialize": true,
// Only applicable to generators.
"_GeneratorNext": true,
"_GeneratorThrow": true,
// Only applicable to DataViews.
"_DataViewInitialize": true,
};
var currentlyUncallable = {
// We need to find a way to test this without breaking the system.
"SystemBreak": true,
// Inserts an int3/stop instruction when run with --always-opt.
"_DebugBreakInOptimizedCode": true
};
function testNatives() {
var allNatives = %ListNatives();
var start = (allNatives.length >> 2)*3;
var stop = allNatives.length;
for (var i = start; i < stop; i++) {
var nativeInfo = allNatives[i];
var name = nativeInfo[0];
if (name in knownProblems || name in currentlyUncallable)
continue;
print(name);
var argc = nativeInfo[1];
testArgumentCount(name, argc);
testArgumentTypes(name, argc);
}
}
testNatives();
testArgumentCount(NAME, ARGC);
testArgumentTypes(NAME, ARGC);
test/fuzz-natives/fuzz-natives.status 0 → 100644
View file @ e1bbd267
# Copyright 2014 the V8 project authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
[
[ALWAYS, {
# These are designed to crash:
"Abort": [SKIP],
"AbortJS": [SKIP],
"SystemBreak": [SKIP],
"_DebugBreakInOptimizedCode": [SKIP],
# varargs.
"Call": [SKIP],
"_CallFunction": [SKIP],
# Implemented in the parser, not callable.
"IS_VAR": [SKIP],
# Compile-time ASSERTs.
"_DateField": [SKIP],
"_GetFromCache": [SKIP],
# Riddled with ASSERTs.
"CompileForOnStackReplacement": [SKIP],
# Too slow for fuzzing.
"SetAllocationTimeout": [SKIP],
# TODO(jkummerow): Fix these and un-blacklist them!
"CreateDateTimeFormat": [SKIP],
"CreateNumberFormat": [SKIP],
# TODO(jkummerow): Figure out what to do about inlined functions.
"_GeneratorNext": [SKIP],
"_GeneratorThrow": [SKIP],
"_GetCachedArrayIndex": [SKIP],
"_HasCachedArrayIndex": [SKIP],
"_IsStringWrapperSafeForDefaultValueOf": [SKIP],
"_OneByteSeqStringSetChar": [SKIP],
"_RegExpConstructResult": [SKIP],
"_TwoByteSeqStringSetChar": [SKIP],
# These are slow.
"DebugEvaluate": [PASS, SLOW],
"DebugReferencedBy": [PASS, SLOW],
"SetAccessorProperty": [PASS, SLOW],
"SetScopeVariableValue": [PASS, SLOW],
}] # ALWAYS
]
test/fuzz-natives/testcfg.py 0 → 100644
View file @ e1bbd267
# Copyright 2014 the V8 project authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
import os
from testrunner.local import commands
from testrunner.local import testsuite
from testrunner.local import utils
from testrunner.objects import testcase
class FuzzNativesTestSuite(testsuite.TestSuite):
def __init__(self, name, root):
super(FuzzNativesTestSuite, self).__init__(name, root)
def ListTests(self, context):
shell = os.path.abspath(os.path.join(context.shell_dir, self.shell()))
if utils.IsWindows():
shell += ".exe"
output = commands.Execute(
context.command_prefix +
[shell, "--allow-natives-syntax", "-e",
"try { var natives = %ListNatives();"
" for (var n in natives) { print(natives[n]); }"
"} catch(e) {}"] +
context.extra_flags)
if output.exit_code != 0:
print output.stdout
print output.stderr
assert false, "Failed to get natives list."
