| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Add a de-opt state logging patch for DUMPLING. DUMPLING is a mode for differential fuzzers that compares the full state of optimized and unoptimized execution for arbitrary JS programs. The design goal of DUMPLING is to transparently extract execution states without any modification to JS or interference with the JIT compiler optimizations. Therefore, the hooks are inserted in a way that is not observable by any pass in the compilation pipeline. The hooking is implemented by emitting a single call instruction at every deoptimization point during the lowering phases to machine code of Maglev and TurboFan. More details in: https://www.ndss-symposium.org/ndss-paper/dumpling-fine-grained-differential-javascript-engine-fuzzing/ This patch was originally published on https://github.com/two-heart/dumpling-artifact-evaluation. Bug: 441467877 Change-Id: I3d29775e268bfc734bb1b8ee45ea5d7a10a2ed63 Co-authored-by: Mathias Payer <mathias.payer@gmail.com> Co-authored-by: Liam Wachter <liam.g.wachter@gmail.com> Co-authored-by: Flavio Toffalini<flavio87@gmail.com> Co-authored-by: Christian Wressnegger <intellisec.de@gmail.com> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7018469 Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#103047} | 8 个月前 |