From e1bbd26794b8171c0f723461a2051298b1cd156a Mon Sep 17 00:00:00 2001 From: "jkummerow@chromium.org" Date: Wed, 7 May 2014 12:31:26 +0000 Subject: [PATCH] Refactor mjsunit/fuzz-natives-* into a separate test suite. R=machenbach@chromium.org Review URL: https://codereview.chromium.org/252143002 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21190 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- test/fuzz-natives/base.js | 99 +++++++++++++++ test/fuzz-natives/fuzz-natives.status | 50 ++++++++ test/fuzz-natives/testcfg.py | 47 ++++++++ test/mjsunit/fuzz-natives-part1.js | 219 ---------------------------------- test/mjsunit/fuzz-natives-part2.js | 216 --------------------------------- test/mjsunit/fuzz-natives-part3.js | 216 --------------------------------- test/mjsunit/fuzz-natives-part4.js | 216 --------------------------------- test/mjsunit/mjsunit.status | 9 -- tools/run-tests.py | 2 +- 9 files changed, 197 insertions(+), 877 deletions(-) create mode 100644 test/fuzz-natives/base.js create mode 100644 test/fuzz-natives/fuzz-natives.status create mode 100644 test/fuzz-natives/testcfg.py delete mode 100644 test/mjsunit/fuzz-natives-part1.js delete mode 100644 test/mjsunit/fuzz-natives-part2.js delete mode 100644 test/mjsunit/fuzz-natives-part3.js delete mode 100644 test/mjsunit/fuzz-natives-part4.js diff --git a/test/fuzz-natives/base.js b/test/fuzz-natives/base.js new file mode 100644 index 0000000..b9f7004 --- /dev/null +++ b/test/fuzz-natives/base.js @@ -0,0 +1,99 @@ +// Copyright 2014 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// TODO(jkummerow): There are many ways to improve these tests, e.g.: +// - more variance in randomized inputs +// - better time complexity management +// - better code readability and documentation of intentions. + +var RUN_WITH_ALL_ARGUMENT_ENTRIES = false; +var kOnManyArgumentsRemove = 5; + +function makeArguments() { + var result = [ ]; + result.push(17); + result.push(-31); + result.push(new Array(100)); + result.push(new Array(100003)); + result.push(Number.MIN_VALUE); + result.push("whoops"); + result.push("x"); + result.push({"x": 1, "y": 2}); + var slowCaseObj = {"a": 3, "b": 4, "c": 5}; + delete slowCaseObj.c; + result.push(slowCaseObj); + result.push(function () { return 8; }); + return result; +} + +var kArgObjects = makeArguments().length; + +function makeFunction(name, argc) { + var args = []; + for (var i = 0; i < argc; i++) + args.push("x" + i); + var argsStr = args.join(", "); + return new Function(argsStr, + "return %" + name + "(" + argsStr + ");"); +} + +function testArgumentCount(name, argc) { + for (var i = 0; i < 10; i++) { + var func = null; + try { + func = makeFunction(name, i); + } catch (e) { + if (e != "SyntaxError: Illegal access") throw e; + } + if (func === null && i == argc) { + throw "unexpected exception"; + } + var args = [ ]; + for (var j = 0; j < i; j++) + args.push(0); + try { + func.apply(void 0, args); + } catch (e) { + // we don't care what happens as long as we don't crash + } + } +} + +function testArgumentTypes(name, argc) { + var type = 0; + var hasMore = true; + var func = makeFunction(name, argc); + while (hasMore) { + var argPool = makeArguments(); + // When we have 5 or more arguments we lower the amount of tests cases + // by randomly removing kOnManyArgumentsRemove entries + var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ? + kArgObjects : kArgObjects - kOnManyArgumentsRemove; + if (kArgObjects >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) { + for (var i = 0; i < kOnManyArgumentsRemove; i++) { + var rand = Math.floor(Math.random() * (kArgObjects - i)); + argPool.splice(rand, 1); + } + } + var current = type; + hasMore = false; + var argList = [ ]; + for (var i = 0; i < argc; i++) { + var index = current % numArguments; + current = (current / numArguments) << 0; + if (index != (numArguments - 1)) + hasMore = true; + argList.push(argPool[index]); + } + try { + func.apply(void 0, argList); + } catch (e) { + // we don't care what happens as long as we don't crash + } + type++; + } +} + +testArgumentCount(NAME, ARGC); +testArgumentTypes(NAME, ARGC); diff --git