tests = []
for line in output.stdout.strip().split():
(name, argc) = line.split(",")
flags = ["--allow-natives-syntax",
"-e", "var NAME = '%s', ARGC = %s;" % (name, argc)]
test = testcase.TestCase(self, name, flags)
tests.append(test)
return tests
def GetFlagsForTestCase(self, testcase, context):
name = testcase.path
basefile = os.path.join(self.root, "base.js")
return testcase.flags + [basefile] + context.mode_flags
def GetSuite(name, root):
return FuzzNativesTestSuite(name, root)
test/mjsunit/fuzz-natives-part1.js deleted 100644 → 0
View file @ 066955e4
// Copyright 2011 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --allow-natives-syntax
var RUN_WITH_ALL_ARGUMENT_ENTRIES = false;
var kOnManyArgumentsRemove = 5;
function makeArguments() {
var result = [ ];
result.push(17);
result.push(-31);
result.push(new Array(100));
result.push(new Array(100003));
result.push(Number.MIN_VALUE);
result.push("whoops");
result.push("x");
result.push({"x": 1, "y": 2});
var slowCaseObj = {"a": 3, "b": 4, "c": 5};
delete slowCaseObj.c;
result.push(slowCaseObj);
result.push(function () { return 8; });
return result;
}
var kArgObjects = makeArguments().length;
function makeFunction(name, argc) {
var args = [];
for (var i = 0; i < argc; i++)
args.push("x" + i);
var argsStr = args.join(", ");
return new Function(args.join(", "), "return %" + name + "(" + argsStr + ");");
}
function testArgumentCount(name, argc) {
for (var i = 0; i < 10; i++) {
var func = null;
try {
func = makeFunction(name, i);
} catch (e) {
if (e != "SyntaxError: Illegal access") throw e;
}
if (func === null && i == argc) {
throw "unexpected exception";
}
var args = [ ];
for (var j = 0; j < i; j++)
args.push(0);
try {
func.apply(void 0, args);
} catch (e) {
// we don't care what happens as long as we don't crash
}
}
}
function testArgumentTypes(name, argc) {
var type = 0;
var hasMore = true;
var func = makeFunction(name, argc);
while (hasMore) {
var argPool = makeArguments();
// When we have 5 or more arguments we lower the amount of tests cases
// by randomly removing kOnManyArgumentsRemove entries
var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ?
kArgObjects : kArgObjects-kOnManyArgumentsRemove;
if (argc >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) {
for (var i = 0; i < kOnManyArgumentsRemove; i++) {
var rand = Math.floor(Math.random() * (kArgObjects - i));
argPool.splice(rand,1);
}
}
var current = type;
var hasMore = false;
var argList = [ ];
for (var i = 0; i < argc; i++) {
var index = current % numArguments;
current = (current / numArguments) << 0;
if (index != (numArguments - 1))
hasMore = true;
argList.push(argPool[index]);
}
try {
func.apply(void 0, argList);
} catch (e) {
// we don't care what happens as long as we don't crash
}
type++;
}
}
var knownProblems = {
"Abort": true,
// Avoid calling the concat operation, because weird lengths
// may lead to out-of-memory. Ditto for StringBuilderJoin.
"StringBuilderConcat": true,
"StringBuilderJoin": true,
// These functions use pseudo-stack-pointers and are not robust
// to unexpected integer values.
"DebugEvaluate": true,
// These functions do nontrivial error checking in recursive calls,
// which means that we have to propagate errors back.
"SetFunctionBreakPoint": true,
"SetScriptBreakPoint": true,
"PrepareStep": true,
// Too slow.
"DebugReferencedBy": true,
// Calling disable/enable access checks may interfere with the
// the rest of the tests.
"DisableAccessChecks": true,
"EnableAccessChecks": true,
// IS_VAR is special.
"IS_VAR": true,
// Vararg with minimum number > 0.
"Call": true,
"SetAllocationTimeout": true,
// Requires integer arguments to be non-negative.
"Apply": true,
// That can only be invoked on Array.prototype.
"FinishArrayPrototypeSetup": true,
"_SwapElements": true,
// Performance critical functions which cannot afford type checks.
"_IsNativeOrStrictMode": true,
"_CallFunction": true,
// Tries to allocate based on argument, and (correctly) throws
// out-of-memory if the request is too large. In practice, the
// size will be the number of captures of a RegExp.
"RegExpConstructResult": true,
"_RegExpConstructResult": true,
// This functions perform some checks compile time (they require one of their
// arguments to be a compile time smi).
"_DateField": true,
"_GetFromCache": true,
// This function expects its first argument to be a non-smi.
"_IsStringWrapperSafeForDefaultValueOf" : true,
// Only applicable to strings.
"_HasCachedArrayIndex": true,
"_GetCachedArrayIndex": true,
"_OneByteSeqStringSetChar": true,
"_TwoByteSeqStringSetChar": true,
// Only applicable to TypedArrays.
"_TypedArrayInitialize": true,
// Only applicable to loading mutable doubles.
