Bug 929786 - Add shell function to neutering (r=sfink)

--HG--
extra : rebase_source : 3134a925596555755908f11017bd4203fc663eb1

js/src/builtin/TestingFunctions.cpp

@@ -1318,6 +1318,24 @@ Deserialize(JSContext *cx, unsigned argc, jsval *vp)
     return true;
 }
 
+static bool
+Neuter(JSContext *cx, unsigned argc, jsval *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    RootedObject obj(cx);
+    if (!JS_ValueToObject(cx, args.get(0), &obj))
+        return false;
+
+    void *contents;
+    uint8_t *data;
+    if (!JS_StealArrayBufferContents(cx, obj, &contents, &data))
+        return false;
+
+    js_free(contents);
+    return true;
+}
+
 static const JSFunctionSpecWithHelp TestingFunctions[] = {
     JS_FN_HELP("gc", ::GC, 0, 0,
 "gc([obj] | 'compartment')",
@@ -1532,6 +1550,10 @@ static const JSFunctionSpecWithHelp TestingFunctions[] = {
 "deserialize(clonebuffer)",
 "  Deserialize data generated by serialize."),
 
+    JS_FN_HELP("neuter", Neuter, 1, 0,
+"neuter(buffer)",
+"  Neuter the given ArrayBuffer object as if it had been transferred to a WebWorker."),
+
     JS_FS_HELP_END
 };
 

js/src/jit-test/tests/basic/testNeutering.js

@@ -0,0 +1,23 @@
+var ab = new ArrayBuffer(4);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);
+
+var ab = new ArrayBuffer(12);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);
+
+var ab = new ArrayBuffer(4096);
+var i32 = new Int32Array(ab);
+i32[0] = 42;
+neuter(ab);
+assertEq(i32.length, 0);
+assertEq(ab.byteLength, 0);
+assertEq(i32[0], undefined);