- Revision
- 243843
- Author
- [email protected]
- Date
- 2019-04-03 18:28:49 -0700 (Wed, 03 Apr 2019)
Log Message
[JSC] Add dump feature for RandomizingFuzzerAgent
https://bugs.webkit.org/show_bug.cgi?id=196586
Reviewed by Saam Barati.
Towards deterministic tests for the results from randomizing fuzzer agent, this patch adds Options::dumpRandomizingFuzzerAgentPredictions, which dumps the generated types.
The results is like this.
getPrediction name:(#C2q9xD),bytecodeIndex:(22),original:(Array),generated:(OtherObj|Array|Float64Array|BigInt|NonIntAsDouble)
getPrediction name:(makeUnwriteableUnconfigurableObject#AiEJv1),bytecodeIndex:(14),original:(OtherObj),generated:(Final|Uint8Array|Float64Array|SetObject|WeakSetObject|BigInt|NonIntAsDouble)
* runtime/Options.cpp:
(JSC::recomputeDependentOptions):
* runtime/Options.h:
* runtime/RandomizingFuzzerAgent.cpp:
(JSC::RandomizingFuzzerAgent::getPrediction):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (243842 => 243843)
--- trunk/Source/_javascript_Core/ChangeLog 2019-04-04 00:43:05 UTC (rev 243842)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-04-04 01:28:49 UTC (rev 243843)
@@ -1,3 +1,22 @@
+2019-04-03 Yusuke Suzuki <[email protected]>
+
+ [JSC] Add dump feature for RandomizingFuzzerAgent
+ https://bugs.webkit.org/show_bug.cgi?id=196586
+
+ Reviewed by Saam Barati.
+
+ Towards deterministic tests for the results from randomizing fuzzer agent, this patch adds Options::dumpRandomizingFuzzerAgentPredictions, which dumps the generated types.
+ The results is like this.
+
+ getPrediction name:(#C2q9xD),bytecodeIndex:(22),original:(Array),generated:(OtherObj|Array|Float64Array|BigInt|NonIntAsDouble)
+ getPrediction name:(makeUnwriteableUnconfigurableObject#AiEJv1),bytecodeIndex:(14),original:(OtherObj),generated:(Final|Uint8Array|Float64Array|SetObject|WeakSetObject|BigInt|NonIntAsDouble)
+
+ * runtime/Options.cpp:
+ (JSC::recomputeDependentOptions):
+ * runtime/Options.h:
+ * runtime/RandomizingFuzzerAgent.cpp:
+ (JSC::RandomizingFuzzerAgent::getPrediction):
+
2019-04-03 Myles C. Maxfield <[email protected]>
-apple-trailing-word is needed for browser detection
Modified: trunk/Source/_javascript_Core/runtime/Options.cpp (243842 => 243843)
--- trunk/Source/_javascript_Core/runtime/Options.cpp 2019-04-04 00:43:05 UTC (rev 243842)
+++ trunk/Source/_javascript_Core/runtime/Options.cpp 2019-04-04 01:28:49 UTC (rev 243843)
@@ -451,7 +451,8 @@
|| Options::logPhaseTimes()
|| Options::verboseCFA()
|| Options::verboseDFGFailure()
- || Options::verboseFTLFailure())
+ || Options::verboseFTLFailure()
+ || Options::dumpRandomizingFuzzerAgentPredictions())
Options::alwaysComputeHash() = true;
if (!Options::useConcurrentGC())
Modified: trunk/Source/_javascript_Core/runtime/Options.h (243842 => 243843)
--- trunk/Source/_javascript_Core/runtime/Options.h 2019-04-04 00:43:05 UTC (rev 243842)
+++ trunk/Source/_javascript_Core/runtime/Options.h 2019-04-04 01:28:49 UTC (rev 243843)
@@ -436,6 +436,7 @@
\
v(bool, useRandomizingFuzzerAgent, false, Normal, nullptr) \
v(unsigned, seedOfRandomizingFuzzerAgent, 1, Normal, nullptr) \
+ v(bool, dumpRandomizingFuzzerAgentPredictions, false, Normal, nullptr) \
\
v(bool, logPhaseTimes, false, Normal, nullptr) \
v(double, rareBlockPenalty, 0.001, Normal, nullptr) \
Modified: trunk/Source/_javascript_Core/runtime/RandomizingFuzzerAgent.cpp (243842 => 243843)
--- trunk/Source/_javascript_Core/runtime/RandomizingFuzzerAgent.cpp 2019-04-04 00:43:05 UTC (rev 243842)
+++ trunk/Source/_javascript_Core/runtime/RandomizingFuzzerAgent.cpp 2019-04-04 01:28:49 UTC (rev 243843)
@@ -33,13 +33,15 @@
{
}
-SpeculatedType RandomizingFuzzerAgent::getPrediction(CodeBlock*, int, SpeculatedType)
+SpeculatedType RandomizingFuzzerAgent::getPrediction(CodeBlock* codeBlock, int bytecodeIndex, SpeculatedType original)
{
auto locker = holdLock(m_lock);
uint32_t high = m_random.getUint32();
uint32_t low = m_random.getUint32();
- uint64_t result = (static_cast<uint64_t>(high) << 32) | low;
- return static_cast<SpeculatedType>(result) & SpecFullTop;
+ SpeculatedType generated = static_cast<SpeculatedType>((static_cast<uint64_t>(high) << 32) | low) & SpecFullTop;
+ if (Options::dumpRandomizingFuzzerAgentPredictions())
+ dataLogLn("getPrediction name:(", codeBlock->inferredName(), "#", codeBlock->hashAsStringIfPossible(), "),bytecodeIndex:(", bytecodeIndex, "),original:(", SpeculationDump(original), "),generated:(", SpeculationDump(generated), ")");
+ return generated;
}
} // namespace JSC