"LoadMutableDouble": true,
// Only applicable to generators.
"_GeneratorNext": true,
"_GeneratorThrow": true,
// Only applicable to DataViews.
"_DataViewInitialize": true,
};
var currentlyUncallable = {
// We need to find a way to test this without breaking the system.
"SystemBreak": true,
// Inserts an int3/stop instruction when run with --always-opt.
"_DebugBreakInOptimizedCode": true
};
function testNatives() {
var allNatives = %ListNatives();
var start = 0;
var stop = (allNatives.length >> 2);
for (var i = start; i < stop; i++) {
var nativeInfo = allNatives[i];
var name = nativeInfo[0];
if (name in knownProblems || name in currentlyUncallable)
continue;
print(name);
var argc = nativeInfo[1];
testArgumentCount(name, argc);
testArgumentTypes(name, argc);
}
}
testNatives();
test/mjsunit/fuzz-natives-part2.js deleted 100644 → 0
View file @ 066955e4
// Copyright 2011 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --allow-natives-syntax
var RUN_WITH_ALL_ARGUMENT_ENTRIES = false;
var kOnManyArgumentsRemove = 5;
function makeArguments() {
var result = [ ];
result.push(17);
result.push(-31);
result.push(new Array(100));
result.push(new Array(100003));
result.push(Number.MIN_VALUE);
result.push("whoops");
result.push("x");
result.push({"x": 1, "y": 2});
var slowCaseObj = {"a": 3, "b": 4, "c": 5};
delete slowCaseObj.c;
result.push(slowCaseObj);
result.push(function () { return 8; });
return result;
}
var kArgObjects = makeArguments().length;
function makeFunction(name, argc) {
var args = [];
for (var i = 0; i < argc; i++)
args.push("x" + i);
var argsStr = args.join(", ");
return new Function(args.join(", "), "return %" + name + "(" + argsStr + ");");
}
function testArgumentCount(name, argc) {
for (var i = 0; i < 10; i++) {
var func = null;
try {
func = makeFunction(name, i);
} catch (e) {
if (e != "SyntaxError: Illegal access") throw e;
}
if (func === null && i == argc) {
throw "unexpected exception";
}
var args = [ ];
for (var j = 0; j < i; j++)
args.push(0);
try {
func.apply(void 0, args);
} catch (e) {
// we don't care what happens as long as we don't crash
}
}
}
function testArgumentTypes(name, argc) {
var type = 0;
var hasMore = true;
var func = makeFunction(name, argc);
while (hasMore) {
var argPool = makeArguments();
// When we have 5 or more arguments we lower the amount of tests cases
// by randomly removing kOnManyArgumentsRemove entries
var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ?
kArgObjects : kArgObjects-kOnManyArgumentsRemove;
if (argc >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) {
for (var i = 0; i < kOnManyArgumentsRemove; i++) {
var rand = Math.floor(Math.random() * (kArgObjects - i));
argPool.splice(rand,1);
}
}
var current = type;
var hasMore = false;
var argList = [ ];
for (var i = 0; i < argc; i++) {
var index = current % numArguments;
current = (current / numArguments) << 0;
if (index != (numArguments - 1))
hasMore = true;
argList.push(argPool[index]);
}
try {
func.apply(void 0, argList);
} catch (e) {
// we don't care what happens as long as we don't crash
}
type++;
}
}
var knownProblems = {
"Abort": true,
// Avoid calling the concat operation, because weird lengths
// may lead to out-of-memory. Ditto for StringBuilderJoin.
"StringBuilderConcat": true,
"StringBuilderJoin": true,
// These functions use pseudo-stack-pointers and are not robust
// to unexpected integer values.
"DebugEvaluate": true,
// These functions do nontrivial error checking in recursive calls,
// which means that we have to propagate errors back.
"SetFunctionBreakPoint": true,
"SetScriptBreakPoint": true,
"PrepareStep": true,
// Too slow.
"DebugReferencedBy": true,
// Calling disable/enable access checks may interfere with the
// the rest of the tests.
"DisableAccessChecks": true,
"EnableAccessChecks": true,
// IS_VAR is special.
"IS_VAR": true,
// Vararg with minimum number > 0.
"Call": true,
"SetAllocationTimeout": true,
// Requires integer arguments to be non-negative.
"Apply": true,
// That can only be invoked on Array.prototype.
