Changeset 243843 in webkit

Timestamp:

Apr 3, 2019, 6:28:49 PM (7 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] Add dump feature for RandomizingFuzzerAgent
​https://bugs.webkit.org/show_bug.cgi?id=196586

Reviewed by Saam Barati.

Towards deterministic tests for the results from randomizing fuzzer agent, this patch adds Options::dumpRandomizingFuzzerAgentPredictions, which dumps the generated types.
The results is like this.

getPrediction name:(#C2q9xD),bytecodeIndex:(22),original:(Array),generated:(OtherObj|Array|Float64Array|BigInt|NonIntAsDouble)
getPrediction name:(makeUnwriteableUnconfigurableObject#AiEJv1),bytecodeIndex:(14),original:(OtherObj),generated:(Final|Uint8Array|Float64Array|SetObject|WeakSetObject|BigInt|NonIntAsDouble)

• runtime/Options.cpp:

(JSC::recomputeDependentOptions):

• runtime/Options.h:
• runtime/RandomizingFuzzerAgent.cpp:

(JSC::RandomizingFuzzerAgent::getPrediction):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/Options.cpp (modified) (1 diff)
• runtime/Options.h (modified) (1 diff)
• runtime/RandomizingFuzzerAgent.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-04-03  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Add dump feature for RandomizingFuzzerAgent
+        https://bugs.webkit.org/show_bug.cgi?id=196586
+
+        Reviewed by Saam Barati.
+
+        Towards deterministic tests for the results from randomizing fuzzer agent, this patch adds Options::dumpRandomizingFuzzerAgentPredictions, which dumps the generated types.
+        The results is like this.
+
+            getPrediction name:(#C2q9xD),bytecodeIndex:(22),original:(Array),generated:(OtherObj|Array|Float64Array|BigInt|NonIntAsDouble)
+            getPrediction name:(makeUnwriteableUnconfigurableObject#AiEJv1),bytecodeIndex:(14),original:(OtherObj),generated:(Final|Uint8Array|Float64Array|SetObject|WeakSetObject|BigInt|NonIntAsDouble)
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+        * runtime/RandomizingFuzzerAgent.cpp:
+        (JSC::RandomizingFuzzerAgent::getPrediction):
+
 2019-04-03  Myles C. Maxfield  <mmaxfield@apple.com>
 

trunk/Source/JavaScriptCore/runtime/Options.cpp

@@ -452 +452 @@
         || Options::verboseCFA()
         || Options::verboseDFGFailure()
-        || Options::verboseFTLFailure())
+        || Options::verboseFTLFailure()
+        || Options::dumpRandomizingFuzzerAgentPredictions())
         Options::alwaysComputeHash() = true;
     

trunk/Source/JavaScriptCore/runtime/Options.h

@@ -437 +437 @@
     v(bool, useRandomizingFuzzerAgent, false, Normal, nullptr) \
     v(unsigned, seedOfRandomizingFuzzerAgent, 1, Normal, nullptr) \
+    v(bool, dumpRandomizingFuzzerAgentPredictions, false, Normal, nullptr) \
     \
     v(bool, logPhaseTimes, false, Normal, nullptr) \

trunk/Source/JavaScriptCore/runtime/RandomizingFuzzerAgent.cpp

@@ -34 +34 @@
 }
 
-SpeculatedType RandomizingFuzzerAgent::getPrediction(CodeBlock*, int, SpeculatedType)
+SpeculatedType RandomizingFuzzerAgent::getPrediction(CodeBlock* codeBlock, int bytecodeIndex, SpeculatedType original)
 {
     auto locker = holdLock(m_lock);
     uint32_t high = m_random.getUint32();
     uint32_t low = m_random.getUint32();
-    uint64_t result = (static_cast<uint64_t>(high) << 32) | low;
-    return static_cast<SpeculatedType>(result) & SpecFullTop;
+    SpeculatedType generated = static_cast<SpeculatedType>((static_cast<uint64_t>(high) << 32) | low) & SpecFullTop;
+    if (Options::dumpRandomizingFuzzerAgentPredictions())
+        dataLogLn("getPrediction name:(", codeBlock->inferredName(), "#", codeBlock->hashAsStringIfPossible(), "),bytecodeIndex:(", bytecodeIndex, "),original:(", SpeculationDump(original), "),generated:(", SpeculationDump(generated), ")");
+    return generated;
 }