The Tor Browser / file comparison
comparison: js/src/jsapi-tests/testGCHeapPostBarriers.cpp
js/src/jsapi-tests/testGCHeapPostBarriers.cpp
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
equal
deleted
inserted
replaced
| -1:000000000000 | 0:2c822822999b |
|---|---|
| 1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- | |
| 2 * vim: set ts=8 sts=4 et sw=4 tw=99: | |
| 3 */ | |
| 4 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 5 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 6 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 7 | |
| 8 #ifdef JSGC_GENERATIONAL | |
| 9 | |
| 10 #include "js/RootingAPI.h" | |
| 11 #include "jsapi-tests/tests.h" | |
| 12 | |
| 13 BEGIN_TEST(testGCHeapPostBarriers) | |
| 14 { | |
| 15 /* Sanity check - objects start in the nursery and then become tenured. */ | |
| 16 JS_GC(cx->runtime()); | |
| 17 JS::RootedObject obj(cx, NurseryObject()); | |
| 18 CHECK(js::gc::IsInsideNursery(obj.get())); | |
| 19 JS_GC(cx->runtime()); | |
| 20 CHECK(!js::gc::IsInsideNursery(obj.get())); | |
| 21 JS::RootedObject tenuredObject(cx, obj); | |
| 22 | |
| 23 /* Currently JSObject and JSFunction objects are nursery allocated. */ | |
| 24 CHECK(TestHeapPostBarriers(NurseryObject())); | |
| 25 CHECK(TestHeapPostBarriers(NurseryFunction())); | |
| 26 | |
| 27 return true; | |
| 28 } | |
| 29 | |
| 30 template <typename T> | |
| 31 bool | |
| 32 TestHeapPostBarriers(T initialObj) | |
| 33 { | |
| 34 CHECK(initialObj != nullptr); | |
| 35 CHECK(js::gc::IsInsideNursery(initialObj)); | |
| 36 | |
| 37 /* Construct Heap<> wrapper. */ | |
| 38 JS::Heap<T> *heapData = new JS::Heap<T>(); | |
| 39 CHECK(heapData); | |
| 40 CHECK(heapData->get() == nullptr); | |
| 41 heapData->set(initialObj); | |
| 42 | |
| 43 /* Store the pointer as an integer so that the hazard analysis will miss it. */ | |
| 44 uintptr_t initialObjAsInt = uintptr_t(initialObj); | |
| 45 | |
| 46 /* Perform minor GC and check heap wrapper is udated with new pointer. */ | |
| 47 js::MinorGC(cx, JS::gcreason::API); | |
| 48 CHECK(uintptr_t(heapData->get()) != initialObjAsInt); | |
| 49 CHECK(!js::gc::IsInsideNursery(heapData->get())); | |
| 50 | |
| 51 /* Check object is definitely still alive. */ | |
| 52 JS::Rooted<T> obj(cx, heapData->get()); | |
| 53 JS::RootedValue value(cx); | |
| 54 CHECK(JS_GetProperty(cx, obj, "x", &value)); | |
| 55 CHECK(value.isInt32()); | |
| 56 CHECK(value.toInt32() == 42); | |
| 57 | |
| 58 delete heapData; | |
| 59 return true; | |
| 60 } | |
| 61 | |
| 62 JSObject *NurseryObject() | |
| 63 { | |
| 64 JS::RootedObject obj(cx, JS_NewObject(cx, nullptr, JS::NullPtr(), JS::NullPtr())); | |
| 65 if (!obj) | |
| 66 return nullptr; | |
| 67 JS_DefineProperty(cx, obj, "x", 42, 0); | |
| 68 return obj; | |
| 69 } | |
| 70 | |
| 71 JSFunction *NurseryFunction() | |
| 72 { | |
| 73 /* | |
| 74 * We don't actually use the function as a function, so here we cheat and | |
| 75 * cast a JSObject. | |
| 76 */ | |
| 77 return static_cast<JSFunction *>(NurseryObject()); | |
| 78 } | |
| 79 | |
| 80 END_TEST(testGCHeapPostBarriers) | |
| 81 | |
| 82 #endif |
