11 files changed, 309 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/sharedbuf/asm-link.js b/js/src/jit-test/tests/sharedbuf/asm-link.js
new file mode 100644
index 000000000..340ee1df4
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/asm-link.js
@@ -0,0 +1,15 @@
+// Don't assert on linking.
+// Provide superficial functionality.
+
+function $(stdlib, foreign, heap) {
+    "use asm";
+    var f64 = new stdlib.Float64Array(heap);
+    function f() { var v=0.0; v=+f64[0]; return +v; }
+    return f
+}
+
+if (this.SharedArrayBuffer) {
+    var heap = new SharedArrayBuffer(65536);
+    (new Float64Array(heap))[0] = 3.14159;
+    assertEq($(this, {}, heap)(), 3.14159);
+}
diff --git a/js/src/jit-test/tests/sharedbuf/byteLength.js b/js/src/jit-test/tests/sharedbuf/byteLength.js
new file mode 100644
index 000000000..69f56a9ec
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/byteLength.js
@@ -0,0 +1,9 @@
+// SharedArrayBuffer.prototype.byteLength
+
+if (!this.SharedArrayBuffer)
+    quit(0);
+
+load(libdir + "asserts.js");
+
+let buffer = new SharedArrayBuffer(137);
+assertEq(buffer.byteLength, 137);
diff --git a/js/src/jit-test/tests/sharedbuf/gc-one-view.js b/js/src/jit-test/tests/sharedbuf/gc-one-view.js
new file mode 100644
index 000000000..65a44d022
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/gc-one-view.js
@@ -0,0 +1,10 @@
+// Test tracing of a single linked ArrayBufferViewObject.
+
+function f() {
+    var x = new SharedArrayBuffer(0x1000);
+    var y = new Int32Array(x);
+    gc();
+}
+
+if (this.SharedArrayBuffer)
+    f();
diff --git a/js/src/jit-test/tests/sharedbuf/gc-two-views.js b/js/src/jit-test/tests/sharedbuf/gc-two-views.js
new file mode 100644
index 000000000..b130092c5
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/gc-two-views.js
@@ -0,0 +1,11 @@
+// Test tracing of two views of a SharedArrayBuffer. Uses a different path.
+
+function f() {
+    var x = new SharedArrayBuffer(0x1000);
+    var y = new Int32Array(x);
+    var z = new Int8Array(x);
+    gc();
+}
+
+if (this.SharedArrayBuffer)
+    f();
diff --git a/js/src/jit-test/tests/sharedbuf/inline-access.js b/js/src/jit-test/tests/sharedbuf/inline-access.js
new file mode 100644
index 000000000..62e31b742
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/inline-access.js
@@ -0,0 +1,29 @@
+// |jit-test| slow;
+//
+// This is for testing inlining behavior in the jits.
+//
+// For Baseline, run:
+//    $ IONFLAGS=bl-ic .../js --ion-off --baseline-eager inline-access.js
+// Then inspect the output, there should be calls to "GetElem(TypedArray[Int32])",
+// "GetProp(NativeObj/NativeGetter 0x...)", and "SetElem_TypedArray stub"
+// for the read access, length access, and write access respectively, within f.
+//
+// For Ion, run:
+//    $ IONFLAGS=logs .../js --ion-offthread-compile=off inline-access.js
+// Then postprocess with iongraph and verify (by inspecting MIR late in the pipeline)
+// that it contains instructions like "typedarraylength", "loadtypedarrayelement",
+// and "storetypedarrayelement".
+
+if (!this.SharedArrayBuffer)
+    quit();
+
+function f(ta) {
+    return (ta[2] = ta[0] + ta[1] + ta.length);
+}
+
+var v = new Int32Array(new SharedArrayBuffer(4096));
+var sum = 0;
+var iter = 1000;
+for ( var i=0 ; i < iter ; i++ )
+    sum += f(v);
+assertEq(sum, v.length * iter);
diff --git a/js/src/jit-test/tests/sharedbuf/is-zeroed.js b/js/src/jit-test/tests/sharedbuf/is-zeroed.js
new file mode 100644
index 000000000..a6ac32b0f
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/is-zeroed.js
@@ -0,0 +1,12 @@
+// Test that the SharedArrayBuffer memory is properly zeroed.
+
+function f() {
+    var x = new SharedArrayBuffer(4096);
+    var y = new Int32Array(x);
+    assertEq(y[0], 0);
+    assertEq(y[1], 0);
+    assertEq(y[1023], 0);
+}
+
+if (this.SharedArrayBuffer)
+    f();
diff --git a/js/src/jit-test/tests/sharedbuf/sab-construct-noargs-1068458.js b/js/src/jit-test/tests/sharedbuf/sab-construct-noargs-1068458.js
new file mode 100644
index 000000000..858808248
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/sab-construct-noargs-1068458.js
@@ -0,0 +1,15 @@
+if (!this.SharedArrayBuffer)
+    quit();
+
+// Note that as of 2014-09-18 it is not correct to construct a SharedArrayBuffer without
+// a length acceptable to asm.js: at-least 4K AND (power-of-two OR multiple-of-16M).
+// That is likely to change however (see bug 1068684).  The test case is constructed
+// to take that into account by catching exceptions.  That does not impact the
+// original bug, which is an assertion in the implementation.
+
+try {
+    new SharedArrayBuffer	// No arguments
+}
+catch (e) {
+    // Ignore it
+}
diff --git a/js/src/jit-test/tests/sharedbuf/sab-gating.js b/js/src/jit-test/tests/sharedbuf/sab-gating.js
new file mode 100644
index 000000000..4ecd13ddd
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/sab-gating.js
@@ -0,0 +1,8 @@
+// Check gating of shared memory features in plain js (bug 1231338).
+
+// Need this testing function to continue.
+if (!this.sharedMemoryEnabled)
+    quit(0);
+
+assertEq(sharedMemoryEnabled(), !!this.SharedArrayBuffer);
+assertEq(sharedMemoryEnabled(), !!this.Atomics);
diff --git a/js/src/jit-test/tests/sharedbuf/slice.js b/js/src/jit-test/tests/sharedbuf/slice.js
new file mode 100644
index 000000000..d9c6b7a67
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/slice.js
@@ -0,0 +1,122 @@
+// SharedArrayBuffer.prototype.slice
+
+if (!this.SharedArrayBuffer)
+    quit(0);
+
+load(libdir + "asserts.js");
+
+let buf = new SharedArrayBuffer(1024);
+let bufAsI8 = new Int8Array(buf);
+for ( let i=0 ; i < buf.length ; i++ )
+    bufAsI8[i] = i;
+
+let base = 10;
+let len = 10;
+
+let buf2 = buf.slice(base, base+len);
+
+// Smells right?
+assertEq(buf2 instanceof SharedArrayBuffer, true);
+assertEq(buf2.byteLength, len);
+
+// Data got copied correctly?
+let buf2AsI8 = new Int8Array(buf2);
+for ( let i=0 ; i < buf2AsI8.length ; i++ )
+    assertEq(buf2AsI8[i], bufAsI8[base+i]);
+
+// Storage not shared?
+let correct = bufAsI8[base];
+bufAsI8[base]++;
+assertEq(buf2AsI8[0], correct);
+
+// Start beyond end
+let notail = buf.slice(buf.byteLength+1);
+assertEq(notail.byteLength, 0);
+
+// Negative start
+let tail = buf.slice(-5, buf.byteLength);
+assertEq(tail.byteLength, 5);
+let tailAsI8 = new Int8Array(tail);
+for ( let i=0 ; i < tailAsI8.length ; i++ )
+    assertEq(tailAsI8[i], bufAsI8[buf.byteLength-5+i]);
+
+// Negative end
+let head = buf.slice(0, -5);
+assertEq(head.byteLength, buf.byteLength-5);
+let headAsI8 = new Int8Array(head);
+for ( let i=0 ; i < headAsI8.length ; i++ )
+    assertEq(headAsI8[i], bufAsI8[i]);
+
+// Subtyping
+class MySharedArrayBuffer1 extends SharedArrayBuffer {
+    constructor(n) { super(n) }
+}
+
+let myBuf = new MySharedArrayBuffer1(1024);
+
+let myBufAsI8 = new Int8Array(myBuf);
+for ( let i=0 ; i < myBuf.length ; i++ )
+    myBufAsI8[i] = i;
+
+let myBufSlice = myBuf.slice(0, 20);
+
+assertEq(myBufSlice instanceof MySharedArrayBuffer1, true);
+
+assertEq(myBufSlice.byteLength, 20);
+
+let myBufSliceAsI8 = new Int8Array(myBufSlice);
+for ( let i=0 ; i < myBufSlice.length ; i++ )
+    assertEq(myBufAsI8[i], myBufSliceAsI8[i]);
+
+// Error mode: the method requires an object
+assertThrowsInstanceOf(() => buf.slice.call(false, 0, 1), TypeError);
+
+// Error mode: the method is not generic.
+assertThrowsInstanceOf(() => buf.slice.call([1,2,3], 0, 1), TypeError);
+
+// Error mode (step 15): the buffer constructed on behalf of slice
+// is too short.
