1405308 - Make assertRecoveredOnBailout fuzzing-safe

Status: NEW

(Core :: JavaScript Engine: JIT, enhancement, P3)

Description

[Nicolas B. Pierron [:nbp]]

assertRecoveredOnBailout is fuzzing unsafe[1] because it checks for an optimization and use MOZ_RELEASE_ASSERT [2] to segv if the optimization did not worked.

We should change this option to check the fuzzingSafe boolean [3] in order to only do this MOZ_RELEASEASSERT if fuzzingSafe is false.  This way we can let fuzzer re-use the test cases written using assertRecoveredOnBailout as a basis for any mutation fuzzing engine.

[1] http://searchfox.org/mozilla-central/rev/a4702203522745baff21e519035b6c946b7d710d/js/src/shell/js.cpp#6726
[2] http://searchfox.org/mozilla-central/rev/a4702203522745baff21e519035b6c946b7d710d/js/src/jit/Recover.cpp#1726
[3] http://searchfox.org/mozilla-central/search?q=fuzzingSafe&path=