Viewing profile — IainIreland

We have a bounty program. If you can find security bugs in Firefox, please let us pay you for them. You don't need to provide a fix; a testcase that crashes in an interesting way i…

I never got direct access to Mythos, so all I know is what I've seen from the quality of the bugs being produced. I also haven't been involved at the prompting end. So the best ans…

Yeah, the test with the patch also adds comments. The human reviewer had extra context available. I did get Opus to do an audit for similar problems elsewhere, to supplement the in…

If I had to guess, I'd say that AI is better at finding TOCTOU bugs than fuzzing because it starts by looking at the code and trying to find problems with it, which naturally leads…

The same is also true of a good security researcher, and has been for a long time. The question is mostly whether it takes long enough to come up with a testcase that we've managed…

I work on SpiderMonkey, so I mostly looked at the JS bugs. It was a smorgasbord of various things. Broadly speaking I'd say the most impressive bugs were TOCTOU issues, where we ch…

Yeah, fuzzing, sanitizers, and bug bounties were our main pre-AI tools for finding bugs.

There doesn't have to be a huge qualitative discontinuity between Opus and Mythos. It's just that Mythos has reached a threshold where it's finally smart enough that putting it in …

I work at Mozilla; I fixed a bunch of these bugs. In general, I would say that our use of "vulnerability" lines up with what jerrythegerbil calls "potential vulnerability". (In cas…

This is really cool. Thanks for the write-up, Chris! I kept waiting for "sea of nodes with CFG" to be shortened to SeaFG, and it never happened. I guess maybe it's ambiguous out lo…

One clear use case for GC in Rust is for implementing other languages (eg writing a JS engine). When people ask why SpiderMonkey hasn't been rewritten in Rust, one of the main tech…

Cranelift does not use copy-and-patch. Consider, for example, this file, which implements part of the instruction generation logic for x64: https://github.com/bytecodealliance/wasm…

Yeah, SM will compile functions with try/catch/finally, but we don't support unwinding directly into optimized code, so the catch block itself will not be optimized.

I don't know how JSC handles it, but in SM `eval` has significant negative effects on surrounding code. (We also decline to optimize functions containing `with` statements, but tha…

This isn't about languages; it's about hardware. Should hardware be "higher-level" to support higher level languages? The author says no (and I am inclined to agree with him).

This is really impressive analysis.

This doesn't read as AI-generated to me at all. The prose isn't polished enough to be AI. AI generation is unlikely to produce missing spaces like "...which are not readable to hum…

Copy and paste all four lines at once.

Taking a quick look at the JSC code, the main difference is that CacheIR is more pervasive and load-bearing. Even monomorphic cases go through CacheIR. The main justification for C…

asm.js solves this in the specific case where somebody has compiled their C/C++ code to target asm.js. It doesn't solve it for arbitrary JS code. asm.js is more like a weird fronte…

The main thing we're doing differently in SM is that all of our ICs are generated using a simple linear IR (CacheIR), instead of generating machine code directly. For example, a si…

We talk about this a bit in our CacheIR paper. Search for "IonBuilder". https://www.mgaudet.ca/s/mplr23main-preprint.pdf

I believe the technical term for the property that existing JS engines lack here is "safe for space". The V8 bug ( https://issues.chromium.org/issues/41070945 ) has already been li…

I can't speak for any other engines, but in SpiderMonkey a BigInt is a GC-managed object with a one-word header containing the sign bit, the length, and some GC bookkeeping bits, a…

This seems unlikely, given that the moai were mostly carved from tuff from a specific crater ( https://en.wikipedia.org/wiki/Rano_Raraku ), whereas the stone gardens are made of "f…