Wed, 31 Dec 2014 06:09:35 +0100
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
1 // Fuzz tests
2 (function(){
3 //
4 (function(){
5 var g = {};
6 x = new Float32Array()
7 Function('g', "g.o = x[1]")(g);
8 })();
9 //
10 (function() {
11 var g = new Float32Array(16);
12 var h = new Float64Array(16);
13 var farrays = [ g, h ];
14 for (aridx = 0; aridx < farrays.length; ++aridx) {
15 ar = farrays[aridx];
16 !(ar[ar.length-2] == (NaN / Infinity)[ar.length-2])
17 }
18 })();
19 //
20 (function () {
21 var v = new Float32Array(32);
22 for (var i = 0; i < v.length; ++i)
23 v[i] = i;
24 var t = (false );
25 for (var i = 0; i < i .length; ++i)
26 t += v[i];
27 })();
28 //
29 (function() {
30 if (typeof ParallelArray !== "undefined")
31 ParallelArray([1606], Math.fround)
32 })();
33 //
34 (function() {
35 x = y = {};
36 z = new Float32Array(6)
37 for (c in this) {
38 Array.prototype.unshift.call(x, new ArrayBuffer())
39 }
40 Array.prototype.sort.call(x, (function (j) {
41 y.s = z[2]
42 }))
43 })();
44 //
45 })();
46 //
47 // ION TESTS
48 //
49 // The assertFloat32 function is deactivated in --ion-eager mode, as the first time, the function Math.fround
50 // would be guarded against modifications (typeguard on Math and then on fround). In this case, Math.fround is
51 // not inlined and the compiler will consider the return value to be a double, not a float32, making the
52 // assertions fail. Note that as assertFloat32 is declared unsafe for fuzzing, this can't happen in fuzzed code.
53 //
54 // To be able to test it, we still need ion compilation though. A nice solution is to manually lower the ion usecount.
55 setJitCompilerOption("ion.usecount.trigger", 50);
57 function test(f) {
58 f32[0] = .5;
59 for(var n = 110; n; n--)
60 f();
61 }
63 var f32 = new Float32Array(2);
64 var f64 = new Float64Array(2);
66 function acceptAdd() {
67 var use = f32[0] + 1;
68 assertFloat32(use, true);
69 f32[0] = use;
70 }
71 test(acceptAdd);
73 function acceptAddSeveral() {
74 var sum1 = f32[0] + 0.5;
75 var sum2 = f32[0] + 0.5;
76 f32[0] = sum1;
77 f32[0] = sum2;
78 assertFloat32(sum1, true);
79 assertFloat32(sum2, true);
80 }
81 test(acceptAddSeveral);
83 function acceptAddVar() {
84 var x = f32[0] + 1;
85 f32[0] = x;
86 f32[1] = x;
87 assertFloat32(x, true);
88 }
89 test(acceptAddVar);
91 function refuseAddCst() {
92 var x = f32[0] + 1234567890; // this constant can't be precisely represented as a float32
93 f32[0] = x;
94 assertFloat32(x, false);
95 }
96 test(refuseAddCst);
98 function refuseAddVar() {
99 var x = f32[0] + 1;
100 f32[0] = x;
101 f32[1] = x;
102 f64[1] = x; // non consumer
103 assertFloat32(x, false);
104 }
105 test(refuseAddVar);
107 function refuseAddStore64() {
108 var x = f32[0] + 1;
109 f64[0] = x; // non consumer
110 f32[0] = f64[0];
111 assertFloat32(x, false);
112 }
113 test(refuseAddStore64);
115 function refuseAddStoreObj() {
116 var o = {}
117 var x = f32[0] + 1;
118 o.x = x; // non consumer
119 f32[0] = o['x'];
120 assertFloat32(x, false);
121 }
122 test(refuseAddStoreObj);
124 function refuseAddSeveral() {
125 var sum = (f32[0] + 2) - 1; // second addition is not a consumer
126 f32[0] = sum;
127 assertFloat32(sum, false);
128 }
129 test(refuseAddSeveral);
131 function refuseAddFunctionCall() {
132 function plusOne(x) { return Math.cos(x+1)*13.37; }
133 var res = plusOne(f32[0]); // func call is not a consumer
134 f32[0] = res;
135 assertFloat32(res, false);
136 }
137 test(refuseAddFunctionCall);
139 function acceptSqrt() {
140 var res = Math.sqrt(f32[0]);
141 assertFloat32(res, true);
142 f32[0] = res;
143 }
144 test(acceptSqrt);
146 function refuseSqrt() {
147 var res = Math.sqrt(f32[0]);
148 assertFloat32(res, false);
149 f32[0] = res + 1;
150 }
151 test(refuseSqrt);
153 function acceptAbs() {
154 var res = Math.abs(f32[0]);
155 assertFloat32(res, true);
156 f32[0] = res;
157 }
158 test(acceptAbs);
160 function refuseAbs() {
161 var res = Math.abs(f32[0]);
162 assertFloat32(res, false);
163 f64[0] = res + 1;
164 }
165 test(refuseAbs);
167 function refuseTrigo() {
168 var res = Math.cos(f32[0]);
169 f32[0] = res;
170 assertFloat32(res, false);
172 var res = Math.sin(f32[0]);
173 f32[0] = res;
174 assertFloat32(res, false);
176 var res = Math.tan(f32[0]);
177 f32[0] = res;
178 assertFloat32(res, false);
180 var res = Math.acos(f32[0]);
181 f32[0] = res;
182 assertFloat32(res, false);
184 var res = Math.asin(f32[0]);
185 f32[0] = res;
186 assertFloat32(res, false);
188 res = Math.atan(f32[0]);
189 f32[0] = res;
190 assertFloat32(res, false);
191 }
192 test(refuseTrigo);
194 function refuseMath() {
195 var res = Math.log10(f32[0]);
196 f32[0] = res;
197 assertFloat32(res, false);
199 res = Math.log2(f32[0]);
200 f32[0] = res;
201 assertFloat32(res, false);
203 res = Math.log1p(f32[0]);
204 f32[0] = res;
205 assertFloat32(res, false);
207 res = Math.expm1(f32[0]);
208 f32[0] = res;
209 assertFloat32(res, false);
211 res = Math.cosh(f32[0]);
212 f32[0] = res;
213 assertFloat32(res, false);
215 res = Math.sinh(f32[0]);
216 f32[0] = res;
217 assertFloat32(res, false);
219 res = Math.tanh(f32[0]);
220 f32[0] = res;
221 assertFloat32(res, false);
223 res = Math.acosh(f32[0]);
224 f32[0] = res;
225 assertFloat32(res, false);
227 res = Math.asinh(f32[0]);
228 f32[0] = res;
229 assertFloat32(res, false);
231 res = Math.atanh(f32[0]);
232 f32[0] = res;
233 assertFloat32(res, false);
235 res = Math.cbrt(f32[0]);
236 f32[0] = res;
237 assertFloat32(res, false);
239 res = Math.sign(f32[0]);
240 f32[0] = res;
241 assertFloat32(res, false);
243 res = Math.trunc(f32[0]);
244 f32[0] = res;
245 assertFloat32(res, false);
246 }
247 test(refuseMath);
249 function refuseLoop() {
250 var res = f32[0],
251 n = 10;
252 while (n--) {
253 res = res + 1; // this loop is equivalent to several additions => second addition is not a consumer
254 assertFloat32(res, false);
255 }
256 assertFloat32(res, false);
257 f32[0] = res;
258 }
259 test(refuseLoop);
261 function acceptLoop() {
262 var res = f32[0],
263 n = 10;
264 while (n--) {
265 var sum = res + 1;
266 res = Math.fround(sum);
267 assertFloat32(sum, true);
268 }
269 assertFloat32(res, true);
270 f32[0] = res;
271 }
272 test(acceptLoop);
274 function alternateCond(n) {
275 var x = f32[0];
276 if (n > 0) {
277 var s1 = x + 1;
278 f32[0] = s1;
279 assertFloat32(s1, true);
280 } else {
281 var s2 = x + 1;
282 f64[0] = s2; // non consumer
283 assertFloat32(s2, false);
284 }
285 }
286 (function() {
287 f32[0] = 0;
288 for (var n = 110; n; n--) {
289 alternateCond(n % 2);
290 }
291 })();
293 function phiTest(n) {
294 var x = (f32[0]);
295 var y = n;
296 if (n > 0) {
297 x = x + 2;
298 assertFloat32(x, true);
299 } else {
300 if (n < -10) {
301 x = Math.fround(Math.sqrt(y));
302 assertFloat32(x, true);
303 } else {
304 x = x - 1;
305 assertFloat32(x, true);
306 }
307 }
308 assertFloat32(x, true);
309 f32[0] = x;
310 }
311 (function() {
312 f32[0] = 0;
313 for (var n = 100; n; n--) {
314 phiTest( ((n % 3) - 1) * 15 );
315 }
316 })();
318 function mixedPhiTest(n) {
319 var x = (f32[0]);
320 var y = n;
321 if (n > 0) {
322 x = x + 2; // non consumer because of (1)
323 assertFloat32(x, false);
324 } else {
325 if (n < -10) {
326 x = Math.fround(Math.sqrt(y)); // new producer
327 assertFloat32(x, true);
328 } else {
329 x = x - 1; // non consumer because of (1)
330 assertFloat32(x, false);
331 }
332 }
333 assertFloat32(x, false);
334 x = x + 1; // (1) non consumer
335 f32[0] = x;
336 }
337 (function() {
338 f32[0] = 0;
339 for (var n = 100; n; n--) {
340 mixedPhiTest( ((n % 3) - 1) * 15 );
341 }
342 })();
344 function phiTest2(n) {
345 var x = f32[0];
346 while (n >= 0) {
347 x = Math.fround(Math.fround(x) + 1);
348 assertFloat32(x, true);
349 if (n < 10) {
350 x = f32[0] + 1;
351 assertFloat32(x, true);
352 }
353 n = n - 1;
354 }
355 }
356 (function(){
357 f32[0] = 0;
358 for (var n = 100; n > 10; n--) {
359 phiTest2(n);
360 }
361 })();