1243031 - Implement dummy wasm functions in deterministic mode

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: deterministic.patch

Gary showed me a piece of code on IRC that unevals the global object and prints out the result. On x86 without fpu, the two wasm functions aren't there, which causes a differential testing issue.

This patch implements dummy wasm functions to prevent this, but that's not enough: if wasm functions are dummy implementations, differential testing fuzzing will get crazy when comparing dummy vs real. So I made the dummy implementations write "WebAssembly is not supported" on stderr, thus fuzzers can pattern match this string and abort fuzzing, as they do for some error messages in asm.js https://github.com/MozillaSecurity/funfuzz/blob/master/js/compareJIT.py#L120 .

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> as they do for some error messages in asm.js
> https://github.com/MozillaSecurity/funfuzz/blob/master/js/compareJIT.py#L120

Here's a better (more permanent) URL:

https://github.com/MozillaSecurity/funfuzz/blob/3273653443dd5faf8b67584cc305d42668e569d8/js/compareJIT.py#L120

Comment 2

[Luke Wagner [:luke]]

Could we instead have wasmEval/wasmTextToString *always* be defined but if !SupportsWasm, they throw an error and, #ifdef MORE_DETERMINISTIC, also fprintf a message that can tell the fuzzers to ignore this test case?

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: deterministic.patch

Comment 4

[Luke Wagner [:luke]]

Comment on attachment 8712609 [details] [diff] [review]
deterministic.patch

Review of attachment 8712609 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!

::: js/src/asmjs/Wasm.cpp
@@ +575,5 @@
> +    if (!SupportsWasm(cx)) {
> +#ifdef JS_MORE_DETERMINISTIC
> +        fprintf(stderr, "WebAssembly is not supported.\n");
> +#endif // JS_MORE_DETERMINISTIC
> +        JS_ReportError(cx, "WebAssembly is not supported.");

Can you say "on the current device"?

@@ +653,5 @@
>  static bool
>  WasmTextToBinary(JSContext* cx, unsigned argc, Value* vp)
>  {
> +    if (!CheckWasmSupport(cx))
> +        return false;

I think this check isn't necessary.

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/40b6b9e6562a

Comment 6

[Pulsebot]

Backout:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7cd22aa3fbac

Comment 7

[Benjamin Bouvier [:bbouvier] (inactive)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e430ac6c314c

Comment 8

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0ae79cfe1fdf

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/0ae79cfe1fdf

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I've turned on --no-fpu testing again, this time ignoring the phrase "WebAssembly is not supported on the current device".

https://github.com/MozillaSecurity/funfuzz/commit/7cb9b3be4f26379f6fca96163456f85febf26f6e