Wednesday, December 24th, 2008
Playing with a fuzzy monkey; Helping JITs improve
Category: JavaScript
JAVASCRIPT:
-
-
for (var i = 0; i <0x02000000; ++i) {
-
d = 0x55555555;
-
d++; d++; d++; d++; d++;
-
}
-
This code runs 250 times faster when the JIT is enabled in a Firefox with TraceMonkey available.
This is just one minor thing that Jesse Ruderman has been able to find as he helps out the TraceMonkey team with his jsfunfuzz JavaScript fuzzer.
He has found many bugs, and those that would have been hard to track down:
Andreas Gal commented that each fuzz-generated testcase saved him nearly a day of debugging: otherwise, he'd probably have to tease a testcase out of a misbehaving complex web page. Encouraged by his comment, I looked for additional ways to help the TraceMonkey team.
He then put his fuzzer to work to find differences between Spidermonkey and JavaScriptCore. Interesting stuff.
Related Content:
4 rating from 5 votes
Fine work Jesse, keep at it!