Diff
Modified: trunk/JSTests/ChangeLog (278463 => 278464)
--- trunk/JSTests/ChangeLog 2021-06-04 16:04:35 UTC (rev 278463)
+++ trunk/JSTests/ChangeLog 2021-06-04 16:08:45 UTC (rev 278464)
@@ -1,3 +1,36 @@
+2021-06-04 Keith Miller <[email protected]>
+
+ Fix tests that fail under executable allocation fuzzing
+ https://bugs.webkit.org/show_bug.cgi?id=226593
+
+ Reviewed by Mark Lam.
+
+ * microbenchmarks/memcpy-wasm-large.js:
+ (typeof.WebAssembly.string_appeared_here.try.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
+ (typeof.WebAssembly.string_appeared_here.catch):
+ (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): Deleted.
+ * microbenchmarks/memcpy-wasm-medium.js:
+ (typeof.WebAssembly.string_appeared_here.try.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
+ (typeof.WebAssembly.string_appeared_here.catch):
+ (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): Deleted.
+ * microbenchmarks/memcpy-wasm-small.js:
+ (typeof.WebAssembly.string_appeared_here.try.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
+ (typeof.WebAssembly.string_appeared_here.catch):
+ (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): Deleted.
+ * microbenchmarks/memcpy-wasm.js:
+ (typeof.WebAssembly.string_appeared_here.try.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
+ (typeof.WebAssembly.string_appeared_here.catch):
+ (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array): Deleted.
+ * stress/bit-op-with-object-returning-int32.js:
+ (numberOfDFGCompiles):
+ (bitOr): Deleted.
+ (bitXor): Deleted.
+ (bitNot): Deleted.
+ (bitLShift): Deleted.
+ * stress/bitwise-not-fixup-rules.js:
+ (numberOfDFGCompiles):
+ (let.o.valueOf): Deleted.
+
2021-06-04 Tadeu Zagallo <[email protected]>
Optimize Function.prototype.toString
Modified: trunk/JSTests/microbenchmarks/memcpy-wasm-large.js (278463 => 278464)
--- trunk/JSTests/microbenchmarks/memcpy-wasm-large.js 2021-06-04 16:04:35 UTC (rev 278463)
+++ trunk/JSTests/microbenchmarks/memcpy-wasm-large.js 2021-06-04 16:08:45 UTC (rev 278464)
@@ -15,21 +15,25 @@
i32[i] = i;
}
-const $1 = new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([
-0,97,115,109,1,0,0,0,1,7,1,96,3,127,127,127,0,2,12,1,2,106,115,3,109,101,109,2,1,pages,pages,3,2,1,0,6,1,0,7,13,1,9,100,111,95,109,101,109,99,112,121,0,0,10,57,1,55,1,1,127,65,0,33,3,3,64,2,64,32,2,32,3,70,13,0,32,1,65,4,108,32,3,65,4,108,106,32,0,32,3,65,4,108,106,40,0,0,54,0,0,32,3,65,1,106,33,3,12,1,11,11,11
-])), { js: { mem: memory } });
+try {
+ const $1 = new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([
+ 0,97,115,109,1,0,0,0,1,7,1,96,3,127,127,127,0,2,12,1,2,106,115,3,109,101,109,2,1,pages,pages,3,2,1,0,6,1,0,7,13,1,9,100,111,95,109,101,109,99,112,121,0,0,10,57,1,55,1,1,127,65,0,33,3,3,64,2,64,32,2,32,3,70,13,0,32,1,65,4,108,32,3,65,4,108,106,32,0,32,3,65,4,108,106,40,0,0,54,0,0,32,3,65,1,106,33,3,12,1,11,11,11
+ ])), { js: { mem: memory } });
