base fuzzili update #52
Open
Dudcom wants to merge 409 commits into
Open
Conversation
Follow-up to commit e12a171 Change-Id: Ie4cfa33fef72c15caaf88336ca408d94c37e759a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9067018 Commit-Queue: Manish Goregaokar <manishearth@google.com> Reviewed-by: Manish Goregaokar <manishearth@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Maybe I shouldn't just predict crashes but instead fix them before landing my changes. Bug: 448860865 Change-Id: I7df709799f11fcaec590960c4eeecdc17696772c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9073196 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 487347678 Change-Id: Id253e99069ceb17b0b6da92876234eb1fec2329c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9044026 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
There are some test-only / d8-only functions that we don't need to or don't want to fuzz. Bug: 487347678 Change-Id: Idea475a3afdf4dcba2787e497fca45580299d265 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9051197 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
There is a large amount of properties on prototype objects that can only be called on a proper instance, e.g. trying to access > DisposableStack.prototype.disposed will throw an error as DisposableStack.prototype is not the expected receiver type (unlike new DisposableStack().disposed). While the property exists on the prototype, it should not be registered as the fuzzer can't really do anything useful with something that always throws. Bug: 487347678 Change-Id: Ie8b2e5d30caa819f512d6791afb1a22d11761c7f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9058839 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
and skip their prototypes in FuzzilliDetectMissingBuiltins. Bug: 487347678 Change-Id: Ib74c990924c2b194f486c14c8578148240b9a1f5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064302 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
This test case is obsolete. For detecting missing builtins, there is now a script that can recursively scan the available global context of a JavaScript shell. Bug: 487347678 Change-Id: If785dc73fca43d693e29d1c22e345381568072bd Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064301 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
Bug: 487347678 Change-Id: I2157fdb4904c8cd5886c8cf9c3f230cab85fdd76 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9078877 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
Bug: 487347678 Change-Id: I00083540222506cfb09d7b1dfe5d040b7818a58b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9081256 Commit-Queue: Danylo Mocherniuk <mdanylo@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 445356784 Change-Id: I488149208dcda6e632ff1fc36d7c959978c3d470 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9078876 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com>
These are fixed in d8 via https://crrev.com/c/7642309. Bug: 487347678 Change-Id: I772ae90c0cee6a4c126f11d84934c132bc69c463 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9081257 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
Bug: 445356784 Change-Id: I583e24a56e0e97b589a9bd796ee7e4e23cd63d0d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9081258 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This flag is enabled by default and has been removed from v8 in: https://crrev.com/c/7642813 Change-Id: I442cd7dfcb0b7d457a06fb73d808285b336738fc Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9081797 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Also add DataView.prototype.setBigUint64 and its optional littleEndian parameter. Bug: 445356784 Change-Id: If49c62df8beb2c7202ad12bad58d220ca3f1a3ad Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9081796 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
- Promise.all, Promise.race, Promise.allSettled expect a single (iterable) argument. - Date.now, Date.parse, Date.UTC don't return a Date, they return a number (the timestamp). The same applies to all the mutator / setter methods on Date.prototype. - String.prototype.localeCompare returns an integer, not a string. - String.prototype.match returns an array of matches, not a single string. - FinalizationRegistry.prototype.register doesn't return anything. - FinalizationRegistry.prototype.unregister returns a boolean (whether at least one cell was unregistered). - Reflect.getPrototypeOf, Reflect.isExtensible, and Reflect.ownKeys throw a TypeError if passed a primitive value, so type them as requiring an object. - DataView: The multi-byte getter and setter methods were missing the optional littleEndian boolean parameter. - Math.max and Math.min return a number (which might be NaN). - Object.assign, .defineProperty, .defineProperties and .freeze all return the object. - Array.fill, .reverse and .sort return the passed (modified) array. - The same is true for the typed arrays (Int8Array and friends). Change-Id: I1c96b03f3303aad8868a13102b6675126bcc3997 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9087136 Reviewed-by: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
Test cases that use OSR currently only do this through --jit-fuzzing triggering OSR in loops, often leading to brittle repros like the referenced bug. This creates a typical pattern in a code generator making use of the %OptimizeOsr() runtime function. Bug: 490353576 Change-Id: Id09459d8f7ba26a1b0eaec7e438de555b22fc7b5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9087056 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
Moves the randomness of the sandbox corruption engine from the JavaScript runtime to the Swift program generator. Functional changes: - Splits the monolithic `corrupt(obj, seed)` JS payload into modular entry points: `corruptDataWithBitflip`, `corruptDataWithIncrement`, `corruptDataWithReplace`, `corruptWithWorker`, and `corruptFunction`. - Replaces JS recursion with deterministic `pathArray` tuples generated by Fuzzilli, explicitly passing required entropy seeds (e.g., `[[Step.POINTER, offsetSeed], [Step.NEIGHBOR, hashQuery]]`). - `corruptFunction` evaluates the entire traversal path first and only hijacks the function if the final target is a JSFunction. - `corruptWithWorker` only sets up a background flipping race condition. - Operations, sizes, bit positions, sub-field offsets, and BigInt increment values are now calculated natively by Fuzzilli and passed to JS as explicit arguments. - Deletes the JS `Mutator` and `RNG` classes entirely, rendering the JS payload completely state-free. - Adds startup tests to explicitly verify the parser and read-only safety logic for all new corruption entry points. Bug: 490512258, 490522975 Change-Id: Ia4459efa2526ecd46aa6db441657905c057e1e37 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9053496 Reviewed-by: Michael Achenbach <machenbach@google.com> Auto-Submit: Dominik Klemba <tacet@google.com> Commit-Queue: Dominik Klemba <tacet@google.com>
Changes the failure rate for LiveTests.testWasmCodeGenerationAndCompilationAndExecution from 25% to 35%. This threshold should be reduced again once ref.cast is properly handled. Change-Id: I92938e5c58ce6171627cc003a13d5344c9cafe70 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9087656 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Dominik Klemba <tacet@google.com> Commit-Queue: Dominik Klemba <tacet@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Change-Id: I28783d963f1ac4678f2e2cdd170f9a8c5182e299 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9091116 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Michael Achenbach <machenbach@google.com>
and support iterables in OptionsBags. Iterator.zip was added to V8 with https://crrev.com/c/7605659. Bug: 465357675 Change-Id: Ia5e5c49831f8ad10c166bb32a264ee90a1aadead Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9090936 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Olivier Flückiger <olivf@google.com> Commit-Queue: Nikos Papaspyrou <nikolaos@google.com> Reviewed-by: Nikos Papaspyrou <nikolaos@google.com>
…codes` Include `--private_field_bytecodes` with a 0.5 probability. Include `--proto_assign_seq_lazy_func_opt` with a 0.5 probability in fuzzili. This flag does imply the flag it replaces. Seq count is fixed to 1 to stress the pattern. Bug: 449885256 Bug: 474269456 Change-Id: I4e9928c2c3b23ebc129bfae67d06dc286a8dfba7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9095116 Reviewed-by: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Change-Id: I9f2aedf60a7d3d8eec7011243e6ddac5af94aa74 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9099036 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Darius Mercadier <dmercadier@google.com>
Same as commit 226938a but now for the tail call variant (in preparation for using wasm-gc signatures for wasm functions.) Bug: 445356784 Change-Id: I5b2501b45a4a3f7e15c8814008d2d6d5bc9a9974 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9108116 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Manos Koukoutos <manoskouk@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Currently, when Fuzzilli fails to execute a script via the REPRL protocol (e.g., if the target fails to launch and send the HELO message, or crashes unexpectedly), the resulting error message is opaque (e.g., "Did not receive HELO message from child: Bad file descriptor"). Fuzzilli already captures the target's stdout and stderr in memory-mapped files by default, this change extracts those buffers and appends them to the Fuzzilli warning and error logs whenever `reprl_execute` fails. This surfaces the actual crash dump, missing dependencies, or startup errors directly in the logs, making debugging broken targets locally or on bots significantly easier. Bug: 492209808 Change-Id: If94fc9eadc97645ab240f648b7e6cf42378d091e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9095283 Auto-Submit: Giovanni Ortuño Urquidi <ortuno@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
