NarrowingNumberPredictionFuzzerAgent.cpp [plain text]
#include "config.h"
#include "NarrowingNumberPredictionFuzzerAgent.h"
#include "CodeBlock.h"
namespace JSC {
NarrowingNumberPredictionFuzzerAgent::NarrowingNumberPredictionFuzzerAgent(VM& vm)
: NumberPredictionFuzzerAgent(vm)
{
}
SpeculatedType NarrowingNumberPredictionFuzzerAgent::getPrediction(CodeBlock* codeBlock, const CodeOrigin& codeOrigin, SpeculatedType original)
{
auto locker = holdLock(m_lock);
if (!(original && speculationChecked(original, SpecBytecodeNumber)))
return original;
Vector<SpeculatedType> numberTypesThatCouldBePartOfSpeculation;
for (auto numberType : bytecodeNumberTypes()) {
if (numberType & original)
numberTypesThatCouldBePartOfSpeculation.append(numberType);
}
unsigned numberOfTypesToKeep = m_random.getUint32(numberTypesThatCouldBePartOfSpeculation.size()) + 1;
if (numberOfTypesToKeep == numberTypesThatCouldBePartOfSpeculation.size())
return original;
SpeculatedType generated = SpecNone;
for (unsigned i = 0; i < numberOfTypesToKeep; i++) {
unsigned indexOfTypeToKeep = m_random.getUint32(numberTypesThatCouldBePartOfSpeculation.size());
mergeSpeculation(generated, numberTypesThatCouldBePartOfSpeculation[indexOfTypeToKeep]);
numberTypesThatCouldBePartOfSpeculation.remove(indexOfTypeToKeep);
}
if (Options::dumpFuzzerAgentPredictions())
dataLogLn("NarrowingNumberPredictionFuzzerAgent::getPrediction name:(", codeBlock->inferredName(), "#", codeBlock->hashAsStringIfPossible(), "),bytecodeIndex:(", codeOrigin.bytecodeIndex(), "),original:(", SpeculationDump(original), "),generated:(", SpeculationDump(generated), ")");
return generated;
}
}