Bug 214093 – Add a fuzzing toggle for LICM

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

Since we have an AI based safety checker for LICM, it's helpful to fuzz that we've implemented our AI safety checker correctly by deciding to randomly not hoist nodes.

[Saam Barati]

Created attachment 403803 [details]
patch

[Yusuke Suzuki]

Comment on attachment 403803 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=403803&action=review

r=me

> Source/JavaScriptCore/dfg/DFGLICMPhase.cpp:185
> +        WeakRandom random { Options::seedForLICMFuzzer() };

Initialize it only when using with useLICMFuzzing. WeakRandom reads random seeds from entropy pool and this is super slow.

[Saam Barati]

Comment on attachment 403803 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=403803&action=review

>> Source/JavaScriptCore/dfg/DFGLICMPhase.cpp:185
>> +        WeakRandom random { Options::seedForLICMFuzzer() };
> 
> Initialize it only when using with useLICMFuzzing. WeakRandom reads random seeds from entropy pool and this is super slow.

Even when it’s seeded?

[Saam Barati]

(In reply to Saam Barati from comment #3)
> Comment on attachment 403803 [details]
> patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=403803&action=review
> 
> >> Source/JavaScriptCore/dfg/DFGLICMPhase.cpp:185
> >> +        WeakRandom random { Options::seedForLICMFuzzer() };
> > 
> > Initialize it only when using with useLICMFuzzing. WeakRandom reads random seeds from entropy pool and this is super slow.
> 
> Even when it’s seeded?

I've verified that this only does simple arithmetic when it's seeded. The default seed is "cryptographicallyRandomNumber()", which is probably what you're thinking about.

[EWS]

Committed r264133: <https://trac.webkit.org/changeset/264133>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 403803 [details].

[Radar WebKit Bug Importer]

<rdar://problem/65241432>