1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
/*
* Copyright (C) 2019-2024 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "config.h"
#include "FileBasedFuzzerAgent.h"
#include "CodeBlock.h"
#include "FuzzerPredictions.h"
#include "JSCellInlines.h"
#include <wtf/AnsiColors.h>
#include <wtf/TZoneMallocInlines.h>
WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
namespace JSC {
WTF_MAKE_TZONE_ALLOCATED_IMPL(FileBasedFuzzerAgent);
FileBasedFuzzerAgent::FileBasedFuzzerAgent(VM& vm)
: FileBasedFuzzerAgentBase(vm)
{
}
SpeculatedType FileBasedFuzzerAgent::getPredictionInternal(CodeBlock* codeBlock, PredictionTarget& target, SpeculatedType original)
{
FuzzerPredictions& fuzzerPredictions = ensureGlobalFuzzerPredictions();
std::optional<SpeculatedType> generated = fuzzerPredictions.predictionFor(target.lookupKey);
SourceProvider* provider = codeBlock->source().provider();
auto sourceUpToDivot = provider->source().substring(target.info.divot - target.info.startOffset, target.info.startOffset);
auto sourceAfterDivot = provider->source().substring(target.info.divot, target.info.endOffset);
switch (target.opcodeId) {
// FIXME: these can not be targeted at all due to the bugs below
case op_to_this: // broken https://bugs.webkit.org/show_bug.cgi?id=203555
case op_get_argument: // broken https://bugs.webkit.org/show_bug.cgi?id=203554
return original;
// FIXME: the output of codeBlock->expressionInfoForBytecodeIndex() allows for some of
// these opcodes to have predictions, but not all instances can be reliably targeted.
case op_get_from_scope: // partially broken https://bugs.webkit.org/show_bug.cgi?id=203603
case op_get_from_arguments: // partially broken https://bugs.webkit.org/show_bug.cgi?id=203608
case op_get_by_val: // partially broken https://bugs.webkit.org/show_bug.cgi?id=203665
case op_get_by_id: // sometimes occurs implicitly for things related to Symbol.iterator
case op_get_length: // sometimes occurs implicitly for things related to Symbol.iterator
if (!generated)
return original;
break;
case op_call: // op_call appears implicitly in for-of loops, generators, spread/rest elements, destructuring assignment
case op_call_ignore_result:
if (!generated) {
if (sourceAfterDivot.containsIgnoringASCIICase("of "_s))
return original;
if (sourceAfterDivot.containsIgnoringASCIICase("..."_s))
return original;
if (sourceAfterDivot.containsIgnoringASCIICase("yield"_s))
return original;
if (sourceAfterDivot.startsWith('[') && sourceAfterDivot.endsWith(']'))
return original;
if (sourceUpToDivot.containsIgnoringASCIICase("yield"_s))
return original;
if (sourceUpToDivot == "..."_s)
return original;
if (!target.info.startOffset && !target.info.endOffset)
return original;
}
break;
case op_get_by_val_with_this:
case op_construct:
case op_construct_varargs:
case op_super_construct:
case op_super_construct_varargs:
case op_call_varargs:
case op_call_direct_eval:
case op_tail_call:
case op_tail_call_varargs:
case op_get_by_id_with_this:
break;
default:
RELEASE_ASSERT_NOT_REACHED_WITH_MESSAGE("Unhandled opcode %s", opcodeNames[target.opcodeId].characters());
}
if (!generated) {
if (Options::dumpFuzzerAgentPredictions())
dataLogLn(MAGENTA(BOLD(target.info.instPC)), " ", BOLD(YELLOW(target.opcodeId)), " missing prediction for: ", RED(BOLD(target.lookupKey)), " ", GREEN(target.sourceFilename), ":", CYAN(target.info.lineColumn.line), ":", CYAN(target.info.lineColumn.column), " divot: ", target.info.divot, " -", target.info.startOffset, " +", target.info.endOffset, " name: '", YELLOW(codeBlock->inferredName()), "' source: '", BLUE(sourceUpToDivot), BLUE(BOLD(sourceAfterDivot)), "'");
RELEASE_ASSERT_WITH_MESSAGE(!Options::requirePredictionForFileBasedFuzzerAgent(), "Missing expected prediction in FuzzerAgent");
return original;
}
if (Options::dumpFuzzerAgentPredictions())
dataLogLn(YELLOW(target.opcodeId), " ", CYAN(target.lookupKey), " original: ", CYAN(BOLD(SpeculationDump(original))), " generated: ", MAGENTA(BOLD(SpeculationDump(*generated))));
return *generated;
}
} // namespace JSC
WTF_ALLOW_UNSAFE_BUFFER_USAGE_END
|