a/test/fuzz-natives/fuzz-natives.status b/test/fuzz-natives/fuzz-natives.status new file mode 100644 index 0000000..fb3cae9 --- /dev/null +++ b/test/fuzz-natives/fuzz-natives.status @@ -0,0 +1,50 @@ +# Copyright 2014 the V8 project authors. All rights reserved. +# Use of this source code is governed by a BSD-style license that can be +# found in the LICENSE file. + +[ +[ALWAYS, { + # These are designed to crash: + "Abort": [SKIP], + "AbortJS": [SKIP], + "SystemBreak": [SKIP], + "_DebugBreakInOptimizedCode": [SKIP], + + # varargs. + "Call": [SKIP], + "_CallFunction": [SKIP], + + # Implemented in the parser, not callable. + "IS_VAR": [SKIP], + + # Compile-time ASSERTs. + "_DateField": [SKIP], + "_GetFromCache": [SKIP], + + # Riddled with ASSERTs. + "CompileForOnStackReplacement": [SKIP], + + # Too slow for fuzzing. + "SetAllocationTimeout": [SKIP], + + # TODO(jkummerow): Fix these and un-blacklist them! + "CreateDateTimeFormat": [SKIP], + "CreateNumberFormat": [SKIP], + + # TODO(jkummerow): Figure out what to do about inlined functions. + "_GeneratorNext": [SKIP], + "_GeneratorThrow": [SKIP], + "_GetCachedArrayIndex": [SKIP], + "_HasCachedArrayIndex": [SKIP], + "_IsStringWrapperSafeForDefaultValueOf": [SKIP], + "_OneByteSeqStringSetChar": [SKIP], + "_RegExpConstructResult": [SKIP], + "_TwoByteSeqStringSetChar": [SKIP], + + # These are slow. + "DebugEvaluate": [PASS, SLOW], + "DebugReferencedBy": [PASS, SLOW], + "SetAccessorProperty": [PASS, SLOW], + "SetScopeVariableValue": [PASS, SLOW], +}] # ALWAYS +] diff --git a/test/fuzz-natives/testcfg.py b/test/fuzz-natives/testcfg.py new file mode 100644 index 0000000..d8e3f05 --- /dev/null +++ b/test/fuzz-natives/testcfg.py @@ -0,0 +1,47 @@ +# Copyright 2014 the V8 project authors. All rights reserved. +# Use of this source code is governed by a BSD-style license that can be +# found in the LICENSE file. + +import os + +from testrunner.local import commands +from testrunner.local import testsuite +from testrunner.local import utils +from testrunner.objects import testcase + +class FuzzNativesTestSuite(testsuite.TestSuite): + + def __init__(self, name, root): + super(FuzzNativesTestSuite, self).__init__(name, root) + + def ListTests(self, context): + shell = os.path.abspath(os.path.join(context.shell_dir, self.shell())) + if utils.IsWindows(): + shell += ".exe" + output = commands.Execute( + context.command_prefix + + [shell, "--allow-natives-syntax", "-e", + "try { var natives = %ListNatives();" + " for (var n in natives) { print(natives[n]); }" + "} catch(e) {}"] + + context.extra_flags) + if output.exit_code != 0: + print output.stdout + print output.stderr + assert false, "Failed to get natives list." + tests = [] + for line in output.stdout.strip().split(): + (name, argc) = line.split(",") + flags = ["--allow-natives-syntax", + "-e", "var NAME = '%s', ARGC = %s;" % (name, argc)] + test = testcase.TestCase(self, name, flags) + tests.append(test) + return tests + + def GetFlagsForTestCase(self, testcase, context): + name = testcase.path + basefile = os.path.join(self.root, "base.js") + return testcase.flags + [basefile] + context.mode_flags + +def GetSuite(name, root): + return FuzzNativesTestSuite(name, root) diff --git a/test/mjsunit/fuzz-natives-part1.js b/test/mjsunit/fuzz-natives-part1.js deleted file mode 100644 index 2059bb0..0000000 --- a/test/mjsunit/fuzz-natives-part1.js +++ /dev/null @@ -1,219 +0,0 @@ -// Copyright 2011 the V8 project authors. All rights reserved. -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are -// met: -// -// * Redistributions of source code must retain the above copyright -// notice, this list of conditions and the following disclaimer. -// * Redistributions in binary form must reproduce the above -// copyright notice, this list of conditions and the following -// disclaimer in the documentation and/or other materials provided -// with the distribution. -// * Neither the name of Google Inc. nor the names of its -// contributors may be used to endorse or promote products derived -// from this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -// Flags: --allow-natives-syntax - -var RUN_WITH_ALL_ARGUMENT_ENTRIES = false; -var kOnManyArgumentsRemove = 5; - -function makeArguments() { - var result = [ ]; - result.push(17); - result.push(-31); - result.push(new Array(100)); - result.push(new Array(100003)); - result.push(Number.MIN_VALUE); - result.push("whoops"); - result.push("x"); - result.push({"x": 1, "y": 2}); - var slowCaseObj = {"a": 3, "b": 4, "c": 5}; - delete slowCaseObj.c; - result.push(slowCaseObj); - result.push(function () { return 8; }); - return result; -} - -var kArgObjects = makeArguments().length; - -function makeFunction(name, argc) { - var args = []; - for (var i = 0; i < argc; i++) - args.push("x" + i); - var argsStr = args.join(", "); - return new Function(args.join(", "), "return %" + name + "(" + argsStr + ");"); -} - -function testArgumentCount(name, argc) { - for (var i = 0; i < 10; i++) { - var func = null; - try { - func = makeFunction(name, i); - } catch (e) { - if (e != "SyntaxError: Illegal access") throw e; - } - if (func === null && i == argc) { - throw "unexpected exception"; - } - var args = [ ]; - for (var j = 0; j < i; j++) - args.push(0); - try { - func.apply(void 0, args); - } catch (e) { - // we don't care what happens as long as we don't crash - } - } -} - -function testArgumentTypes(name, argc) { - var type = 0; - var hasMore = true; - var func = makeFunction(name, argc); - while (hasMore) { - var argPool = makeArguments(); - // When we have 5 or more arguments we lower the amount of tests cases - // by randomly removing kOnManyArgumentsRemove entries - var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ? - kArgObjects : kArgObjects-kOnManyArgumentsRemove; - if (argc >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) { - for (var i = 0; i < kOnManyArgumentsRemove; i++) { - var rand = Math.floor(Math.random() * (kArgObjects - i)); - argPool.splice(rand,1); - } - } - var current = type; - var hasMore = false; - var argList = [ ]; - for (var i = 0; i < argc; i++) { - var index = current % numArguments; - current = (current / numArguments) << 0; - if (index != (numArguments - 1)) - hasMore = true; - argList.push(argPool[index]); - } - try { - func.apply(void 0, argList); - } catch (e) { - // we don't care what happens as long as we don't crash - } - type++; - } -} - -var knownProblems = { - "Abort": true, - - // Avoid calling the concat operation, because weird lengths - // may lead to out-of-memory. Ditto for StringBuilderJoin. - "StringBuilderConcat": true, - "StringBuilderJoin": true, - - // These functions use pseudo-stack-pointers and are not robust - // to unexpected integer values. - "DebugEvaluate": true, - - // These functions do nontrivial error checking in recursive calls, - // which means that we have to propagate errors back. - "SetFunctionBreakPoint": true, - "SetScriptBreakPoint": true, - "PrepareStep": true, - - // Too slow. - "DebugReferencedBy": true, - - // Calling disable/enable access checks may interfere with the - // the rest of the tests. - "DisableAccessChecks": true, - "EnableAccessChecks": true, - - // IS_VAR is special. - "IS_VAR": true, - - // Vararg with minimum number > 0. - "Call": true, - "SetAllocationTimeout": true, - - // Requires integer arguments to be non-negative. - "Apply": true, - - // That can only be invoked on Array.prototype. - "FinishArrayPrototypeSetup": true, - - "_SwapElements": true, - - // Performance critical functions which cannot afford type checks. - "_IsNativeOrStrictMode": true, - "_CallFunction": true, - - // Tries to allocate based on argument, and (correctly) throws - // out-of-memory if the request is too large. In practice, the - // size will be the number of captures of a RegExp. - "RegExpConstructResult": true, - "_RegExpConstructResult": true, - - // This functions perform some checks compile time (they require one of their - // arguments to be a compile time smi). - "_DateField": true, - "_GetFromCache": true, - - // This function expects its first argument to be a non-smi. - "_IsStringWrapperSafeForDefaultValueOf" : true, - - // Only applicable to strings. - "_HasCachedArrayIndex": true, - "_GetCachedArrayIndex": true, - "_OneByteSeqStringSetChar": true, - "_TwoByteSeqStringSetChar": true, - - // Only