Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (243884 => 243885)
--- trunk/Source/_javascript_Core/ChangeLog 2019-04-04 18:45:10 UTC (rev 243884)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-04-04 18:53:08 UTC (rev 243885)
@@ -1,3 +1,23 @@
+2019-04-04 Yusuke Suzuki <[email protected]>
+
+ [JSC] Pass CodeOrigin to FuzzerAgent
+ https://bugs.webkit.org/show_bug.cgi?id=196590
+
+ Reviewed by Saam Barati.
+
+ Pass CodeOrigin instead of bytecodeIndex. CodeOrigin includes richer information (InlineCallFrame*).
+ We also mask prediction with SpecBytecodeTop in DFGByteCodeParser. The fuzzer can produce any SpeculatedTypes,
+ but DFGByteCodeParser should only see predictions that can be actually produced from the bytecode execution.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+ * runtime/FuzzerAgent.cpp:
+ (JSC::FuzzerAgent::getPrediction):
+ * runtime/FuzzerAgent.h:
+ * runtime/RandomizingFuzzerAgent.cpp:
+ (JSC::RandomizingFuzzerAgent::getPrediction):
+ * runtime/RandomizingFuzzerAgent.h:
+
2019-04-04 Caio Lima <[email protected]>
[JSC] We should consider moving UnlinkedFunctionExecutable::m_parentScopeTDZVariables to RareData
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (243884 => 243885)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2019-04-04 18:45:10 UTC (rev 243884)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2019-04-04 18:53:08 UTC (rev 243885)
@@ -832,20 +832,20 @@
SpeculatedType getPredictionWithoutOSRExit(unsigned bytecodeIndex)
{
- auto getValueProfilePredictionFromForCodeBlockAndBytecodeOffset = [&] (CodeBlock* codeBlock, int bytecodeIndex)
+ auto getValueProfilePredictionFromForCodeBlockAndBytecodeOffset = [&] (CodeBlock* codeBlock, const CodeOrigin& codeOrigin)
{
SpeculatedType prediction;
{
ConcurrentJSLocker locker(codeBlock->m_lock);
- prediction = codeBlock->valueProfilePredictionForBytecodeOffset(locker, bytecodeIndex);
+ prediction = codeBlock->valueProfilePredictionForBytecodeOffset(locker, codeOrigin.bytecodeIndex());
}
auto* fuzzerAgent = m_vm->fuzzerAgent();
if (UNLIKELY(fuzzerAgent))
- return fuzzerAgent->getPrediction(codeBlock, bytecodeIndex, prediction);
+ return fuzzerAgent->getPrediction(codeBlock, codeOrigin, prediction) & SpecBytecodeTop;
return prediction;
};
- SpeculatedType prediction = getValueProfilePredictionFromForCodeBlockAndBytecodeOffset(m_inlineStackTop->m_profiledBlock, bytecodeIndex);
+ SpeculatedType prediction = getValueProfilePredictionFromForCodeBlockAndBytecodeOffset(m_inlineStackTop->m_profiledBlock, CodeOrigin(bytecodeIndex, inlineCallFrame()));
if (prediction != SpecNone)
return prediction;
@@ -879,7 +879,7 @@
while (stack->m_inlineCallFrame != codeOrigin->inlineCallFrame())
stack = stack->m_caller;
- return getValueProfilePredictionFromForCodeBlockAndBytecodeOffset(stack->m_profiledBlock, codeOrigin->bytecodeIndex());
+ return getValueProfilePredictionFromForCodeBlockAndBytecodeOffset(stack->m_profiledBlock, *codeOrigin);
}
default:
Modified: trunk/Source/_javascript_Core/runtime/FuzzerAgent.cpp (243884 => 243885)
--- trunk/Source/_javascript_Core/runtime/FuzzerAgent.cpp 2019-04-04 18:45:10 UTC (rev 243884)