+
+class MySharedArrayBuffer2 extends SharedArrayBuffer {
+    constructor(n) { super(n-1) }
+}
+
+let myBuf2 = new MySharedArrayBuffer2(10);
+
+assertThrowsInstanceOf(() => myBuf2.slice(0, 5), TypeError);
+
+// Error mode (step 13): the buffer constructed on behalf of slice
+// is not a SharedArrayBuffer.
+
+let subvert = false;
+
+class MySharedArrayBuffer3 extends SharedArrayBuffer {
+    constructor(n) {
+	super(n);
+	if (subvert)
+	    return new Array(n);
+    }
+}
+
+let myBuf3 = new MySharedArrayBuffer3(10);
+
+subvert = true;
+assertThrowsInstanceOf(() => myBuf3.slice(0, 5), TypeError);
+
+// Error mode (step 14): the buffer constructed on behalf of slice
+// is the same as the input buffer.
+
+let sneaky = null;
+
+class MySharedArrayBuffer4 extends SharedArrayBuffer {
+    constructor(n) {
+	super(n);
+	if (sneaky)
+	    return sneaky;
+    }
+}
+
+let myBuf4 = new MySharedArrayBuffer4(10);
+
+sneaky = myBuf4;
+assertThrowsInstanceOf(() => myBuf4.slice(0, 5), TypeError);
diff --git a/js/src/jit-test/tests/sharedbuf/subtypes.js b/js/src/jit-test/tests/sharedbuf/subtypes.js
new file mode 100644
index 000000000..ce893cc45
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/subtypes.js
@@ -0,0 +1,53 @@
+// Test cases for subclasses of SharedArrayBuffer.
+
+if (!this.SharedArrayBuffer)
+    quit(0);
+
+load(libdir + "asserts.js");
+
+// Basic subclassing.
+
+class MySharedArrayBuffer1 extends SharedArrayBuffer {
+    constructor(n) { super(n) }
+}
+
+let mv1 = new MySharedArrayBuffer1(1024);
+assertEq(mv1 instanceof SharedArrayBuffer, true);
+assertEq(mv1 instanceof MySharedArrayBuffer1, true);
+assertEq(mv1.byteLength, 1024);
+
+// Can construct views on the subclasses and read/write elements.
+
+let mva1 = new Int8Array(mv1);
+assertEq(mva1.length, mv1.byteLength);
+assertEq(mva1.buffer, mv1);
+
+for ( let i=1 ; i < mva1.length ; i++ )
+    mva1[i] = i;
+
+for ( let i=1 ; i < mva1.length ; i++ )
+    assertEq(mva1[i], (i << 24) >> 24);
+
+// Passing modified arguments to superclass to get a different length.
+
+class MySharedArrayBuffer2 extends SharedArrayBuffer {
+    constructor(n) { super(n-1) }
+}
+
+let mv2 = new MySharedArrayBuffer2(10);
+assertEq(mv2 instanceof SharedArrayBuffer, true);
+assertEq(mv2 instanceof MySharedArrayBuffer2, true);
+assertEq(mv2.byteLength, 9);
+
+// Returning a different object altogether.
+
+class MySharedArrayBuffer3 extends SharedArrayBuffer {
+    constructor(n) {
+	return new Array(n);
+    }
+}
+
+let mv3 = new MySharedArrayBuffer3(10);
+assertEq(mv3 instanceof Array, true);
+assertEq(mv3 instanceof MySharedArrayBuffer3, false);
+assertEq(mv3.length, 10);
diff --git a/js/src/jit-test/tests/sharedbuf/typedarray-from-sharedtypedarray-with-overridden-length.js b/js/src/jit-test/tests/sharedbuf/typedarray-from-sharedtypedarray-with-overridden-length.js
new file mode 100644
index 000000000..33992a869
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/typedarray-from-sharedtypedarray-with-overridden-length.js
@@ -0,0 +1,25 @@
+if (!this.SharedArrayBuffer)
+    quit(0);
+
+// This would hit an assertion in debug builds due to an incorrect
+// type guard in the code that copies data from STA to TA.
+
+// Original test case
+
+var sab = new SharedArrayBuffer(4);
+
+var x = new Int32Array(sab);
+x.__proto__ = (function(){});
+new Uint8Array(x);		// Would assert here
+
+// Supposedly equivalent test case, provoking the error directly
+
+var x = new Int32Array(sab);
+Object.defineProperty(x, "length", { value: 0 });
+new Uint8Array(x);		// Would assert here
+
+// Derived test case - would not tickle the bug, though.
+
+var x = new Int32Array(sab);
+Object.defineProperty(x, "length", { value: 1 << 20 });
+new Uint8Array(x);