Changeset 278356 in webkit


Ignore:
Timestamp:
Jun 2, 2021, 9:26:00 AM (4 years ago)
Author:
[email protected]
Message:

Convert small JIT pool tests into executable fuzzing
​https://bugs.webkit.org/show_bug.cgi?id=226279

Source/JavaScriptCore:

Right now, we try to test our engine on a small JIT pool. This isn't a known configuration for any
actual ports and causes issues if we run out of JIT memory when we need to compile an OSR exit.
Instead of testing such a small pool we should just fuzz each executable allocation that says it
can fail.

The current fuzzing doesn't do a good job tracking the number of DFG/FTL compiles when allocations
fail, so when enabled those tests will just exit early. Also, right now we use a random seed picked
by the engine for these tests, which makes it hard to reproduce crashes on the bots. If we see
flakiness on the bots we can have the harness pass in a number so it gets logged in the repro command.

Reviewed by Michael Saboff.

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::numberOfDFGCompiles):

  • jit/ExecutableAllocationFuzz.cpp:

(JSC::doExecutableAllocationFuzzing):

  • jsc.cpp:

(runJSC):

Tools:

Reviewed by Michael Saboff.

Right now, we try to test our engine on a small JIT pool. This isn't a known configuration for any
actual ports and causes issues if we run out of JIT memory when we need to compile an OSR exit.
Instead of testing such a small pool we should just fuzz each executable allocation that says it
can fail.

The current fuzzing doesn't do a good job tracking the number of DFG/FTL compiles when allocations
fail, so when enabled those tests will just exit early. Also, right now we use a random seed picked
by the engine for these tests, which makes it hard to reproduce crashes on the bots. If we see
flakiness on the bots we can have the harness pass in a number so it gets logged in the repro command.

  • Scripts/jsc-stress-test-helpers/js-executable-allocation-fuzz:
  • Scripts/run-jsc-stress-tests:
Location:
trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r278351 r278356  
     12021-06-02  Keith Miller  <[email protected]>
     2
     3        Convert small JIT pool tests into executable fuzzing
     4        https://bugs.webkit.org/show_bug.cgi?id=226279
     5
     6        Right now, we try to test our engine on a small JIT pool. This isn't a known configuration for any
     7        actual ports and causes issues if we run out of JIT memory when we need to compile an OSR exit.
     8        Instead of testing such a small pool we should just fuzz each executable allocation that says it
     9        can fail.
     10
     11        The current fuzzing doesn't do a good job tracking the number of DFG/FTL compiles when allocations
     12        fail, so when enabled those tests will just exit early. Also, right now we use a random seed picked
     13        by the engine for these tests, which makes it hard to reproduce crashes on the bots. If we see
     14        flakiness on the bots we can have the harness pass in a number so it gets logged in the repro command.
     15
     16        Reviewed by Michael Saboff.
     17
     18        * bytecode/CodeBlock.cpp:
     19        (JSC::CodeBlock::numberOfDFGCompiles):
     20        * jit/ExecutableAllocationFuzz.cpp:
     21        (JSC::doExecutableAllocationFuzzing):
     22        * jsc.cpp:
     23        (runJSC):
     24
    1252021-06-02  Chris Dumez  <[email protected]>
    226

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r278253 r278356  
    24822482{
    24832483    ASSERT(JITCode::isBaselineCode(jitType()));
     2484
     2485    // FIXME: We don't really do a good job tracking when a compilation failed because of executable allocation fuzzing. https://bugs.webkit.org/show_bug.cgi?id=226276
     2486    if (Options::useExecutableAllocationFuzz())
     2487        return 1000000;
    24842488    if (Options::testTheFTL()) {
    24852489        if (m_didFailFTLCompilation)

  • trunk/Source/JavaScriptCore/jit/ExecutableAllocationFuzz.cpp

    r191058 r278356  
    3030#include <wtf/Atomics.h>
    3131#include <wtf/DataLog.h>
     32#include <wtf/WeakRandom.h>
    3233
    3334namespace JSC {
    … …  
    4142ExecutableAllocationFuzzResult doExecutableAllocationFuzzing()
    4243{
     44    static WeakRandom random(Options::seedOfVMRandomForFuzzer() ? Options::seedOfVMRandomForFuzzer() : cryptographicallyRandomNumber());
     45
    4346    ASSERT(Options::useExecutableAllocationFuzz());
    4447   
    45     unsigned oldValue;
    46     unsigned newValue;
    47     do {
    48         oldValue = s_numberOfExecutableAllocationFuzzChecks.load();
    49         newValue = oldValue + 1;
    50     } while (!s_numberOfExecutableAllocationFuzzChecks.compareExchangeWeak(oldValue, newValue));
    51    
    52     if (newValue == Options::fireExecutableAllocationFuzzAt()) {
     48    unsigned numChecks = s_numberOfExecutableAllocationFuzzChecks.value++;
     49
     50    if (numChecks == Options::fireExecutableAllocationFuzzAt()) {
    5351        if (Options::verboseExecutableAllocationFuzz()) {
    5452            dataLog("Will pretend to fail executable allocation.\n");
    … …  
    5755        return PretendToFailExecutableAllocation;
    5856    }
    59    
     57
    6058    if (Options::fireExecutableAllocationFuzzAtOrAfter()
    61         && newValue >= Options::fireExecutableAllocationFuzzAtOrAfter()) {
     59        && numChecks >= Options::fireExecutableAllocationFuzzAtOrAfter()) {
    6260        if (Options::verboseExecutableAllocationFuzz()) {
    6361            dataLog("Will pretend to fail executable allocation.\n");
    … …  
    6563        }
    6664        return PretendToFailExecutableAllocation;
    67     }
     65    } else if (!Options::fireExecutableAllocationFuzzAt() && random.getUint32() < UINT_MAX * Options::randomIntegrityAuditRate())
     66        return PretendToFailExecutableAllocation;
    6867   
    6968    return AllowNormalExecutableAllocation;