+++ trunk/Source/_javascript_Core/runtime/FuzzerAgent.cpp 2019-04-04 18:53:08 UTC (rev 243885)
@@ -32,7 +32,7 @@
{
}
-SpeculatedType FuzzerAgent::getPrediction(CodeBlock*, int, SpeculatedType result)
+SpeculatedType FuzzerAgent::getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType result)
{
return result;
}
Modified: trunk/Source/_javascript_Core/runtime/FuzzerAgent.h (243884 => 243885)
--- trunk/Source/_javascript_Core/runtime/FuzzerAgent.h 2019-04-04 18:45:10 UTC (rev 243884)
+++ trunk/Source/_javascript_Core/runtime/FuzzerAgent.h 2019-04-04 18:53:08 UTC (rev 243885)
@@ -25,8 +25,8 @@
#pragma once
+#include "CodeOrigin.h"
#include "SpeculatedType.h"
-#include <wtf/Locker.h>
namespace JSC {
@@ -36,7 +36,7 @@
public:
JS_EXPORT_PRIVATE virtual ~FuzzerAgent();
- JS_EXPORT_PRIVATE virtual SpeculatedType getPrediction(CodeBlock*, int bytecodeOffset, SpeculatedType);
+ JS_EXPORT_PRIVATE virtual SpeculatedType getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType);
};
} // namespace JSC
Modified: trunk/Source/_javascript_Core/runtime/RandomizingFuzzerAgent.cpp (243884 => 243885)
--- trunk/Source/_javascript_Core/runtime/RandomizingFuzzerAgent.cpp 2019-04-04 18:45:10 UTC (rev 243884)
+++ trunk/Source/_javascript_Core/runtime/RandomizingFuzzerAgent.cpp 2019-04-04 18:53:08 UTC (rev 243885)
@@ -27,6 +27,7 @@
#include "RandomizingFuzzerAgent.h"
#include "CodeBlock.h"
+#include <wtf/Locker.h>
namespace JSC {
@@ -35,7 +36,7 @@
{
}
-SpeculatedType RandomizingFuzzerAgent::getPrediction(CodeBlock* codeBlock, int bytecodeIndex, SpeculatedType original)
+SpeculatedType RandomizingFuzzerAgent::getPrediction(CodeBlock* codeBlock, const CodeOrigin& codeOrigin, SpeculatedType original)
{
auto locker = holdLock(m_lock);
uint32_t high = m_random.getUint32();
@@ -42,7 +43,7 @@
uint32_t low = m_random.getUint32();
SpeculatedType generated = static_cast<SpeculatedType>((static_cast<uint64_t>(high) << 32) | low) & SpecFullTop;
if (Options::dumpRandomizingFuzzerAgentPredictions())
- dataLogLn("getPrediction name:(", codeBlock->inferredName(), "#", codeBlock->hashAsStringIfPossible(), "),bytecodeIndex:(", bytecodeIndex, "),original:(", SpeculationDump(original), "),generated:(", SpeculationDump(generated), ")");
+ dataLogLn("getPrediction name:(", codeBlock->inferredName(), "#", codeBlock->hashAsStringIfPossible(), "),bytecodeIndex:(", codeOrigin.bytecodeIndex(), "),original:(", SpeculationDump(original), "),generated:(", SpeculationDump(generated), ")");
return generated;
}
Modified: trunk/Source/_javascript_Core/runtime/RandomizingFuzzerAgent.h (243884 => 243885)
--- trunk/Source/_javascript_Core/runtime/RandomizingFuzzerAgent.h 2019-04-04 18:45:10 UTC (rev 243884)
+++ trunk/Source/_javascript_Core/runtime/RandomizingFuzzerAgent.h 2019-04-04 18:53:08 UTC (rev 243885)
@@ -37,7 +37,7 @@
public:
RandomizingFuzzerAgent(VM&);
- SpeculatedType getPrediction(CodeBlock*, int bytecodeOffset, SpeculatedType) override;
+ SpeculatedType getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType) override;
private:
WeakRandom m_random;
