WideningNumberPredictionFuzzerAgent.cpp [plain text]
#include "config.h"
#include "WideningNumberPredictionFuzzerAgent.h"
#include "CodeBlock.h"
namespace JSC {
WideningNumberPredictionFuzzerAgent::WideningNumberPredictionFuzzerAgent(VM& vm)
: NumberPredictionFuzzerAgent(vm)
{
}
SpeculatedType WideningNumberPredictionFuzzerAgent::getPrediction(CodeBlock* codeBlock, const CodeOrigin& codeOrigin, SpeculatedType original)
{
auto locker = holdLock(m_lock);
if (!(original && speculationChecked(original, SpecBytecodeNumber)))
return original;
if (original == SpecBytecodeNumber)
return original;
Vector<SpeculatedType> numberTypesNotIncludedInSpeculation;
for (auto numberType : bytecodeNumberTypes()) {
if (!(numberType & original))
numberTypesNotIncludedInSpeculation.append(numberType);
}
unsigned numberOfTypesToAdd = m_random.getUint32(numberTypesNotIncludedInSpeculation.size() + 1);
if (!numberOfTypesToAdd)
return original;
SpeculatedType generated = original;
for (unsigned i = 0; i < numberOfTypesToAdd; i++) {
unsigned indexOfNewType = m_random.getUint32(numberTypesNotIncludedInSpeculation.size());
mergeSpeculation(generated, numberTypesNotIncludedInSpeculation[indexOfNewType]);
numberTypesNotIncludedInSpeculation.remove(indexOfNewType);
}
if (Options::dumpFuzzerAgentPredictions())
dataLogLn("WideningNumberPredictionFuzzerAgent::getPrediction name:(", codeBlock->inferredName(), "#", codeBlock->hashAsStringIfPossible(), "),bytecodeIndex:(", codeOrigin.bytecodeIndex(), "),original:(", SpeculationDump(original), "),generated:(", SpeculationDump(generated), ")");
return generated;
}
}