"FinishArrayPrototypeSetup": true,
"_SwapElements": true,
// Performance critical functions which cannot afford type checks.
"_IsNativeOrStrictMode": true,
"_CallFunction": true,
// Tries to allocate based on argument, and (correctly) throws
// out-of-memory if the request is too large. In practice, the
// size will be the number of captures of a RegExp.
"RegExpConstructResult": true,
"_RegExpConstructResult": true,
// This functions perform some checks compile time (they require one of their
// arguments to be a compile time smi).
"_DateField": true,
"_GetFromCache": true,
// This function expects its first argument to be a non-smi.
"_IsStringWrapperSafeForDefaultValueOf" : true,
// Only applicable to strings.
"_HasCachedArrayIndex": true,
"_GetCachedArrayIndex": true,
"_OneByteSeqStringSetChar": true,
"_TwoByteSeqStringSetChar": true,
// Only applicable to TypedArrays.
"_TypedArrayInitialize": true,
// Only applicable to generators.
"_GeneratorNext": true,
"_GeneratorThrow": true,
// Only applicable to DataViews.
"_DataViewInitialize": true,
};
var currentlyUncallable = {
// We need to find a way to test this without breaking the system.
"SystemBreak": true,
// Inserts an int3/stop instruction when run with --always-opt.
"_DebugBreakInOptimizedCode": true
};
function testNatives() {
var allNatives = %ListNatives();
var start = allNatives.length >> 2;
var stop = (allNatives.length >> 2)*2;
for (var i = start; i < stop; i++) {
var nativeInfo = allNatives[i];
var name = nativeInfo[0];
if (name in knownProblems || name in currentlyUncallable)
continue;
print(name);
var argc = nativeInfo[1];
testArgumentCount(name, argc);
testArgumentTypes(name, argc);
}
}
testNatives();
test/mjsunit/fuzz-natives-part3.js deleted 100644 → 0
View file @ 066955e4
// Copyright 2011 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --allow-natives-syntax
var RUN_WITH_ALL_ARGUMENT_ENTRIES = false;
var kOnManyArgumentsRemove = 5;
function makeArguments() {
var result = [ ];
result.push(17);
result.push(-31);
result.push(new Array(100));
result.push(new Array(100003));
result.push(Number.MIN_VALUE);
result.push("whoops");
result.push("x");
result.push({"x": 1, "y": 2});
var slowCaseObj = {"a": 3, "b": 4, "c": 5};
delete slowCaseObj.c;
result.push(slowCaseObj);
result.push(function () { return 8; });
return result;
}
var kArgObjects = makeArguments().length;
function makeFunction(name, argc) {
var args = [];
for (var i = 0; i < argc; i++)
args.push("x" + i);
var argsStr = args.join(", ");
return new Function(args.join(", "), "return %" + name + "(" + argsStr + ");");
}
function testArgumentCount(name, argc) {
for (var i = 0; i < 10; i++) {
var func = null;
try {
func = makeFunction(name, i);
} catch (e) {
if (e != "SyntaxError: Illegal access") throw e;
}
if (func === null && i == argc) {
throw "unexpected exception";
}
var args = [ ];
for (var j = 0; j < i; j++)
args.push(0);
try {
func.apply(void 0, args);
} catch (e) {
// we don't care what happens as long as we don't crash
}
}
}
function testArgumentTypes(name, argc) {
var type = 0;
var hasMore = true;
var func = makeFunction(name, argc);
while (hasMore) {
var argPool = makeArguments();
// When we have 5 or more arguments we lower the amount of tests cases
// by randomly removing kOnManyArgumentsRemove entries
var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ?
kArgObjects : kArgObjects-kOnManyArgumentsRemove;
if (argc >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) {
for (var i = 0; i < kOnManyArgumentsRemove; i++) {
var rand = Math.floor(Math.random() * (kArgObjects - i));
argPool.splice(rand,1);
}
}
var current = type;
var hasMore = false;
var argList = [ ];
for (var i = 0; i < argc; i++) {
var index = current % numArguments;
current = (current / numArguments) << 0;
if (index != (numArguments - 1))
hasMore = true;
argList.push(argPool[index]);
}
try {
func.apply(void 0, argList);
} catch (e) {
// we don't care what happens as long as we don't crash
}
type++;
}
}
var knownProblems = {
"Abort": true,
// Avoid calling the concat operation, because weird lengths
// may lead to out-of-memory. Ditto for StringBuilderJoin.