V8 has lots of optimizations around smi ranges (e.g. untagging smis). Change-Id: I1393d1c30a61ef43d45f3ede4a74e6fe0b6c0e2d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9111056 Reviewed-by: Darius Mercadier <dmercadier@google.com> Commit-Queue: Darius Mercadier <dmercadier@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Bug: 445356784 Change-Id: I0eb33e4e3f800919b5c92bf6ce48ded45d372ac5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9108176 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 491410818 Change-Id: I400fbd530f32c3a8ee2c16cd71c73d24adf43357 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9110957 Commit-Queue: Darius Mercadier <dmercadier@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This works around false positives in connection with code referring to `f.arguments` in differential fuzzing. We now suppress any access to the `arguments` property and instead reject such samples. This has only an effect in differential fuzzing and is a no-op otherwise. We don't really care if the receiver actually is a function, and instead over-approximate this slightly. This might cover weird other ways of transferring the arguments to another object with `o.__proto__ = f`. Bug: 490382714 Change-Id: Ia7e78a6708f4d0db4c1ba671cfd279db8f57b70e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9102176 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
While this changes the IL to emit wasm-gc signatures for the functions, it doesn't yet actually allow using wasm-gc types in them. A few places (WasmDefineTable and WasmCallIndirect / WasmReturnCallIndirect) still need to be adapted to allow wasm-gc types before we can actually allow indexed wasm-gc types in function signatures. Bug: 445356784 Change-Id: I5715f584cfa5ee664f957a28e28bf80b6f3cdd9e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9115296 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com>
Change-Id: I4e2111aca7b7619584bffe9d008c60f55da18999 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9122916 Auto-Submit: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This reverts commit 1e31dbd. Reason for revert: This was likely not the culprit of https://crbug.com/524213342. The real fix landed in the mean time. Original change's description: > Temporarily make destruct operation-immutable > > Bug: 524213342 > Change-Id: Ib5ecc32559db751e8e48460a95ea896cf46d9d50 > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9432455 > Reviewed-by: Matthias Liedtke <mliedtke@google.com> > Commit-Queue: Michael Achenbach <machenbach@google.com> Bug: 524213342 Change-Id: Icb00b787fdeb9c6a6b162583058a2ab50999d92e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9463495 Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
…atch Many JavaScript input requirements are listed as "preferred". This means, even if we do have a variable of the correct type, we might not use it. Increasing this constant increases the probability that we will pick a variable of a correct type, and increase the probability of generating interesting code (e.g., trying to iterate an iterable instead of a non- iterable object). Fixed: 522657728 Change-Id: Ie0f6a1e4b8cd905c072bd8a36e96e4d4ecd5a0ef Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9463335 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
This CL enables subtyping support for structs. Bug: 517707090 Change-Id: I932a38eb1f29161cf2552d9aae83960f18c6b431 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9452016 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
This CL enables subtyping support for signatures. Bug: 517707090 Change-Id: Ibf052051b643341fe5555be819593c4a75393aa6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9457035 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL adds missing calls to registerTypeGroupDependency() for structs/arrays/signatures. This issue flushed out when FuzzilliCli ran into `Fuzzilli/WasmLifter.swift:564: Fatal error: Unexpectedly found nil while unwrapping an Optional value`. Bug: 517707090 Change-Id: I84f9aeedbfb8f5762ee113df44c3417aade15d6b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9463675 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
…for debugging Bug: 524213342 Change-Id: Id78d02bee00f3d032c515ea2f349238665d31fc3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9470675 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Cyclic imports require knowing which modules and exports we will generate *later*. Add the "pending module" concept to support this. We use .jsAnything as the type for the variables which will be exported later - it's hard to decide a better type upfront and those won't technically be true (since we might access a "var" variable before it has its final value). TAG=agy CONV=9d719888-54be-4548-b5e1-2eec15f7d6bc Bug: 342521422 Change-Id: I4f9621d5771244a12e18937688fed3327757658d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9408620 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