  • trunk/Source/JavaScriptCore/jsc.cpp

    r278240 r278356  
    34903490        if (Options::useExceptionFuzz())
    34913491            printf("JSC EXCEPTION FUZZ: encountered %u checks.\n", numberOfExceptionFuzzChecks());
    3492         bool fireAtEnabled =
    3493         Options::fireExecutableAllocationFuzzAt() || Options::fireExecutableAllocationFuzzAtOrAfter();
    3494         if (Options::useExecutableAllocationFuzz() && (!fireAtEnabled || Options::verboseExecutableAllocationFuzz()))
     3492        if (Options::useExecutableAllocationFuzz() && Options::verboseExecutableAllocationFuzz())
    34953493            printf("JSC EXECUTABLE ALLOCATION FUZZ: encountered %u checks.\n", numberOfExecutableAllocationFuzzChecks());
    34963494        if (Options::useOSRExitFuzz() && Options::verboseOSRExitFuzz()) {

  • trunk/Tools/ChangeLog

    r278353 r278356  
     12021-06-02  Keith Miller  <[email protected]>
     2
     3        Convert small JIT pool tests into executable fuzzing
     4        https://bugs.webkit.org/show_bug.cgi?id=226279
     5
     6        Reviewed by Michael Saboff.
     7
     8        Right now, we try to test our engine on a small JIT pool. This isn't a known configuration for any
     9        actual ports and causes issues if we run out of JIT memory when we need to compile an OSR exit.
     10        Instead of testing such a small pool we should just fuzz each executable allocation that says it
     11        can fail.
     12
     13        The current fuzzing doesn't do a good job tracking the number of DFG/FTL compiles when allocations
     14        fail, so when enabled those tests will just exit early. Also, right now we use a random seed picked
     15        by the engine for these tests, which makes it hard to reproduce crashes on the bots. If we see
     16        flakiness on the bots we can have the harness pass in a number so it gets logged in the repro command.
     17
     18        * Scripts/jsc-stress-test-helpers/js-executable-allocation-fuzz:
     19        * Scripts/run-jsc-stress-tests:
     20
    1212021-06-02  Jonathan Bedard  <[email protected]>
    222

  • trunk/Tools/Scripts/jsc-stress-test-helpers/js-executable-allocation-fuzz

    r226395 r278356  
    7070}
    7171
    72 open (my $testInput, "$commandString --useExecutableAllocationFuzz=true |") or fail("Cannot execute initial command when getting check count");
     72open (my $testInput, "$commandString --useExecutableAllocationFuzz=true --verboseExecutableAllocationFuzz=true |") or fail("Cannot execute initial command when getting check count");
    7373while (my $inputLine = <$testInput>) {
    7474    chomp($inputLine);

  • trunk/Tools/Scripts/run-jsc-stress-tests

    r278234 r278356  
    190190    puts "                            no-cjit-validate-phases, no-cjit-collect-continuously, dfg-eager"
    191191    puts "                            and for FTL platforms: no-ftl, ftl-eager-no-cjit and"
    192     puts "                            ftl-no-cjit-small-pool."
     192    puts "                            ftl-no-cjit-fuzz."
    193193    exit 1
    194194end
    … …  
    852852end
    853853
    854 def runFTLNoCJITSmallPool(*optionalTestSpecificOptions)
    855     run("ftl-no-cjit-small-pool", "--jitMemoryReservationSize=102400", *(FTL_OPTIONS + NO_CJIT_OPTIONS + optionalTestSpecificOptions))
     854def runFTLNoCJITFuzz(*optionalTestSpecificOptions)
     855    run("ftl-no-cjit-fuzz", "--useExecutableAllocationFuzz=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + optionalTestSpecificOptions))
    856856end
    857857
    … …  
    898898            runFTLEager
    899899            runFTLEagerNoCJITValidate
    900             runFTLNoCJITSmallPool
     900            runFTLNoCJITFuzz
    901901
    902902            return if $mode == "basic"
    … …  
    929929            runNoFTL
    930930            runFTLNoCJITValidate
    931             runFTLNoCJITSmallPool
     931            runFTLNoCJITFuzz
    932932
    933933            return if $mode == "basic"
    … …  
    10091009        runFTLEager
    10101010        runFTLEagerNoCJITValidate
    1011         runFTLNoCJITSmallPool
     1011        runFTLNoCJITFuzz
    10121012    end
    10131013end
    … …  
    11611161    run("ftl-eager-modules", "-m", *(FTL_OPTIONS + EAGER_OPTIONS))
    11621162    run("ftl-eager-no-cjit-modules", "-m", "--validateGraph=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + EAGER_OPTIONS))
    1163     run("ftl-no-cjit-small-pool-modules", "-m", "--jitMemoryReservationSize=102400", *(FTL_OPTIONS + NO_CJIT_OPTIONS))
     1163    run("ftl-no-cjit-fuzz-modules", "-m", "--useExecutableAllocationFuzz=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS))
    11641164end
    11651165
Note: See TracChangeset for help on using the changeset viewer.