[Webkit-unassigned] [Bug 203898] Add FuzzerAgent that reads predictions from a file

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=203898

--- Comment #13 from Tuomas Karkkainen <tuomas.webkit at apple.com> ---
(In reply to Saam Barati from comment #11)
> Comment on attachment 383545 [details]
> proposed patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=383545&action=review
> 
> >> Source/JavaScriptCore/runtime/PredictionFileCreatingFuzzerAgent.cpp:95
> >> +        RELEASE_ASSERT_WITH_MESSAGE(false, "unhandled opcode: %s", toString(opcodeId).utf8().data());
> > 
> > why so few opcodes above?
> 
> never mind, these are just opcodes with heap predictions. Is still seems
> like we should just include all opcodes unconditionally since anytime
> someone adds a new opcode with a heap prediction, they'll need to fill in a
> case in this switch statement. However, we don't do anything special for
> different opcodes.

I want to map the JavaScript source code to the opcode and prediction. Therefore I want to know which opcodes occur, and what the source range is for those opcodes, and 
1) It turned out that there were bugs in getting the source range for a number of opcodes
2) I need code in the fuzzer to target a specific prediction location. 

If someone adds a new opcode that has a heap prediction, this FuzzerAgent will crash and that’s how I will immediately find out about the opcode and I’ll be able to add code to handle it.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20191118/f67bc50f/attachment-0001.htm>