-for (let i=0; i<500; ++i)
- $1.exports.do_memcpy(0,50000,40000);
+ for (let i=0; i<500; ++i)
+ $1.exports.do_memcpy(0,50000,40000);
-for (let i = 0; i < 50000; i++) {
- eq(i32[i], i);
+ for (let i = 0; i < 50000; i++) {
+ eq(i32[i], i);
+ }
+ for (let i = 50000; i < 50000+40000; i++) {
+ eq(i32[i], i-50000);
+ }
+ for (let i = 50000+40000; i < 100000; i++) {
+ eq(i32[i], i);
+ }
+} catch (e) {
+ if (jscOptions().useExecutableAllocationFuzz === false)
+ throw e
}
-for (let i = 50000; i < 50000+40000; i++) {
- eq(i32[i], i-50000);
}
-for (let i = 50000+40000; i < 100000; i++) {
- eq(i32[i], i);
-}
-
-}
Modified: trunk/JSTests/microbenchmarks/memcpy-wasm-medium.js (278463 => 278464)
--- trunk/JSTests/microbenchmarks/memcpy-wasm-medium.js 2021-06-04 16:04:35 UTC (rev 278463)
+++ trunk/JSTests/microbenchmarks/memcpy-wasm-medium.js 2021-06-04 16:08:45 UTC (rev 278464)
@@ -15,22 +15,27 @@
i32[i] = i;
}
-const $1 = new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([
-0,97,115,109,1,0,0,0,1,7,1,96,3,127,127,127,0,2,12,1,2,106,115,3,109,101,109,2,1,1,1,3,2,1,0,6,1,0,7,13,1,9,100,111,95,109,101,109,99,112,121,0,0,10,57,1,55,1,1,127,65,0,33,3,3,64,2,64,32,2,32,3,70,13,0,32,1,65,4,108,32,3,65,4,108,106,32,0,32,3,65,4,108,106,40,0,0,54,0,0,32,3,65,1,106,33,3,12,1,11,11,11
-])), { js: { mem: memory } });
+try {
+ const $1 = new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([
+ 0,97,115,109,1,0,0,0,1,7,1,96,3,127,127,127,0,2,12,1,2,106,115,3,109,101,109,2,1,1,1,3,2,1,0,6,1,0,7,13,1,9,100,111,95,109,101,109,99,112,121,0,0,10,57,1,55,1,1,127,65,0,33,3,3,64,2,64,32,2,32,3,70,13,0,32,1,65,4,108,32,3,65,4,108,106,32,0,32,3,65,4,108,106,40,0,0,54,0,0,32,3,65,1,106,33,3,12,1,11,11,11
+ ])), { js: { mem: memory } });
-for (let i=0; i<1000000; ++i)
- $1.exports.do_memcpy(0,5,5);
+ for (let i=0; i<1000000; ++i)
+ $1.exports.do_memcpy(0,5,5);
-eq(i32[0], 0);
-eq(i32[1], 1);
-eq(i32[2], 2);
-eq(i32[3], 3);
-eq(i32[4], 4);
-eq(i32[5], 0);
-eq(i32[6], 1);
-eq(i32[7], 2);
-eq(i32[8], 3);
-eq(i32[9], 4);
+ eq(i32[0], 0);
+ eq(i32[1], 1);
+ eq(i32[2], 2);
+ eq(i32[3], 3);
+ eq(i32[4], 4);
+ eq(i32[5], 0);
+ eq(i32[6], 1);
+ eq(i32[7], 2);
+ eq(i32[8], 3);
+ eq(i32[9], 4);
+} catch (e) {
+ if (jscOptions().useExecutableAllocationFuzz === false)
+ throw e
+}
}
Modified: trunk/JSTests/microbenchmarks/memcpy-wasm-small.js (278463 => 278464)
--- trunk/JSTests/microbenchmarks/memcpy-wasm-small.js 2021-06-04 16:04:35 UTC (rev 278463)
+++ trunk/JSTests/microbenchmarks/memcpy-wasm-small.js 2021-06-04 16:08:45 UTC (rev 278464)
@@ -14,16 +14,21 @@
i32[i] = i;
}
-const $1 = new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([
-0,97,115,109,1,0,0,0,1,7,1,96,3,127,127,127,0,2,12,1,2,106,115,3,109,101,109,2,1,1,1,3,2,1,0,6,1,0,7,13,1,9,100,111,95,109,101,109,99,112,121,0,0,10,57,1,55,1,1,127,65,0,33,3,3,64,2,64,32,2,32,3,70,13,0,32,1,65,4,108,32,3,65,4,108,106,32,0,32,3,65,4,108,106,40,0,0,54,0,0,32,3,65,1,106,33,3,12,1,11,11,11
-])), { js: { mem: memory } });
+try {
+ const $1 = new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([
+ 0,97,115,109,1,0,0,0,1,7,1,96,3,127,127,127,0,2,12,1,2,106,115,3,109,101,109,2,1,1,1,3,2,1,0,6,1,0,7,13,1,9,100,111,95,109,101,109,99,112,121,0,0,10,57,1,55,1,1,127,65,0,33,3,3,64,2,64,32,2,32,3,70,13,0,32,1,65,4,108,32,3,65,4,108,106,32,0,32,3,65,4,108,106,40,0,0,54,0,0,32,3,65,1,106,33,3,12,1,11,11,11
+ ])), { js: { mem: memory } });
-for (let i=0; i<1000000; ++i)
- $1.exports.do_memcpy(0,2,2);
+ for (let i=0; i<1000000; ++i)
+ $1.exports.do_memcpy(0,2,2);
-eq(i32[0], 0);
-eq(i32[1], 1);
-eq(i32[2], 0);
-eq(i32[3], 1);
+ eq(i32[0], 0);
+ eq(i32[1], 1);
+ eq(i32[2], 0);
+ eq(i32[3], 1);
+} catch (e) {
+ if (jscOptions().useExecutableAllocationFuzz === false)
+ throw e
+}
}
Modified: trunk/JSTests/microbenchmarks/memcpy-wasm.js (278463 => 278464)
--- trunk/JSTests/microbenchmarks/memcpy-wasm.js 2021-06-04 16:04:35 UTC (rev 278463)
+++ trunk/JSTests/microbenchmarks/memcpy-wasm.js 2021-06-04 16:08:45 UTC (rev 278464)
@@ -14,21 +14,26 @@
i32[i] = i;
}
-const $1 = new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([
-0,97,115,109,1,0,0,0,1,7,1,96,3,127,127,127,0,2,12,1,2,106,115,3,109,101,109,2,1,1,1,3,2,1,0,6,1,0,7,13,1,9,100,111,95,109,101,109,99,112,121,0,0,10,57,1,55,1,1,127,65,0,33,3,3,64,2,64,32,2,32,3,70,13,0,32,1,65,4,108,32,3,65,4,108,106,32,0,32,3,65,4,108,106,40,0,0,54,0,0,32,3,65,1,106,33,3,12,1,11,11,11
-])), { js: { mem: memory } });
+try {
+ const $1 = new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([
+ 0,97,115,109,1,0,0,0,1,7,1,96,3,127,127,127,0,2,12,1,2,106,115,3,109,101,109,2,1,1,1,3,2,1,0,6,1,0,7,13,1,9,100,111,95,109,101,109,99,112,121,0,0,10,57,1,55,1,1,127,65,0,33,3,3,64,2,64,32,2,32,3,70,13,0,32,1,65,4,108,32,3,65,4,108,106,32,0,32,3,65,4,108,106,40,0,0,54,0,0,32,3,65,1,106,33,3,12,1,11,11,11
+ ])), { js: { mem: memory } });
-for (let i=0; i<100000; ++i)
- $1.exports.do_memcpy(0,500,300);
+ for (let i=0; i<100000; ++i)
+ $1.exports.do_memcpy(0,500,300);
-for (let i = 0; i < 500; i++) {
- eq(i32[i], i);
+ for (let i = 0; i < 500; i++) {
+ eq(i32[i], i);
+ }
+ for (let i = 500; i < 500+300; i++) {
+ eq(i32[i], i-500);
+ }
+ for (let i = 500+300; i < 1000; i++) {
+ eq(i32[i], i);
+ }
+} catch (e) {
+ if (jscOptions().useExecutableAllocationFuzz === false)
+ throw e
}
-for (let i = 500; i < 500+300; i++) {
- eq(i32[i], i-500);
-}
-for (let i = 500+300; i < 1000; i++) {
- eq(i32[i], i);
-}
}
Modified: trunk/JSTests/stress/bit-op-with-object-returning-int32.js (278463 => 278464)
--- trunk/JSTests/stress/bit-op-with-object-returning-int32.js 2021-06-04 16:04:35 UTC (rev 278463)
+++ trunk/JSTests/stress/bit-op-with-object-returning-int32.js 2021-06-04 16:08:45 UTC (rev 278464)
@@ -9,50 +9,53 @@
}
noInline(bitAnd);
-var o = { valueOf: () => 0b1101 };
+// This can fail if we are fuzzing executable allocation .
+if (numberOfDFGCompiles(bitAnd) === 0) {
-for (var i = 0; i < 10000; i++)
- assert(bitAnd(0b11, o), 0b1);
+ var o = { valueOf: () => 0b1101 };
-assert(numberOfDFGCompiles(bitAnd) <= 1, true);
+ for (var i = 0; i < 10000; i++)
+ assert(bitAnd(0b11, o), 0b1);
-function bitOr(a, b) {
- return a | b;
-}
-noInline(bitOr);
+ assert(numberOfDFGCompiles(bitAnd) <= 1, true);
-for (var i = 0; i < 10000; i++)
- assert(bitOr(0b11, o), 0b1111);
+ function bitOr(a, b) {
+ return a | b;
+ }
+ noInline(bitOr);
-assert(numberOfDFGCompiles(bitOr) <= 1, true);
+ for (var i = 0; i < 10000; i++)
+ assert(bitOr(0b11, o), 0b1111);
-function bitXor(a, b) {
- return a ^ b;
-}
-noInline(bitXor);
+ assert(numberOfDFGCompiles(bitOr) <= 1, true);
-for (var i = 0; i < 10000; i++)
- assert(bitXor(0b0011, o), 0b1110);
+ function bitXor(a, b) {
+ return a ^ b;
+ }
+ noInline(bitXor);
-assert(numberOfDFGCompiles(bitXor) <= 1, true);
+ for (var i = 0; i < 10000; i++)
+ assert(bitXor(0b0011, o), 0b1110);
-function bitNot(a) {
- return ~a;
-}
-noInline(bitNot);
+ assert(numberOfDFGCompiles(bitXor) <= 1, true);
-for (var i = 0; i < 10000; i++)
- assert(bitNot(o), -14);
+ function bitNot(a) {
+ return ~a;
+ }
+ noInline(bitNot);
-assert(numberOfDFGCompiles(bitNot) <= 1, true);
+ for (var i = 0; i < 10000; i++)
+ assert(bitNot(o), -14);
-function bitLShift(a, b) {
- return a << b;
-}
-noInline(bitLShift);
+ assert(numberOfDFGCompiles(bitNot) <= 1, true);
-for (var i = 0; i < 10000; i++)
- assert(bitLShift(o, 3), 0b1101000);
+ function bitLShift(a, b) {
+ return a << b;
+ }
+ noInline(bitLShift);
-assert(numberOfDFGCompiles(bitLShift) <= 1, true);
+ for (var i = 0; i < 10000; i++)
+ assert(bitLShift(o, 3), 0b1101000);
+ assert(numberOfDFGCompiles(bitLShift) <= 1, true);
+}
Modified: trunk/JSTests/stress/bitwise-not-fixup-rules.js (278463 => 278464)
--- trunk/JSTests/stress/bitwise-not-fixup-rules.js 2021-06-04 16:04:35 UTC (rev 278463)
+++ trunk/JSTests/stress/bitwise-not-fixup-rules.js 2021-06-04 16:08:45 UTC (rev 278464)
@@ -10,18 +10,20 @@
}
noInline(foo);
-let c = 0;
-let o = {
- valueOf: () => {
- c++;
- return 3;
- }
-};
+// This can fail when we are fuzzing executable allocation.
+if (!numberOfDFGCompiles(foo)) {
+ let c = 0;
+ let o = {
+ valueOf: () => {
+ c++;
+ return 3;
+ }
+ };
-for (let i = 0; i < 10000; i++)
- foo(o);
+ for (let i = 0; i < 10000; i++)
+ foo(o);
-assert(c, 10000);
-if (numberOfDFGCompiles(foo) > 1)
- throw new Error("Function 'foo' should be compiled just once");
-
+ assert(c, 10000);
+ if (numberOfDFGCompiles(foo) > 1)
+ throw new Error("Function 'foo' should be compiled just once");
+}