applicable to TypedArrays. - "_TypedArrayInitialize": true, - - // Only applicable to loading mutable doubles. - "LoadMutableDouble": true, - - // Only applicable to generators. - "_GeneratorNext": true, - "_GeneratorThrow": true, - - // Only applicable to DataViews. - "_DataViewInitialize": true, -}; - -var currentlyUncallable = { - // We need to find a way to test this without breaking the system. - "SystemBreak": true, - // Inserts an int3/stop instruction when run with --always-opt. - "_DebugBreakInOptimizedCode": true -}; - -function testNatives() { - var allNatives = %ListNatives(); - var start = 0; - var stop = (allNatives.length >> 2); - for (var i = start; i < stop; i++) { - var nativeInfo = allNatives[i]; - var name = nativeInfo[0]; - if (name in knownProblems || name in currentlyUncallable) - continue; - print(name); - var argc = nativeInfo[1]; - testArgumentCount(name, argc); - testArgumentTypes(name, argc); - } -} - -testNatives(); diff --git a/test/mjsunit/fuzz-natives-part2.js b/test/mjsunit/fuzz-natives-part2.js deleted file mode 100644 index 103e132..0000000 --- a/test/mjsunit/fuzz-natives-part2.js +++ /dev/null @@ -1,216 +0,0 @@ -// Copyright 2011 the V8 project authors. All rights reserved. -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are -// met: -// -// * Redistributions of source code must retain the above copyright -// notice, this list of conditions and the following disclaimer. -// * Redistributions in binary form must reproduce the above -// copyright notice, this list of conditions and the following -// disclaimer in the documentation and/or other materials provided -// with the distribution. -// * Neither the name of Google Inc. nor the names of its -// contributors may be used to endorse or promote products derived -// from this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -// Flags: --allow-natives-syntax - -var RUN_WITH_ALL_ARGUMENT_ENTRIES = false; -var kOnManyArgumentsRemove = 5; - -function makeArguments() { - var result = [ ]; - result.push(17); - result.push(-31); - result.push(new Array(100)); - result.push(new Array(100003)); - result.push(Number.MIN_VALUE); - result.push("whoops"); - result.push("x"); - result.push({"x": 1, "y": 2}); - var slowCaseObj = {"a": 3, "b": 4, "c": 5}; - delete slowCaseObj.c; - result.push(slowCaseObj); - result.push(function () { return 8; }); - return result; -} - -var kArgObjects = makeArguments().length; - -function makeFunction(name, argc) { - var args = []; - for (var i = 0; i < argc; i++) - args.push("x" + i); - var argsStr = args.join(", "); - return new Function(args.join(", "), "return %" + name + "(" + argsStr + ");"); -} - -function testArgumentCount(name, argc) { - for (var i = 0; i < 10; i++) { - var func = null; - try { - func = makeFunction(name, i); - } catch (e) { - if (e != "SyntaxError: Illegal access") throw e; - } - if (func === null && i == argc) { - throw "unexpected exception"; - } - var args = [ ]; - for (var j = 0; j < i; j++) - args.push(0); - try { - func.apply(void 0, args); - } catch (e) { - // we don't care what happens as long as we don't crash - } - } -} - -function testArgumentTypes(name, argc) { - var type = 0; - var hasMore = true; - var func = makeFunction(name, argc); - while (hasMore) { - var argPool = makeArguments(); - // When we have 5 or more arguments we lower the amount of tests cases - // by randomly removing kOnManyArgumentsRemove entries - var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ? - kArgObjects : kArgObjects-kOnManyArgumentsRemove; - if (argc >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) { - for (var i = 0; i < kOnManyArgumentsRemove; i++) { - var rand = Math.floor(Math.random() * (kArgObjects - i)); - argPool.splice(rand,1); - } - } - var current = type; - var hasMore = false; - var argList = [ ]; - for (var i = 0; i < argc; i++) { - var index = current % numArguments; - current = (current / numArguments) << 0; - if (index != (numArguments - 1)) - hasMore = true; - argList.push(argPool[index]); - } - try { - func.apply(void 0, argList); - } catch (e) { - // we don't care what happens as long as we don't crash - } - type++; - } -} - -var knownProblems = { - "Abort": true, - - // Avoid calling the concat operation, because weird lengths - // may lead to out-of-memory. Ditto for StringBuilderJoin. - "StringBuilderConcat": true, - "StringBuilderJoin": true, - - // These functions use pseudo-stack-pointers and are not robust - // to unexpected integer values. - "DebugEvaluate": true, - - // These functions do nontrivial error checking in recursive calls, - // which means that we have to propagate errors back. - "SetFunctionBreakPoint": true, - "SetScriptBreakPoint": true, - "PrepareStep": true, - - // Too slow. - "DebugReferencedBy": true, - - // Calling disable/enable access checks may interfere with the - // the rest of the tests. - "DisableAccessChecks": true, - "EnableAccessChecks": true, - - // IS_VAR is special. - "IS_VAR": true, - - // Vararg with minimum number > 0. - "Call": true, - "SetAllocationTimeout": true, - - // Requires integer arguments to be non-negative. - "Apply": true, - - // That can only be invoked on Array.prototype. - "FinishArrayPrototypeSetup": true, - - "_SwapElements": true, - - // Performance critical functions which cannot afford type checks. - "_IsNativeOrStrictMode": true, - "_CallFunction": true, - - // Tries to allocate based on argument, and (correctly) throws - // out-of-memory if the request is too large. In practice, the - // size will be the number of captures of a RegExp. - "RegExpConstructResult": true, - "_RegExpConstructResult": true, - - // This functions perform some checks compile time (they require one of their - // arguments to be a compile time smi). - "_DateField": true, - "_GetFromCache": true, - - // This function expects its first argument to be a non-smi. - "_IsStringWrapperSafeForDefaultValueOf" : true, - - // Only applicable to strings. - "_HasCachedArrayIndex": true, - "_GetCachedArrayIndex": true, - "_OneByteSeqStringSetChar": true, - "_TwoByteSeqStringSetChar": true, - - // Only applicable to TypedArrays. - "_TypedArrayInitialize": true, - - // Only applicable to generators. - "_GeneratorNext": true, - "_GeneratorThrow": true, - - // Only applicable to DataViews. - "_DataViewInitialize": true, -}; - -var currentlyUncallable = { - // We need to find a way to test this without breaking the system. - "SystemBreak": true, - // Inserts an int3/stop instruction when run with --always-opt. - "_DebugBreakInOptimizedCode": true -}; - -function testNatives() { - var allNatives = %ListNatives(); - var start = allNatives.length >> 2; - var stop = (allNatives.length >> 2)*2; - for (var i = start; i < stop; i++) { - var nativeInfo = allNatives[i]; - var name = nativeInfo[0]; - if (name in knownProblems || name in currentlyUncallable) - continue; - print(name); - var argc = nativeInfo[1]; - testArgumentCount(name, argc); - testArgumentTypes(name, argc); - } -} - -testNatives(); diff --git a/test/mjsunit/fuzz-natives-part3.js b/test/mjsunit/fuzz-natives-part3.js deleted file mode 100644 index 7a8125a..0000000 --- a/test/mjsunit/fuzz-natives-part3.js +++ /dev/null @@ -1,216 +0,0 @@ -// Copyright 2011 the V8 project authors. All rights reserved. -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are -// met: -// -// * Redistributions of source code must retain the above copyright -// notice, this list of conditions and the following disclaimer. -// * Redistributions in binary form must reproduce the above -// copyright notice, this list of conditions and the following -// disclaimer in the documentation and/or other materials provided -// with the distribution. -// * Neither the name of Google Inc. nor the names of its -// contributors may be used to endorse or promote products derived -// from this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -// Flags: --allow-natives-syntax - -var RUN_WITH_ALL_ARGUMENT_ENTRIES = false; -var kOnManyArgumentsRemove = 5; - -function makeArguments() { - var result = [ ]; - result.push(17); - result.push(-31); - result.push(new Array(100)); - result.push(new Array(100003)); - result.push(Number.MIN_VALUE); - result.push("whoops"); - result.push("x"); - result.push({"x": 1, "y": 2}); - var slowCaseObj = {"a": 3, "b": 4, "c": 5}; - delete slowCaseObj.c; - result.push(slowCaseObj); - result.push(function () { return 8; }); - return result; -} - -var kArgObjects = makeArguments().length; - -function makeFunction(name, argc) { - var args = []; - for (var i = 0; i < argc; i++) - args.push("x" + i); - var argsStr = args.join(", "); - return new Function(args.join(", "), "return %" + name + "(" + argsStr + ");"); -} - -function testArgumentCount(name, argc) { - for (var i = 0; i < 10; i++) { - var func = null; - try { - func = makeFunction(name, i); - } catch (e) { - if (e != "SyntaxError: Illegal access") throw e; - } - if (func === null && i == argc) { - throw "unexpected exception"; - } - var args = [ ]; - for (var j = 0; j < i; j++) - args.push(0); - try { - func.apply(void 0, args); - } catch (e) { - // we don't care what happens as long as we don't crash - } - } -} - -function testArgumentTypes(name, argc) { - var type = 0; - var hasMore = true; - var func = makeFunction(name, argc); - while (hasMore) { - var argPool = makeArguments(); - // When we have 5 or more arguments we lower the amount of tests cases - // by randomly removing kOnManyArgumentsRemove entries - var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ? - kArgObjects : kArgObjects-kOnManyArgumentsRemove; - if (argc >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) { - for (var i = 0; i < kOnManyArgumentsRemove; i++) { - var rand = Math.floor(Math.random() * (kArgObjects - i)); - argPool.splice(rand,1); - } - } - var current = type; - var hasMore = false; - var argList = [ ]; - for (var i = 0; i < argc; i++) { - var index = current % numArguments; - current = (current / numArguments) << 0; - if (index != (numArguments - 1)) - hasMore = true; - argList.push(argPool[index]); - } - try { - func.apply(void 0, argList); - } catch (e) { - // we don't care what happens as long as we don't crash - } - type++; - } -} - -var knownProblems = { - "Abort": true, - - // Avoid calling the concat operation, because weird lengths - // may lead to out-of-memory. Ditto for StringBuilderJoin. - "StringBuilderConcat": true, - "StringBuilderJoin": true, - - // These functions use pseudo-stack-pointers and are not robust - // to unexpected integer values. - "DebugEvaluate": true, - - // These functions do nontrivial error checking in recursive calls, - // which means that we have to propagate errors back. - "SetFunctionBreakPoint": true, - "SetScriptBreakPoint": true, - "PrepareStep": true, - - // Too slow. - "DebugReferencedBy": true, - - // Calling disable/enable access checks may interfere with the - // the rest of the tests. - "DisableAccessChecks": true, - "EnableAccessChecks": true, - - // IS_VAR is special. - "IS_VAR": true, - - // Vararg with minimum number > 0. - "Call": true, - "SetAllocationTimeout": true, - - // Requires integer arguments to be non-negative. - "Apply": true, - - // That can only be invoked on Array.prototype. - "FinishArrayPrototypeSetup": true, - - "_SwapElements": true, - - // Performance critical functions which cannot afford type checks. - "_IsNativeOrStrictMode": true, - "_CallFunction": true, - - // Tries to allocate based on argument, and (correctly) throws - // out-of-memory if the request is too large. In practice, the - // size will be the number of captures of a RegExp. - "RegExpConstructResult": true, - "_RegExpConstructResult": true, - - // This functions perform some checks compile time (they require one of their - // arguments to be a compile time smi). - "_DateField": true, - "_GetFromCache": true, - - // This function expects its first argument to be a non-smi. - "_IsStringWrapperSafeForDefaultValueOf" : true, - - // Only applicable to strings. - "_HasCachedArrayIndex": true, - "_GetCachedArrayIndex": true, - "_OneByteSeqStringSetChar": true, - "_TwoByteSeqStringSetChar": true, - - // Only applicable to TypedArrays. - "_TypedArrayInitialize": true, - - // Only applicable to generators. - "_GeneratorNext": true, - "_GeneratorThrow": true, - - // Only applicable to DataViews. - "_DataViewInitialize": true, -}; - -var currentlyUncallable = { - // We need to find a way to test this without breaking the system. - "SystemBreak": true, - // Inserts an int3/stop instruction when run with --always-opt. - "_DebugBreakInOptimizedCode": true -}; - -function testNatives() { - var allNatives = %ListNatives(); - var start = (allNatives.length >> 2)*2; - var stop = (allNatives.length >> 2)*3; - for (var i = start; i < stop; i++) { - var nativeInfo = allNatives[i]; - var name = nativeInfo[0]; - if (name in knownProblems || name in currentlyUncallable) - continue; - print(name); - var argc = nativeInfo[1]; - testArgumentCount(name, argc); - testArgumentTypes(name, argc); - } -} - -testNatives(); diff --git a/test/mjsunit/fuzz-natives-part4.js b/test/mjsunit/fuzz-natives-part4.js deleted file mode 100644 index 9523749..0000000 --- a/test/mjsunit/fuzz-natives-part4.js +++ /dev/null @@ -1,216 +0,0 @@ -// Copyright 2011 the V8 project authors. All rights reserved. -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are -// met: -// -// * Redistributions of source code must retain the above copyright -// notice, this list of conditions and the following disclaimer. -// * Redistributions in binary form must reproduce the above -// copyright notice, this list of conditions and the following -// disclaimer in the documentation and/or other materials provided -// with the distribution. -// * Neither the name of Google Inc. nor the names of its -// contributors may be used to endorse or promote products derived -// from this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -// Flags: --allow-natives-syntax - -var RUN_WITH_ALL_ARGUMENT_ENTRIES = false; -var kOnManyArgumentsRemove = 5; - -function makeArguments() { - var result = [ ]; - result.push(17); - result.push(-31); - result.push(new Array(100)); - result.push(new Array(100003)); - result.push(Number.MIN_VALUE); - result.push("whoops"); - result.push("x"); - result.push({"x": 1, "y": 2}); - var slowCaseObj = {"a": 3, "b": 4, "c": 5}; - delete slowCaseObj.c; - result.push(slowCaseObj); - result.push(function () { return 8; }); - return result; -} - -var kArgObjects = makeArguments().length; - -function makeFunction(name, argc) { - var args = []; - for (var i = 0; i < argc; i++) - args.push("x" + i); - var argsStr = args.join(", "); - return new Function(args.join(", "), "return %" + name + "(" + argsStr + ");"); -} - -function testArgumentCount(name, argc) { - for (var i = 0; i < 10; i++) { - var func = null; - try { - func = makeFunction(name, i); - } catch (e) { - if (e != "SyntaxError: Illegal access") throw e; - } - if (func === null && i == argc) { - throw "unexpected exception"; - } - var args = [ ]; - for (var j = 0; j < i; j++) - args.push(0); - try { - func.apply(void 0, args); - } catch (e) { - // we don't care what happens as long as we don't crash - } - } -} - -function testArgumentTypes(name, argc) { - var type = 0; - var hasMore = true; - var func = makeFunction(name, argc); - while (hasMore) { - var argPool = makeArguments(); - // When we have 5 or more arguments we lower the amount of tests cases - // by randomly removing kOnManyArgumentsRemove entries - var numArguments = RUN_WITH_ALL_ARGUMENT_ENTRIES ? - kArgObjects : kArgObjects-kOnManyArgumentsRemove; - if (argc >= 5 && !RUN_WITH_ALL_ARGUMENT_ENTRIES) { - for (var i = 0; i < kOnManyArgumentsRemove; i++) { - var rand = Math.floor(Math.random() * (kArgObjects - i)); - argPool.splice(rand,1); - } - } - var current = type; - var hasMore = false; - var argList = [ ]; - for (var i = 0; i < argc; i++) { - var index = current % numArguments; - current = (current / numArguments) << 0; - if (index != (numArguments - 1)) - hasMore = true; - argList.push(argPool[index]); - } - try { - func.apply(void 0, argList); - } catch (e) { - // we don't care what happens as long as we don't crash - } - type++; - } -} - -var knownProblems = { - "Abort": true, - - // Avoid calling the concat operation, because weird lengths - // may lead to out-of-memory. Ditto for StringBuilderJoin. - "StringBuilderConcat": true, - "StringBuilderJoin": true, - - // These functions use pseudo-stack-pointers and are