Wed, 31 Dec 2014 06:09:35 +0100
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
michael@0 | 1 | // Fuzz tests |
michael@0 | 2 | (function(){ |
michael@0 | 3 | // |
michael@0 | 4 | (function(){ |
michael@0 | 5 | var g = {}; |
michael@0 | 6 | x = new Float32Array() |
michael@0 | 7 | Function('g', "g.o = x[1]")(g); |
michael@0 | 8 | })(); |
michael@0 | 9 | // |
michael@0 | 10 | (function() { |
michael@0 | 11 | var g = new Float32Array(16); |
michael@0 | 12 | var h = new Float64Array(16); |
michael@0 | 13 | var farrays = [ g, h ]; |
michael@0 | 14 | for (aridx = 0; aridx < farrays.length; ++aridx) { |
michael@0 | 15 | ar = farrays[aridx]; |
michael@0 | 16 | !(ar[ar.length-2] == (NaN / Infinity)[ar.length-2]) |
michael@0 | 17 | } |
michael@0 | 18 | })(); |
michael@0 | 19 | // |
michael@0 | 20 | (function () { |
michael@0 | 21 | var v = new Float32Array(32); |
michael@0 | 22 | for (var i = 0; i < v.length; ++i) |
michael@0 | 23 | v[i] = i; |
michael@0 | 24 | var t = (false ); |
michael@0 | 25 | for (var i = 0; i < i .length; ++i) |
michael@0 | 26 | t += v[i]; |
michael@0 | 27 | })(); |
michael@0 | 28 | // |
michael@0 | 29 | (function() { |
michael@0 | 30 | if (typeof ParallelArray !== "undefined") |
michael@0 | 31 | ParallelArray([1606], Math.fround) |
michael@0 | 32 | })(); |
michael@0 | 33 | // |
michael@0 | 34 | (function() { |
michael@0 | 35 | x = y = {}; |
michael@0 | 36 | z = new Float32Array(6) |
michael@0 | 37 | for (c in this) { |
michael@0 | 38 | Array.prototype.unshift.call(x, new ArrayBuffer()) |
michael@0 | 39 | } |
michael@0 | 40 | Array.prototype.sort.call(x, (function (j) { |
michael@0 | 41 | y.s = z[2] |
michael@0 | 42 | })) |
michael@0 | 43 | })(); |
michael@0 | 44 | // |
michael@0 | 45 | })(); |
michael@0 | 46 | // |
michael@0 | 47 | // ION TESTS |
michael@0 | 48 | // |
michael@0 | 49 | // The assertFloat32 function is deactivated in --ion-eager mode, as the first time, the function Math.fround |
michael@0 | 50 | // would be guarded against modifications (typeguard on Math and then on fround). In this case, Math.fround is |
michael@0 | 51 | // not inlined and the compiler will consider the return value to be a double, not a float32, making the |
michael@0 | 52 | // assertions fail. Note that as assertFloat32 is declared unsafe for fuzzing, this can't happen in fuzzed code. |
michael@0 | 53 | // |
michael@0 | 54 | // To be able to test it, we still need ion compilation though. A nice solution is to manually lower the ion usecount. |
michael@0 | 55 | setJitCompilerOption("ion.usecount.trigger", 50); |
michael@0 | 56 | |
michael@0 | 57 | function test(f) { |
michael@0 | 58 | f32[0] = .5; |
michael@0 | 59 | for(var n = 110; n; n--) |
michael@0 | 60 | f(); |
michael@0 | 61 | } |
michael@0 | 62 | |
michael@0 | 63 | var f32 = new Float32Array(2); |
michael@0 | 64 | var f64 = new Float64Array(2); |
michael@0 | 65 | |
michael@0 | 66 | function acceptAdd() { |
michael@0 | 67 | var use = f32[0] + 1; |
michael@0 | 68 | assertFloat32(use, true); |
michael@0 | 69 | f32[0] = use; |
michael@0 | 70 | } |
michael@0 | 71 | test(acceptAdd); |
michael@0 | 72 | |
michael@0 | 73 | function acceptAddSeveral() { |
michael@0 | 74 | var sum1 = f32[0] + 0.5; |
michael@0 | 75 | var sum2 = f32[0] + 0.5; |
michael@0 | 76 | f32[0] = sum1; |
michael@0 | 77 | f32[0] = sum2; |
michael@0 | 78 | assertFloat32(sum1, true); |
michael@0 | 79 | assertFloat32(sum2, true); |
michael@0 | 80 | } |
michael@0 | 81 | test(acceptAddSeveral); |