"StringBuilderConcat": true,
"StringBuilderJoin": true,
// These functions use pseudo-stack-pointers and are not robust
// to unexpected integer values.
"DebugEvaluate": true,
// These functions do nontrivial error checking in recursive calls,
// which means that we have to propagate errors back.
"SetFunctionBreakPoint": true,
"SetScriptBreakPoint": true,
"PrepareStep": true,
// Too slow.
"DebugReferencedBy": true,
// Calling disable/enable access checks may interfere with the
// the rest of the tests.
"DisableAccessChecks": true,
"EnableAccessChecks": true,
// IS_VAR is special.
"IS_VAR": true,
// Vararg with minimum number > 0.
"Call": true,
"SetAllocationTimeout": true,
// Requires integer arguments to be non-negative.
"Apply": true,
// That can only be invoked on Array.prototype.
"FinishArrayPrototypeSetup": true,
"_SwapElements": true,
// Performance critical functions which cannot afford type checks.
"_IsNativeOrStrictMode": true,
"_CallFunction": true,
// Tries to allocate based on argument, and (correctly) throws
// out-of-memory if the request is too large. In practice, the
// size will be the number of captures of a RegExp.
"RegExpConstructResult": true,
"_RegExpConstructResult": true,
// This functions perform some checks compile time (they require one of their
// arguments to be a compile time smi).
"_DateField": true,
"_GetFromCache": true,
// This function expects its first argument to be a non-smi.
"_IsStringWrapperSafeForDefaultValueOf" : true,
// Only applicable to strings.
"_HasCachedArrayIndex": true,
"_GetCachedArrayIndex": true,
"_OneByteSeqStringSetChar": true,
"_TwoByteSeqStringSetChar": true,
// Only applicable to TypedArrays.
"_TypedArrayInitialize": true,
// Only applicable to generators.
"_GeneratorNext": true,
"_GeneratorThrow": true,
// Only applicable to DataViews.
"_DataViewInitialize": true,
};
var currentlyUncallable = {
// We need to find a way to test this without breaking the system.
"SystemBreak": true,
// Inserts an int3/stop instruction when run with --always-opt.
"_DebugBreakInOptimizedCode": true
};
function testNatives() {
var allNatives = %ListNatives();
var start = (allNatives.length >> 2)*2;
var stop = (allNatives.length >> 2)*3;
for (var i = start; i < stop; i++) {
var nativeInfo = allNatives[i];
var name = nativeInfo[0];
if (name in knownProblems || name in currentlyUncallable)
continue;
print(name);
var argc = nativeInfo[1];
testArgumentCount(name, argc);
testArgumentTypes(name, argc);
}
}
testNatives();
test/mjsunit/mjsunit.status
View file @ e1bbd267
......@@ -68,10 +68,6 @@
'd8-performance-now': [PASS, NO_VARIANTS],
##############################################################################
# These use a built-in that's only present in debug mode. They take
# too long to run in debug mode on ARM and MIPS.
'fuzz-natives-part*': [PASS, ['mode == release or arch == arm or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips', SKIP]],
'big-object-literal': [PASS, ['arch == arm or arch == android_arm or arch == android_arm64', SKIP]],
# Issue 488: this test sometimes times out.
......@@ -351,11 +347,6 @@
'debug-liveedit-restart-frame': [SKIP],
'debug-liveedit-double-call': [SKIP],
# This test dumps core for arm.debug, so no reason to expect it to work
# for NaCl. The other three fuzz-natives tests seem to run fine.
# As noted above none of them are run in the arm.debug case.
'fuzz-natives-part4': [SKIP],
# NaCl builds have problems with this test since Pepper_28.
# V8 Issue 2786
'math-exp-precision': [SKIP],
......
tools/run-tests.py
View file @ e1bbd267
......@@ -50,7 +50,7 @@ from testrunner.objects import context
ARCH_GUESS = utils.DefaultArch()
DEFAULT_TESTS = ["mjsunit", "cctest", "message", "preparser"]
DEFAULT_TESTS = ["mjsunit", "fuzz-natives", "cctest", "message", "preparser"]
TIMEOUT_DEFAULT = 60
TIMEOUT_SCALEFACTOR = {"debug" : 4,
"release" : 1 }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment