AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[fuzzing] Use --fuzzing flag for allowed runtime functions

Browse Source 
This subsumes the old behavior of --allow-natives-for-fuzzing under
--fuzzing as well. Both flags are used in a redundant way in fuzz
configs. Only --allow-natives-for-fuzzing wasn't specified as a
required argument, leading to the bug below.

We still need the flag --allow-natives-for-differential-fuzzing
to allow different functions when using differential fuzzing.

Bug: chromium:1094866
Change-Id: I398791779e58ed4d80e896c1cfea343848159212
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2246568
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68401}
This commit is contained in:
Michael Achenbach 2020-06-17 18:56:54 +02:00 committed by Commit Bot
parent 365f46d05b
commit 3864e1f2da
5 changed files with 7 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/flags/flag-definitions.h
View File

@ -1270,15 +1270,11 @@ DEFINE_IMPLICATION(trace_maps, log_code)
// parser.cc // parser.cc
DEFINE_BOOL(allow_natives_syntax, false, "allow natives syntax") DEFINE_BOOL(allow_natives_syntax, false, "allow natives syntax")
DEFINE_BOOL(allow_natives_for_fuzzing, false,
"allow only natives explicitly whitelisted for fuzzers")
DEFINE_BOOL(allow_natives_for_differential_fuzzing, false, DEFINE_BOOL(allow_natives_for_differential_fuzzing, false,
"allow only natives explicitly whitelisted for differential " "allow only natives explicitly whitelisted for differential "
"fuzzers") "fuzzers")
DEFINE_IMPLICATION(allow_natives_for_differential_fuzzing, allow_natives_syntax) DEFINE_IMPLICATION(allow_natives_for_differential_fuzzing, allow_natives_syntax)
DEFINE_IMPLICATION(allow_natives_for_fuzzing, allow_natives_syntax) DEFINE_IMPLICATION(allow_natives_for_differential_fuzzing, fuzzing)
DEFINE_IMPLICATION(allow_natives_for_differential_fuzzing,
allow_natives_for_fuzzing)
DEFINE_BOOL(parse_only, false, "only parse the sources") DEFINE_BOOL(parse_only, false, "only parse the sources")
// simulator-arm.cc, simulator-arm64.cc and simulator-mips.cc // simulator-arm.cc, simulator-arm64.cc and simulator-mips.cc

6
src/parsing/parser.cc
View File

@ -357,8 +357,8 @@ Expression* Parser::NewV8Intrinsic(const AstRawString* name,
const Runtime::Function* function = const Runtime::Function* function =
Runtime::FunctionForName(name->raw_data(), name->length()); Runtime::FunctionForName(name->raw_data(), name->length());
// Be more premissive when fuzzing. Intrinsics are not supported. // Be more permissive when fuzzing. Intrinsics are not supported.
if (FLAG_allow_natives_for_fuzzing) { if (FLAG_fuzzing) {
return NewV8RuntimeFunctionForFuzzing(function, args, pos); return NewV8RuntimeFunctionForFuzzing(function, args, pos);
} }
@ -392,7 +392,7 @@ Expression* Parser::NewV8Intrinsic(const AstRawString* name,
Expression* Parser::NewV8RuntimeFunctionForFuzzing( Expression* Parser::NewV8RuntimeFunctionForFuzzing(
const Runtime::Function* function, const ScopedPtrList<Expression>& args, const Runtime::Function* function, const ScopedPtrList<Expression>& args,
int pos) { int pos) {
CHECK(FLAG_allow_natives_for_fuzzing); CHECK(FLAG_fuzzing);
// Intrinsics are not supported for fuzzing. Only allow whitelisted runtime // Intrinsics are not supported for fuzzing. Only allow whitelisted runtime
// functions. Also prevent later errors due to too few arguments and just // functions. Also prevent later errors due to too few arguments and just

2
src/runtime/runtime.cc
View File

@ -193,7 +193,7 @@ bool Runtime::MayAllocate(FunctionId id) {
} }
bool Runtime::IsWhitelistedForFuzzing(FunctionId id) { bool Runtime::IsWhitelistedForFuzzing(FunctionId id) {
CHECK(FLAG_allow_natives_for_fuzzing); CHECK(FLAG_fuzzing);
switch (id) { switch (id) {
// Runtime functions whitelisted for all fuzzers. Only add functions that // Runtime functions whitelisted for all fuzzers. Only add functions that
// help increase coverage. // help increase coverage.

2
test/mjsunit/call-intrinsic-fuzzing.js
View File

@ -2,7 +2,7 @@
// Use of this source code is governed by a BSD-style license that can be // Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file. // found in the LICENSE file.
// Flags: --allow-natives-for-fuzzing --fuzzing // Flags: --allow-natives-syntax --fuzzing
// Test whitelisted/blacklisted intrinsics in the context of fuzzing. // Test whitelisted/blacklisted intrinsics in the context of fuzzing.

2
test/mjsunit/regress/regress-crbug-754177.js
View File

@ -9,7 +9,7 @@
%NeverOptimizeFunction(true); %NeverOptimizeFunction(true);
%NeverOptimizeFunction(1); %NeverOptimizeFunction(1);
%NeverOptimizeFunction({}); %NeverOptimizeFunction({});
assertThrows("%NeverOptimizeFunction()", SyntaxError); %NeverOptimizeFunction();
%PrepareFunctionForOptimization(print); %PrepareFunctionForOptimization(print);
%OptimizeFunctionOnNextCall(print); %OptimizeFunctionOnNextCall(print);