michael@0 | 82 | |
michael@0 | 83 | function acceptAddVar() { |
michael@0 | 84 | var x = f32[0] + 1; |
michael@0 | 85 | f32[0] = x; |
michael@0 | 86 | f32[1] = x; |
michael@0 | 87 | assertFloat32(x, true); |
michael@0 | 88 | } |
michael@0 | 89 | test(acceptAddVar); |
michael@0 | 90 | |
michael@0 | 91 | function refuseAddCst() { |
michael@0 | 92 | var x = f32[0] + 1234567890; // this constant can't be precisely represented as a float32 |
michael@0 | 93 | f32[0] = x; |
michael@0 | 94 | assertFloat32(x, false); |
michael@0 | 95 | } |
michael@0 | 96 | test(refuseAddCst); |
michael@0 | 97 | |
michael@0 | 98 | function refuseAddVar() { |
michael@0 | 99 | var x = f32[0] + 1; |
michael@0 | 100 | f32[0] = x; |
michael@0 | 101 | f32[1] = x; |
michael@0 | 102 | f64[1] = x; // non consumer |
michael@0 | 103 | assertFloat32(x, false); |
michael@0 | 104 | } |
michael@0 | 105 | test(refuseAddVar); |
michael@0 | 106 | |
michael@0 | 107 | function refuseAddStore64() { |
michael@0 | 108 | var x = f32[0] + 1; |
michael@0 | 109 | f64[0] = x; // non consumer |
michael@0 | 110 | f32[0] = f64[0]; |
michael@0 | 111 | assertFloat32(x, false); |
michael@0 | 112 | } |
michael@0 | 113 | test(refuseAddStore64); |
michael@0 | 114 | |
michael@0 | 115 | function refuseAddStoreObj() { |
michael@0 | 116 | var o = {} |
michael@0 | 117 | var x = f32[0] + 1; |
michael@0 | 118 | o.x = x; // non consumer |
michael@0 | 119 | f32[0] = o['x']; |
michael@0 | 120 | assertFloat32(x, false); |
michael@0 | 121 | } |
michael@0 | 122 | test(refuseAddStoreObj); |
michael@0 | 123 | |
michael@0 | 124 | function refuseAddSeveral() { |
michael@0 | 125 | var sum = (f32[0] + 2) - 1; // second addition is not a consumer |
michael@0 | 126 | f32[0] = sum; |
michael@0 | 127 | assertFloat32(sum, false); |
michael@0 | 128 | } |
michael@0 | 129 | test(refuseAddSeveral); |
michael@0 | 130 | |
michael@0 | 131 | function refuseAddFunctionCall() { |
michael@0 | 132 | function plusOne(x) { return Math.cos(x+1)*13.37; } |
michael@0 | 133 | var res = plusOne(f32[0]); // func call is not a consumer |
michael@0 | 134 | f32[0] = res; |
michael@0 | 135 | assertFloat32(res, false); |
michael@0 | 136 | } |
michael@0 | 137 | test(refuseAddFunctionCall); |
michael@0 | 138 | |
michael@0 | 139 | function acceptSqrt() { |
michael@0 | 140 | var res = Math.sqrt(f32[0]); |
michael@0 | 141 | assertFloat32(res, true); |
michael@0 | 142 | f32[0] = res; |
michael@0 | 143 | } |
michael@0 | 144 | test(acceptSqrt); |
michael@0 | 145 | |
michael@0 | 146 | function refuseSqrt() { |
michael@0 | 147 | var res = Math.sqrt(f32[0]); |
michael@0 | 148 | assertFloat32(res, false); |
michael@0 | 149 | f32[0] = res + 1; |
michael@0 | 150 | } |
michael@0 | 151 | test(refuseSqrt); |
michael@0 | 152 | |
michael@0 | 153 | function acceptAbs() { |
michael@0 | 154 | var res = Math.abs(f32[0]); |
michael@0 | 155 | assertFloat32(res, true); |
michael@0 | 156 | f32[0] = res; |
michael@0 | 157 | } |
michael@0 | 158 | test(acceptAbs); |
michael@0 | 159 | |
michael@0 | 160 | function refuseAbs() { |
michael@0 | 161 | var res = Math.abs(f32[0]); |
michael@0 | 162 | assertFloat32(res, false); |
michael@0 | 163 | f64[0] = res + 1; |
michael@0 | 164 | } |
michael@0 | 165 | test(refuseAbs); |
michael@0 | 166 | |
michael@0 | 167 | function refuseTrigo() { |
michael@0 | 168 | var res = Math.cos(f32[0]); |
michael@0 | 169 | f32[0] = res; |
michael@0 | 170 | assertFloat32(res, false); |
michael@0 | 171 | |
