Bug 195924 – FTL: Emit code to validate AI's state when running the compiled code

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Saam Barati]

...

[Radar WebKit Bug Importer]

<rdar://problem/49003422>

[Saam Barati]

Created attachment 365252 [details]
WIP

[Saam Barati]

Created attachment 365255 [details]
WIP

[Saam Barati]

Created attachment 365261 [details]
WIP

[Saam Barati]

seems possible it's already found some bugs...

[Saam Barati]

(In reply to Saam Barati from comment #5)
> seems possible it's already found some bugs...

Perhaps not. It seems like using combined liveness may not work, since AI only tracks live in IR values.

[Saam Barati]

Created attachment 365267 [details]
WIP

[Saam Barati]

It found a bug:

```
    case ValueBitXor:
    case ValueBitAnd:
    case ValueBitOr:
        if (node->binaryUseKind() == BigIntUse)
            setTypeForNode(node, SpecBigInt);
        else {
            clobberWorld();
            setTypeForNode(node, SpecBoolInt32 | SpecBigInt);
        }
        break;

```

Should be:
```
    case ValueBitXor:
    case ValueBitAnd:
    case ValueBitOr:
        if (node->binaryUseKind() == BigIntUse)
            setTypeForNode(node, SpecBigInt);
        else {
            clobberWorld();
            setTypeForNode(node, SpecInt32Only | SpecBigInt);
        }
        break;
````

[Saam Barati]

Created attachment 365284 [details]
patch

WIP

[Saam Barati]

Created attachment 365288 [details]
WIP

[Saam Barati]

Created attachment 365293 [details]
WIP

[Saam Barati]

Created attachment 365457 [details]
WIP

[Saam Barati]

Created attachment 365910 [details]
patch

[Saam Barati]

Comment on attachment 365910 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=365910&action=review

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:177
> +                        live.add(child.node());

I’ll also make this addVoid

[EWS Watchlist]

Attachment 365910 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/ChangeLog:12:  Please consider whether the use of security-sensitive phrasing could help someone exploit WebKit: fuzzer  [changelog/unwantedsecurityterms] [3]
Total errors found: 1 in 3 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Saam Barati]

Comment on attachment 365910 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=365910&action=review

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:597
> +                input = boxDouble(lowDouble(Edge(node, DoubleRepUse)));

this logic is somewhat wrong for doubles. I think I need to validate them unboxed.

[Saam Barati]

Created attachment 365926 [details]
patch

[EWS Watchlist]

Attachment 365926 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/ChangeLog:12:  Please consider whether the use of security-sensitive phrasing could help someone exploit WebKit: fuzzer  [changelog/unwantedsecurityterms] [3]
Total errors found: 1 in 3 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[WebKit Commit Bot]

Comment on attachment 365926 [details]
patch

Clearing flags on attachment: 365926

Committed r243530: <https://trac.webkit.org/changeset/243530>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.