Before this CL, we chose which CodeGenerators to use in the prefix based on IsValueGenerator property (= all stubs in the generator require no inputs and produce something). However, we want to have CodeGenerators which satisfy that property, but which are not used in the prefix. This CL solves this problem by adding an explicit way to mark which code generators should be used in the prefix. CONV=fe946adb-0cf0-4d0b-a600-a45a70ecddad TAG=agy Bug: 526979176 Change-Id: Ib5dd42efbaf082e7196992c00aa867a23c4609b0 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9457934 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
…noise Optimize the reporting of poorly performing code generators and program templates by aggregating their stats across all fuzzer nodes and centralizing the output on the main thread. This makes log messages more actionable and easier to read and navigate in cloud logging. Key changes: - Moved the generator/template stats from individual worker threads to the root node. - Merged validSamples and interestingSamples into correctSamples. - Print compact, table-based logs. - Reduced log frequency to every 5th statistics update and on termination. TAG=agy Bug: 465497343 Change-Id: I146e8b08057ee1ed84cf64c8f308b6be7b63bbf3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9432454 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
The index passed into the `translateInput` is unused, as the code hard-coded to use 0. Bug: 527887612, 524213342 Change-Id: I7e8604ae8cc814ab588614dff70a77d2db8fe732 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9471895 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Tigran Bantikyan <bantikyan@google.com>
This CL adds `isFinal` to WasmTypeDescription and subclasses WasmArrayTypeDescription, WasmStructTypeDescription, WasmSignatureTypeDescription. In code generators, we only use non-final super types. All generated types are final with a probability of 25%. Bug: 517707090 Change-Id: I47df3b1b8f06f5b133f3a349f0c1c7aeebdc975f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9464195 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
and make them parallelizable. - AnalyzerTest.swift - ContextGraphTest.swift - DiffOracleTests.swift - EngineTests.swift Bug: 522635668 Change-Id: Icb3e6503cd84d2fffeb9952c866e6f7a40c618f1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9471917 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 515363087 Change-Id: Ib12bedcdabb2681a10afcce1bb26dae5a89c56f1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9453876 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 522635668 Change-Id: I42ffbdb0fbf0f25a621a14466a3c4c9d815089fb Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9475596 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Bug: 498924945 TAG=agy Change-Id: Idf0bab6bef6811f82abd8bfc5586e4d699b90d4a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9376411 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This reverts commit a799a23. Reason for revert: Suspected to crash with: Fatal error: Code generators must contain at least one generator to be used in the prefix Original change's description: > [code generators] Introduce explicit "useInPrefix" > > Before this CL, we chose which CodeGenerators to use in the prefix based > on IsValueGenerator property (= all stubs in the generator require no > inputs and produce something). > > However, we want to have CodeGenerators which satisfy that > property, but which are not used in the prefix. > > This CL solves this problem by adding an explicit way to mark which code > generators should be used in the prefix. > > CONV=fe946adb-0cf0-4d0b-a600-a45a70ecddad > TAG=agy > Bug: 526979176 > Change-Id: Ib5dd42efbaf082e7196992c00aa867a23c4609b0 > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9457934 > Commit-Queue: Marja Hölttä <marja@google.com> > Reviewed-by: Matthias Liedtke <mliedtke@google.com> Bug: 526979176 Change-Id: I1acc51b237c4ece57cf9ef7b4637a6bd16c6ebf6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482515 Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Marja Hölttä <marja@google.com>
Previous version: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9457934 Previous description: Before this CL, we chose which CodeGenerators to use in the prefix based on IsValueGenerator property (= all stubs in the generator require no inputs and produce something). However, we want to have CodeGenerators which satisfy that property, but which are not used in the prefix. This CL solves this problem by adding an explicit way to mark which code generators should be used in the prefix. Fix: Update CodeGenerators in various files to pass useInPrefix: true as needed. CONV=fe946adb-0cf0-4d0b-a600-a45a70ecddad TAG=agy Bug: 526979176 Change-Id: I20abc01ef6b28f69aa39861143c7cb9e253608fe Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482715 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