michael@0 | 172 | var res = Math.sin(f32[0]); |
michael@0 | 173 | f32[0] = res; |
michael@0 | 174 | assertFloat32(res, false); |
michael@0 | 175 | |
michael@0 | 176 | var res = Math.tan(f32[0]); |
michael@0 | 177 | f32[0] = res; |
michael@0 | 178 | assertFloat32(res, false); |
michael@0 | 179 | |
michael@0 | 180 | var res = Math.acos(f32[0]); |
michael@0 | 181 | f32[0] = res; |
michael@0 | 182 | assertFloat32(res, false); |
michael@0 | 183 | |
michael@0 | 184 | var res = Math.asin(f32[0]); |
michael@0 | 185 | f32[0] = res; |
michael@0 | 186 | assertFloat32(res, false); |
michael@0 | 187 | |
michael@0 | 188 | res = Math.atan(f32[0]); |
michael@0 | 189 | f32[0] = res; |
michael@0 | 190 | assertFloat32(res, false); |
michael@0 | 191 | } |
michael@0 | 192 | test(refuseTrigo); |
michael@0 | 193 | |
michael@0 | 194 | function refuseMath() { |
michael@0 | 195 | var res = Math.log10(f32[0]); |
michael@0 | 196 | f32[0] = res; |
michael@0 | 197 | assertFloat32(res, false); |
michael@0 | 198 | |
michael@0 | 199 | res = Math.log2(f32[0]); |
michael@0 | 200 | f32[0] = res; |
michael@0 | 201 | assertFloat32(res, false); |
michael@0 | 202 | |
michael@0 | 203 | res = Math.log1p(f32[0]); |
michael@0 | 204 | f32[0] = res; |
michael@0 | 205 | assertFloat32(res, false); |
michael@0 | 206 | |
michael@0 | 207 | res = Math.expm1(f32[0]); |
michael@0 | 208 | f32[0] = res; |
michael@0 | 209 | assertFloat32(res, false); |
michael@0 | 210 | |
michael@0 | 211 | res = Math.cosh(f32[0]); |
michael@0 | 212 | f32[0] = res; |
michael@0 | 213 | assertFloat32(res, false); |
michael@0 | 214 | |
michael@0 | 215 | res = Math.sinh(f32[0]); |
michael@0 | 216 | f32[0] = res; |
michael@0 | 217 | assertFloat32(res, false); |
michael@0 | 218 | |
michael@0 | 219 | res = Math.tanh(f32[0]); |
michael@0 | 220 | f32[0] = res; |
michael@0 | 221 | assertFloat32(res, false); |
michael@0 | 222 | |
michael@0 | 223 | res = Math.acosh(f32[0]); |
michael@0 | 224 | f32[0] = res; |
michael@0 | 225 | assertFloat32(res, false); |
michael@0 | 226 | |
michael@0 | 227 | res = Math.asinh(f32[0]); |
michael@0 | 228 | f32[0] = res; |
michael@0 | 229 | assertFloat32(res, false); |
michael@0 | 230 | |
michael@0 | 231 | res = Math.atanh(f32[0]); |
michael@0 | 232 | f32[0] = res; |
michael@0 | 233 | assertFloat32(res, false); |
michael@0 | 234 | |
michael@0 | 235 | res = Math.cbrt(f32[0]); |
michael@0 | 236 | f32[0] = res; |
michael@0 | 237 | assertFloat32(res, false); |
michael@0 | 238 | |
michael@0 | 239 | res = Math.sign(f32[0]); |
michael@0 | 240 | f32[0] = res; |
michael@0 | 241 | assertFloat32(res, false); |
michael@0 | 242 | |
michael@0 | 243 | res = Math.trunc(f32[0]); |
michael@0 | 244 | f32[0] = res; |
michael@0 | 245 | assertFloat32(res, false); |
michael@0 | 246 | } |
michael@0 | 247 | test(refuseMath); |
michael@0 | 248 | |
michael@0 | 249 | function refuseLoop() { |
michael@0 | 250 | var res = f32[0], |
michael@0 | 251 | n = 10; |
michael@0 | 252 | while (n--) { |
michael@0 | 253 | res = res + 1; // this loop is equivalent to several additions => second addition is not a consumer |
michael@0 | 254 | assertFloat32(res, false); |
michael@0 | 255 | } |
michael@0 | 256 | assertFloat32(res, false); |
michael@0 | 257 | f32[0] = res; |
michael@0 | 258 | } |
michael@0 | 259 | test(refuseLoop); |
michael@0 | 260 | |
michael@0 | 261 | function acceptLoop() { |
michael@0 | 262 | var res = f32[0], |
michael@0 | 263 | n = 10; |
michael@0 | 264 | while (n--) { |