not robust - // to unexpected integer values. - "DebugEvaluate": true, - - // These functions do nontrivial error checking in recursive calls, - // which means that we have to propagate errors back. - "SetFunctionBreakPoint": true, - "SetScriptBreakPoint": true, - "PrepareStep": true, - - // Too slow. - "DebugReferencedBy": true, - - // Calling disable/enable access checks may interfere with the - // the rest of the tests. - "DisableAccessChecks": true, - "EnableAccessChecks": true, - - // IS_VAR is special. - "IS_VAR": true, - - // Vararg with minimum number > 0. - "Call": true, - "SetAllocationTimeout": true, - - // Requires integer arguments to be non-negative. - "Apply": true, - - // That can only be invoked on Array.prototype. - "FinishArrayPrototypeSetup": true, - - "_SwapElements": true, - - // Performance critical functions which cannot afford type checks. - "_IsNativeOrStrictMode": true, - "_CallFunction": true, - - // Tries to allocate based on argument, and (correctly) throws - // out-of-memory if the request is too large. In practice, the - // size will be the number of captures of a RegExp. - "RegExpConstructResult": true, - "_RegExpConstructResult": true, - - // This functions perform some checks compile time (they require one of their - // arguments to be a compile time smi). - "_DateField": true, - "_GetFromCache": true, - - // This function expects its first argument to be a non-smi. - "_IsStringWrapperSafeForDefaultValueOf" : true, - - // Only applicable to strings. - "_HasCachedArrayIndex": true, - "_GetCachedArrayIndex": true, - "_OneByteSeqStringSetChar": true, - "_TwoByteSeqStringSetChar": true, - - // Only applicable to TypedArrays. - "_TypedArrayInitialize": true, - - // Only applicable to generators. - "_GeneratorNext": true, - "_GeneratorThrow": true, - - // Only applicable to DataViews. - "_DataViewInitialize": true, -}; - -var currentlyUncallable = { - // We need to find a way to test this without breaking the system. - "SystemBreak": true, - // Inserts an int3/stop instruction when run with --always-opt. - "_DebugBreakInOptimizedCode": true -}; - -function testNatives() { - var allNatives = %ListNatives(); - var start = (allNatives.length >> 2)*3; - var stop = allNatives.length; - for (var i = start; i < stop; i++) { - var nativeInfo = allNatives[i]; - var name = nativeInfo[0]; - if (name in knownProblems || name in currentlyUncallable) - continue; - print(name); - var argc = nativeInfo[1]; - testArgumentCount(name, argc); - testArgumentTypes(name, argc); - } -} - -testNatives(); diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status index 036fb48..117a0e6 100644 --- a/test/mjsunit/mjsunit.status +++ b/test/mjsunit/mjsunit.status @@ -68,10 +68,6 @@ 'd8-performance-now': [PASS, NO_VARIANTS], ############################################################################## - # These use a built-in that's only present in debug mode. They take - # too long to run in debug mode on ARM and MIPS. - 'fuzz-natives-part*': [PASS, ['mode == release or arch == arm or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips', SKIP]], - 'big-object-literal': [PASS, ['arch == arm or arch == android_arm or arch == android_arm64', SKIP]], # Issue 488: this test sometimes times out. @@ -351,11 +347,6 @@ 'debug-liveedit-restart-frame': [SKIP], 'debug-liveedit-double-call': [SKIP], - # This test dumps core for arm.debug, so no reason to expect it to work - # for NaCl. The other three fuzz-natives tests seem to run fine. - # As noted above none of them are run in the arm.debug case. - 'fuzz-natives-part4': [SKIP], - # NaCl builds have problems with this test since Pepper_28. # V8 Issue 2786 'math-exp-precision': [SKIP], diff --git a/tools/run-tests.py b/tools/run-tests.py index 4167a55..5cf4904 100755 --- a/tools/run-tests.py +++ b/tools/run-tests.py @@ -50,7 +50,7 @@ from testrunner.objects import context ARCH_GUESS = utils.DefaultArch() -DEFAULT_TESTS = ["mjsunit", "cctest", "message", "preparser"] +DEFAULT_TESTS = ["mjsunit", "fuzz-natives", "cctest", "message", "preparser"] TIMEOUT_DEFAULT = 60 TIMEOUT_SCALEFACTOR = {"debug" : 4, "release" : 1 } -- 2.7.4