842258 - (BaselineFuzz) [meta] Baseline compiler fuzz bugs

Status: NEW

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

The baseline compiler is ready for fuzzing.

The source is here: http://hg.mozilla.org/projects/ionmonkey

You don't need any build flags or shell flags to enable the compiler. The most interesting shell flags to test are either (1) no flags or (2) --ion-eager.

Baseline still compiles scripts eagerly. When this changes there will be a --baseline-eager flag to get the current behavior, comparable to -a for JM or --ion-eager for Ion. We will update this bug and let the fuzz people know when this happens.

Other interesting flags are --no-ti and -d, but note that even though the baseline compiler works with these flags, they disable IonMonkey, so the fuzzers should not use them all the time.

--no-baseline disables the baseline compiler. We should probably test with this flag too at some point.

Comment 1

[Christian Holler (:decoder)]

I'm on it, testing with either no flags or --ion-eager right now on x86/x86_64. Does this have any ARM specific code or other implications for ARM?

Comment 2

[Jan de Mooij [:jandem]]

(In reply to Christian Holler (:decoder) from comment #1)
> I'm on it, testing with either no flags or --ion-eager right now on
> x86/x86_64. Does this have any ARM specific code or other implications for
> ARM?

Great! Although almost all code is shared across platforms, there's some ARM specific code, so it would be good to have fuzz testing on ARM. Maybe when x86/x64 are more stable?

Comment 3

[Christian Holler (:decoder)]

(In reply to Jan de Mooij [:jandem] from comment #2)

> Great! Although almost all code is shared across platforms, there's some ARM
> specific code, so it would be good to have fuzz testing on ARM. Maybe when
> x86/x64 are more stable?

Exactly. Since everything (esp. crash processing) on ARM is slower, I'll wait with the ARM fuzzing until we are somewhat stable on x86 :) Thanks.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I'm on this too. (just got back from PTO recently)

Comment 5

[Jan de Mooij [:jandem]]

(In reply to Jan de Mooij [:jandem] from comment #0)
> Baseline still compiles scripts eagerly. When this changes there will be a
> --baseline-eager flag to get the current behavior, comparable to -a for JM
> or --ion-eager for Ion. We will update this bug and let the fuzz people know
> when this happens.

This is done, there's now a --baseline-eager flag (and --ion-eager implies --baseline-eager).