449529 - TM: Fuzzer that exercises tracer implementation

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement)

Description

[Robert Sayre]

We need a fuzzer that really makes life hard for the tracer.

Comment 1

[Jesse Ruderman]

Attachment: current version of jsfunfuzz.js

If you don't have access to the fuzzer repository, you should be able to use this file along with the other files in the .zip in bug 349611.

Last week I added some extra looping, both around the content of the entire function and at random.  (Search for "randomRepeater").  This is enough to at least exercise some tracing code, right?  Does it find bugs?

I'm at Black Hat and DEF CON this week, but next week I can work with you guys to test tracing harder.

Comment 2

[Martijn Wargers (dead)]

What is the tracer?

Comment 3

[Andreas Gal :gal]

The tracer is the part of the Spidermonkey JIT that records instructions as the interpreter executes them. This recorded sequence of instructions results in a trace that is then compiled to native machine code.

Comment 4

[Andreas Gal :gal]

I started using the fuzzer and it kills us pretty early on (in the fuzzer code, not the fuzzed code). I suggest to put some gdb warrior on this. Looks easy to fix.

Comment 5

[Jesse Ruderman]

Attachment: jsfunfuzz.js, 2008-09-02

I also have a known_assertions.txt and a known_crashes.txt and stuff.

Comment 6

[Jesse Ruderman]

jsfunfuzz (bug 349611) and comparison fuzzers (bug 465479) both exercise the tracer now.