…putMutable Mutating the input of a pending bundle module doesn't make sense, since it would disconnect the pending bundle module declaration and definition. TAG=agy CONV=54baa3fa-0849-4897-bf71-1d1444d3dece Change-Id: I2bfec9f49e41a1d9f73fdc9abc0b8612fe380771 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9483335 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
- EnvironmentTest.swift - InstructionTests.swift - Leb128Test.swift - ProbingMutatorTests.swift - ProgramSerializationTest.swift - RingBufferTest.swift - TestUtils.swift Bug: 522635668 Change-Id: I54f26fd83eb0b393ea9f3d5ab8aabc95cc972dd2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482716 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Otherwise workers are going to crash as they take over the generator and mutator of the main config but miss the wasmOptPath. Bug: 498924945 Change-Id: Ia5137e731823e9387b7cbd38a8b3328ac70158e9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9484055 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com>
Don't replace non-jsvariable inputs with inputs which might be of a different type. Additionally, mark label-related operations as isNotInputMutable. Change-Id: Iafce817bc7781aa6f919d59e9faf8855ae6c9f82 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9483695 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
Otherwise this causes reports that this generator has too restrictive dynamic requirements when running without --bundle, e.g.: Code generators with too restrictive dynamic requirements: Name | Success | Invocations DynamicImportGenerator | 0.00% | 12487 This way, if we are in the .bundle context, we can even schedule the generation of a module before emitting the import. Bug: 398218423 Change-Id: I3d758298f750796cce01b143cf87ad65df9c98d7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9484355 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@google.com>
This moves the logic to construct an identical subtype for a given supertype from code generators. In follow-up CLs, this function will become recursive and more capable. Bug: 517707090 Change-Id: I64cf7a6ae4f37f16d48f633670e9af9203149098 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9475595 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Enables generation of non-identical subtypes for arrays. Specifically: - Immutable arrays w/ (elementType is nullable reference type): make element type in subtype non-nullable with p=50%. - Immutable arrays w/ (elementType is reference to index type): find an existing subtype for the element type. Bug: 517707090 Change-Id: I9d8fd570274b4e94042dba59be22bc425b87ed51 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482876 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL contains a couple of minor cleanups. Bug: 529687716 Change-Id: Iadc25fe651f4ed9ddd79ccaa400355af75c126d9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9489395 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Bug:498924945 TAG=agy Change-Id: I3a8d353800bf9349ea23e446e3562c49af98f3de Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9475800 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This was removed with https://crrev.com/c/7960065 Bug: 525363217 Change-Id: Iaf4772b0f965ddd0bf823e2d7f33d2e0fa5e8642 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9489875 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
…isposables to avoid throwing. Bug: 524562043 Change-Id: Ibbd2b13b0dff18b3a149a98d836b5f0092959ca6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9432394 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 524213342 Change-Id: Ia5b05c04a4068ce9d698a4ea35b6a49b2624fe2b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9492736 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Michael Achenbach <machenbach@google.com>
This adds tests for the exploration mutator. To make them deterministic, two helper functions for determining the runtime values to explore are factored out for testing. Additionally, tests need to ignore the non-deterministic seed passed to explore. With these changes, we can now test the instrumentation and processing of explore and compare the expected JS programs. One of the tests should cover the logic for https://crbug.com/527887612. Bug: 527887612, 524213342 Change-Id: If7ad6dc9dc94d7736b7bbcc4a0dd447568c226fb Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482875 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Michael Achenbach <machenbach@google.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
13 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
updating with head