1  /*
  2   * Copyright (C) 2019 Apple Inc. All rights reserved.
  3   *
  4   * Redistribution and use in source and binary forms, with or without
  5   * modification, are permitted provided that the following conditions
  6   * are met:
  7   * 1. Redistributions of source code must retain the above copyright
  8   *    notice, this list of conditions and the following disclaimer.
  9   * 2. Redistributions in binary form must reproduce the above copyright
 10   *    notice, this list of conditions and the following disclaimer in the
 11   *    documentation and/or other materials provided with the distribution.
 12   *
 13   * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 14   * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 15   * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 16   * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 17   * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 18   * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 19   * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 20   * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 21   * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 22   * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 23   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 24   */
 25  
 26  #include "config.h"
 27  #include "FileBasedFuzzerAgent.h"
 28  
 29  #include "CodeBlock.h"
 30  #include "FuzzerPredictions.h"
 31  #include "JSCellInlines.h"
 32  #include <wtf/AnsiColors.h>
 33  
 34  namespace JSC {
 35  
 36  FileBasedFuzzerAgent::FileBasedFuzzerAgent(VM& vm)
 37      : FileBasedFuzzerAgentBase(vm)
 38  {
 39  }
 40  
 41  SpeculatedType FileBasedFuzzerAgent::getPredictionInternal(CodeBlock* codeBlock, PredictionTarget& target, SpeculatedType original)
 42  {
 43      FuzzerPredictions& fuzzerPredictions = ensureGlobalFuzzerPredictions();
 44      Optional<SpeculatedType> generated = fuzzerPredictions.predictionFor(target.lookupKey);
 45  
 46      SourceProvider* provider = codeBlock->source().provider();
 47      auto sourceUpToDivot = provider->source().substring(target.divot - target.startOffset, target.startOffset);
 48      auto sourceAfterDivot = provider->source().substring(target.divot, target.endOffset);
 49  
 50      switch (target.opcodeId) {
 51      // FIXME: these can not be targeted at all due to the bugs below
 52      case op_to_this: // broken https://bugs.webkit.org/show_bug.cgi?id=203555
 53      case op_get_argument: // broken https://bugs.webkit.org/show_bug.cgi?id=203554
 54          return original;
 55  
 56      // FIXME: the output of codeBlock->expressionRangeForBytecodeIndex() allows for some of
 57      // these opcodes to have predictions, but not all instances can be reliably targeted.
 58      case op_bitand: // partially broken https://bugs.webkit.org/show_bug.cgi?id=203604
 59      case op_bitor: // partially broken https://bugs.webkit.org/show_bug.cgi?id=203604
 60      case op_bitxor: // partially broken https://bugs.webkit.org/show_bug.cgi?id=203604
 61      case op_bitnot: // partially broken
 62      case op_get_from_scope: // partially broken https://bugs.webkit.org/show_bug.cgi?id=203603
 63      case op_get_from_arguments: // partially broken https://bugs.webkit.org/show_bug.cgi?id=203608
 64      case op_get_by_val: // partially broken https://bugs.webkit.org/show_bug.cgi?id=203665
 65      case op_rshift: // partially broken https://bugs.webkit.org/show_bug.cgi?id=203664
 66      case op_lshift: // partially broken https://bugs.webkit.org/show_bug.cgi?id=203664
 67      case op_to_number: // partially broken
 68      case op_get_by_id: // sometimes occurs implicitly for things related to Symbol.iterator
 69          if (!generated)
 70              return original;
 71          break;
 72  
 73      case op_call: // op_call appears implicitly in for-of loops, generators, spread/rest elements, destructuring assignment
 74          if (!generated) {
 75              if (sourceAfterDivot.containsIgnoringASCIICase("of "))
 76                  return original;
 77              if (sourceAfterDivot.containsIgnoringASCIICase("..."))
 78                  return original;
 79              if (sourceAfterDivot.containsIgnoringASCIICase("yield"))
 80                  return original;
 81              if (sourceAfterDivot.startsWith('[') && sourceAfterDivot.endsWith("]"))
 82                  return original;
 83              if (sourceUpToDivot.containsIgnoringASCIICase("yield"))
 84                  return original;
 85              if (sourceUpToDivot == "...")
 86                  return original;
 87              if (!target.startOffset && !target.endOffset)
 88                  return original;
 89          }
 90          break;
 91  
 92      case op_get_by_val_with_this:
 93      case op_get_direct_pname:
 94      case op_construct:
 95      case op_construct_varargs:
 96      case op_call_varargs:
 97      case op_call_eval:
 98      case op_tail_call:
 99      case op_tail_call_varargs:
100      case op_get_by_id_with_this:
101          break;
102  
103      default:
104          RELEASE_ASSERT_NOT_REACHED_WITH_MESSAGE("Unhandled opcode %s", opcodeNames[target.opcodeId]);
105      }
106      if (!generated) {
107          if (Options::dumpFuzzerAgentPredictions())
108              dataLogLn(MAGENTA(BOLD(target.bytecodeIndex)), " ", BOLD(YELLOW(target.opcodeId)), " missing prediction for: ", RED(BOLD(target.lookupKey)), " ", GREEN(target.sourceFilename), ":", CYAN(target.line), ":", CYAN(target.column), " divot: ", target.divot, " -", target.startOffset, " +", target.endOffset, " name: '", YELLOW(codeBlock->inferredName()), "' source: '", BLUE(sourceUpToDivot), BLUE(BOLD(sourceAfterDivot)), "'");
109  
110          RELEASE_ASSERT_WITH_MESSAGE(!Options::requirePredictionForFileBasedFuzzerAgent(), "Missing expected prediction in FuzzerAgent");
111          return original;
112      }
113      if (Options::dumpFuzzerAgentPredictions())
114          dataLogLn(YELLOW(target.opcodeId), " ", CYAN(target.lookupKey), " original: ", CYAN(BOLD(SpeculationDump(original))), " generated: ", MAGENTA(BOLD(SpeculationDump(*generated))));
115      return *generated;
116  }
117  
118  } // namespace JSC