michael@0 | 265 | var sum = res + 1; |
michael@0 | 266 | res = Math.fround(sum); |
michael@0 | 267 | assertFloat32(sum, true); |
michael@0 | 268 | } |
michael@0 | 269 | assertFloat32(res, true); |
michael@0 | 270 | f32[0] = res; |
michael@0 | 271 | } |
michael@0 | 272 | test(acceptLoop); |
michael@0 | 273 | |
michael@0 | 274 | function alternateCond(n) { |
michael@0 | 275 | var x = f32[0]; |
michael@0 | 276 | if (n > 0) { |
michael@0 | 277 | var s1 = x + 1; |
michael@0 | 278 | f32[0] = s1; |
michael@0 | 279 | assertFloat32(s1, true); |
michael@0 | 280 | } else { |
michael@0 | 281 | var s2 = x + 1; |
michael@0 | 282 | f64[0] = s2; // non consumer |
michael@0 | 283 | assertFloat32(s2, false); |
michael@0 | 284 | } |
michael@0 | 285 | } |
michael@0 | 286 | (function() { |
michael@0 | 287 | f32[0] = 0; |
michael@0 | 288 | for (var n = 110; n; n--) { |
michael@0 | 289 | alternateCond(n % 2); |
michael@0 | 290 | } |
michael@0 | 291 | })(); |
michael@0 | 292 | |
michael@0 | 293 | function phiTest(n) { |
michael@0 | 294 | var x = (f32[0]); |
michael@0 | 295 | var y = n; |
michael@0 | 296 | if (n > 0) { |
michael@0 | 297 | x = x + 2; |
michael@0 | 298 | assertFloat32(x, true); |
michael@0 | 299 | } else { |
michael@0 | 300 | if (n < -10) { |
michael@0 | 301 | x = Math.fround(Math.sqrt(y)); |
michael@0 | 302 | assertFloat32(x, true); |
michael@0 | 303 | } else { |
michael@0 | 304 | x = x - 1; |
michael@0 | 305 | assertFloat32(x, true); |
michael@0 | 306 | } |
michael@0 | 307 | } |
michael@0 | 308 | assertFloat32(x, true); |
michael@0 | 309 | f32[0] = x; |
michael@0 | 310 | } |
michael@0 | 311 | (function() { |
michael@0 | 312 | f32[0] = 0; |
michael@0 | 313 | for (var n = 100; n; n--) { |
michael@0 | 314 | phiTest( ((n % 3) - 1) * 15 ); |
michael@0 | 315 | } |
michael@0 | 316 | })(); |
michael@0 | 317 | |
michael@0 | 318 | function mixedPhiTest(n) { |
michael@0 | 319 | var x = (f32[0]); |
michael@0 | 320 | var y = n; |
michael@0 | 321 | if (n > 0) { |
michael@0 | 322 | x = x + 2; // non consumer because of (1) |
michael@0 | 323 | assertFloat32(x, false); |
michael@0 | 324 | } else { |
michael@0 | 325 | if (n < -10) { |
michael@0 | 326 | x = Math.fround(Math.sqrt(y)); // new producer |
michael@0 | 327 | assertFloat32(x, true); |
michael@0 | 328 | } else { |
michael@0 | 329 | x = x - 1; // non consumer because of (1) |
michael@0 | 330 | assertFloat32(x, false); |
michael@0 | 331 | } |
michael@0 | 332 | } |
michael@0 | 333 | assertFloat32(x, false); |
michael@0 | 334 | x = x + 1; // (1) non consumer |
michael@0 | 335 | f32[0] = x; |
michael@0 | 336 | } |
michael@0 | 337 | (function() { |
michael@0 | 338 | f32[0] = 0; |
michael@0 | 339 | for (var n = 100; n; n--) { |
michael@0 | 340 | mixedPhiTest( ((n % 3) - 1) * 15 ); |
michael@0 | 341 | } |
michael@0 | 342 | })(); |
michael@0 | 343 | |
michael@0 | 344 | function phiTest2(n) { |
michael@0 | 345 | var x = f32[0]; |
michael@0 | 346 | while (n >= 0) { |
michael@0 | 347 | x = Math.fround(Math.fround(x) + 1); |
michael@0 | 348 | assertFloat32(x, true); |
michael@0 | 349 | if (n < 10) { |
michael@0 | 350 | x = f32[0] + 1; |
michael@0 | 351 | assertFloat32(x, true); |
michael@0 | 352 | } |
michael@0 | 353 | n = n - 1; |
michael@0 | 354 | } |
michael@0 | 355 | } |
michael@0 | 356 | (function(){ |
michael@0 | 357 | f32[0] = 0; |
michael@0 | 358 | for (var n = 100; n > 10; n--) { |
michael@0 | 359 | phiTest2(n); |
michael@0 | 360 | } |
michael@0 | 361 | })(); |