Changeset 243885 in webkit

Timestamp:

Apr 4, 2019, 11:53:08 AM (7 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] Pass CodeOrigin to FuzzerAgent
​https://bugs.webkit.org/show_bug.cgi?id=196590

Reviewed by Saam Barati.

Pass CodeOrigin instead of bytecodeIndex. CodeOrigin includes richer information (InlineCallFrame*).
We also mask prediction with SpecBytecodeTop in DFGByteCodeParser. The fuzzer can produce any SpeculatedTypes,
but DFGByteCodeParser should only see predictions that can be actually produced from the bytecode execution.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):

• runtime/FuzzerAgent.cpp:

(JSC::FuzzerAgent::getPrediction):

• runtime/FuzzerAgent.h:
• runtime/RandomizingFuzzerAgent.cpp:

(JSC::RandomizingFuzzerAgent::getPrediction):

• runtime/RandomizingFuzzerAgent.h:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGByteCodeParser.cpp (modified) (2 diffs)
• runtime/FuzzerAgent.cpp (modified) (1 diff)
• runtime/FuzzerAgent.h (modified) (2 diffs)
• runtime/RandomizingFuzzerAgent.cpp (modified) (3 diffs)
• runtime/RandomizingFuzzerAgent.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-04-04  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Pass CodeOrigin to FuzzerAgent
+        https://bugs.webkit.org/show_bug.cgi?id=196590
+
+        Reviewed by Saam Barati.
+
+        Pass CodeOrigin instead of bytecodeIndex. CodeOrigin includes richer information (InlineCallFrame*).
+        We also mask prediction with SpecBytecodeTop in DFGByteCodeParser. The fuzzer can produce any SpeculatedTypes,
+        but DFGByteCodeParser should only see predictions that can be actually produced from the bytecode execution.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        * runtime/FuzzerAgent.cpp:
+        (JSC::FuzzerAgent::getPrediction):
+        * runtime/FuzzerAgent.h:
+        * runtime/RandomizingFuzzerAgent.cpp:
+        (JSC::RandomizingFuzzerAgent::getPrediction):
+        * runtime/RandomizingFuzzerAgent.h:
+
 2019-04-04  Caio Lima  <ticaiolima@gmail.com>
 

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -833 +833 @@
     SpeculatedType getPredictionWithoutOSRExit(unsigned bytecodeIndex)
     {
-        auto getValueProfilePredictionFromForCodeBlockAndBytecodeOffset = [&] (CodeBlock* codeBlock, int bytecodeIndex)
+        auto getValueProfilePredictionFromForCodeBlockAndBytecodeOffset = [&] (CodeBlock* codeBlock, const CodeOrigin& codeOrigin)
         {
             SpeculatedType prediction;
             {
                 ConcurrentJSLocker locker(codeBlock->m_lock);
-                prediction = codeBlock->valueProfilePredictionForBytecodeOffset(locker, bytecodeIndex);
+                prediction = codeBlock->valueProfilePredictionForBytecodeOffset(locker, codeOrigin.bytecodeIndex());
             }
             auto* fuzzerAgent = m_vm->fuzzerAgent();
             if (UNLIKELY(fuzzerAgent))
-                return fuzzerAgent->getPrediction(codeBlock, bytecodeIndex, prediction);
+                return fuzzerAgent->getPrediction(codeBlock, codeOrigin, prediction) & SpecBytecodeTop;
             return prediction;
         };
 
-        SpeculatedType prediction = getValueProfilePredictionFromForCodeBlockAndBytecodeOffset(m_inlineStackTop->m_profiledBlock, bytecodeIndex);
+        SpeculatedType prediction = getValueProfilePredictionFromForCodeBlockAndBytecodeOffset(m_inlineStackTop->m_profiledBlock, CodeOrigin(bytecodeIndex, inlineCallFrame()));
         if (prediction != SpecNone)
             return prediction;
@@ -880 +880 @@
                 stack = stack->m_caller;
 
-            return getValueProfilePredictionFromForCodeBlockAndBytecodeOffset(stack->m_profiledBlock, codeOrigin->bytecodeIndex());
+            return getValueProfilePredictionFromForCodeBlockAndBytecodeOffset(stack->m_profiledBlock, *codeOrigin);
         }
 

trunk/Source/JavaScriptCore/runtime/FuzzerAgent.cpp

@@ -33 +33 @@
 }
 
-SpeculatedType FuzzerAgent::getPrediction(CodeBlock*, int, SpeculatedType result)
+SpeculatedType FuzzerAgent::getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType result)
 {
     return result;

trunk/Source/JavaScriptCore/runtime/FuzzerAgent.h

@@ -26 +26 @@
 #pragma once
 
+#include "CodeOrigin.h"
 #include "SpeculatedType.h"
-#include <wtf/Locker.h>
 
 namespace JSC {
@@ -37 +37 @@
     JS_EXPORT_PRIVATE virtual ~FuzzerAgent();
 
-    JS_EXPORT_PRIVATE virtual SpeculatedType getPrediction(CodeBlock*, int bytecodeOffset, SpeculatedType);
+    JS_EXPORT_PRIVATE virtual SpeculatedType getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType);
 };
 

trunk/Source/JavaScriptCore/runtime/RandomizingFuzzerAgent.cpp

@@ -28 +28 @@
 
 #include "CodeBlock.h"
+#include <wtf/Locker.h>
 
 namespace JSC {
@@ -36 +37 @@
 }
 
-SpeculatedType RandomizingFuzzerAgent::getPrediction(CodeBlock* codeBlock, int bytecodeIndex, SpeculatedType original)
+SpeculatedType RandomizingFuzzerAgent::getPrediction(CodeBlock* codeBlock, const CodeOrigin& codeOrigin, SpeculatedType original)
 {
     auto locker = holdLock(m_lock);
@@ -43 +44 @@
     SpeculatedType generated = static_cast<SpeculatedType>((static_cast<uint64_t>(high) << 32) | low) & SpecFullTop;
     if (Options::dumpRandomizingFuzzerAgentPredictions())
-        dataLogLn("getPrediction name:(", codeBlock->inferredName(), "#", codeBlock->hashAsStringIfPossible(), "),bytecodeIndex:(", bytecodeIndex, "),original:(", SpeculationDump(original), "),generated:(", SpeculationDump(generated), ")");
+        dataLogLn("getPrediction name:(", codeBlock->inferredName(), "#", codeBlock->hashAsStringIfPossible(), "),bytecodeIndex:(", codeOrigin.bytecodeIndex(), "),original:(", SpeculationDump(original), "),generated:(", SpeculationDump(generated), ")");
     return generated;
 }

trunk/Source/JavaScriptCore/runtime/RandomizingFuzzerAgent.h

@@ -38 +38 @@
     RandomizingFuzzerAgent(VM&);
 
-    SpeculatedType getPrediction(CodeBlock*, int bytecodeOffset, SpeculatedType) override;
+    SpeculatedType getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType) override;
 
 private: