Changeset 279126 in webkit for trunk/Source/JavaScriptCore/jit/ExecutableAllocationFuzz.cpp

Timestamp:

Jun 22, 2021, 10:48:42 AM (4 years ago)

Author:

[email protected]

Message:

jitCompileAndSetHeuristics shouldn't return true when we fail to compile
​https://bugs.webkit.org/show_bug.cgi?id=227155

Reviewed by Tadeu Zagallo.

JSTests:

• microbenchmarks/interpreter-wasm.js:
• microbenchmarks/memcpy-wasm-large.js:
• microbenchmarks/memcpy-wasm-medium.js:
• microbenchmarks/memcpy-wasm-small.js:
• microbenchmarks/memcpy-wasm.js:
• stress/wasm-error-message-cross-threads.js:

Source/JavaScriptCore:

jitCompileAndSetHeuristics should only return true when we've successfully
compiled a baseline JIT CodeBlock. However, with the rewrite to using a
unified JIT worklist, the code was changed to returning true when a
compilation finished, regardless of it being successful or not. This patch
fixes that error.

This bug was found by our existing executable allocation fuzzer, but at a low
hit rate. That fuzzer only ran a single test case. This patch also introduces
a new form of the executable fuzzer where we fail to allocate JIT code
randomly, and the crash manifests more reliably. And this patch also hooks
the new fuzzer into more JSC stress tests.

• dfg/DFGLICMPhase.cpp:

(JSC::DFG::LICMPhase::run):

• jit/ExecutableAllocationFuzz.cpp:

(JSC::doExecutableAllocationFuzzing):

• jsc.cpp:

(runJSC):

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::jitCompileAndSetHeuristics):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• runtime/OptionsList.h:

Source/WTF:

• wtf/WeakRandom.h:

Tools:

• Scripts/run-jsc-stress-tests:

File:

• trunk/Source/JavaScriptCore/jit/ExecutableAllocationFuzz.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/jit/ExecutableAllocationFuzz.cpp

@@ -30 +30 @@
 #include <wtf/Atomics.h>
 #include <wtf/DataLog.h>
+#include <wtf/WeakRandom.h>
 
 namespace JSC {
@@ -42 +43 @@
 {
     ASSERT(Options::useExecutableAllocationFuzz());
+
+    if (Options::fireExecutableAllocationFuzzRandomly()) {
+        static LazyNeverDestroyed<WeakRandom> random;
+        static std::once_flag once;
+        std::call_once(once, [] () {
+            random.construct();
+        });
+
+        static Lock fuzzingLock;
+        Locker locker { fuzzingLock };
+        
+        if (random->returnTrueWithProbability(Options::fireExecutableAllocationFuzzRandomlyProbability()))
+            return PretendToFailExecutableAllocation;
+
+        return AllowNormalExecutableAllocation;
+    }
     
     unsigned oldValue;