base fuzzili update #52
Open
Dudcom wants to merge 423 commits into
Open
Conversation
- Promise.all, Promise.race, Promise.allSettled expect a single (iterable) argument. - Date.now, Date.parse, Date.UTC don't return a Date, they return a number (the timestamp). The same applies to all the mutator / setter methods on Date.prototype. - String.prototype.localeCompare returns an integer, not a string. - String.prototype.match returns an array of matches, not a single string. - FinalizationRegistry.prototype.register doesn't return anything. - FinalizationRegistry.prototype.unregister returns a boolean (whether at least one cell was unregistered). - Reflect.getPrototypeOf, Reflect.isExtensible, and Reflect.ownKeys throw a TypeError if passed a primitive value, so type them as requiring an object. - DataView: The multi-byte getter and setter methods were missing the optional littleEndian boolean parameter. - Math.max and Math.min return a number (which might be NaN). - Object.assign, .defineProperty, .defineProperties and .freeze all return the object. - Array.fill, .reverse and .sort return the passed (modified) array. - The same is true for the typed arrays (Int8Array and friends). Change-Id: I1c96b03f3303aad8868a13102b6675126bcc3997 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9087136 Reviewed-by: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
Test cases that use OSR currently only do this through --jit-fuzzing triggering OSR in loops, often leading to brittle repros like the referenced bug. This creates a typical pattern in a code generator making use of the %OptimizeOsr() runtime function. Bug: 490353576 Change-Id: Id09459d8f7ba26a1b0eaec7e438de555b22fc7b5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9087056 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
Moves the randomness of the sandbox corruption engine from the JavaScript runtime to the Swift program generator. Functional changes: - Splits the monolithic `corrupt(obj, seed)` JS payload into modular entry points: `corruptDataWithBitflip`, `corruptDataWithIncrement`, `corruptDataWithReplace`, `corruptWithWorker`, and `corruptFunction`. - Replaces JS recursion with deterministic `pathArray` tuples generated by Fuzzilli, explicitly passing required entropy seeds (e.g., `[[Step.POINTER, offsetSeed], [Step.NEIGHBOR, hashQuery]]`). - `corruptFunction` evaluates the entire traversal path first and only hijacks the function if the final target is a JSFunction. - `corruptWithWorker` only sets up a background flipping race condition. - Operations, sizes, bit positions, sub-field offsets, and BigInt increment values are now calculated natively by Fuzzilli and passed to JS as explicit arguments. - Deletes the JS `Mutator` and `RNG` classes entirely, rendering the JS payload completely state-free. - Adds startup tests to explicitly verify the parser and read-only safety logic for all new corruption entry points. Bug: 490512258, 490522975 Change-Id: Ia4459efa2526ecd46aa6db441657905c057e1e37 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9053496 Reviewed-by: Michael Achenbach <machenbach@google.com> Auto-Submit: Dominik Klemba <tacet@google.com> Commit-Queue: Dominik Klemba <tacet@google.com>
Changes the failure rate for LiveTests.testWasmCodeGenerationAndCompilationAndExecution from 25% to 35%. This threshold should be reduced again once ref.cast is properly handled. Change-Id: I92938e5c58ce6171627cc003a13d5344c9cafe70 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9087656 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Dominik Klemba <tacet@google.com> Commit-Queue: Dominik Klemba <tacet@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Change-Id: I28783d963f1ac4678f2e2cdd170f9a8c5182e299 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9091116 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Michael Achenbach <machenbach@google.com>
and support iterables in OptionsBags. Iterator.zip was added to V8 with https://crrev.com/c/7605659. Bug: 465357675 Change-Id: Ia5e5c49831f8ad10c166bb32a264ee90a1aadead Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9090936 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Olivier Flückiger <olivf@google.com> Commit-Queue: Nikos Papaspyrou <nikolaos@google.com> Reviewed-by: Nikos Papaspyrou <nikolaos@google.com>
…codes` Include `--private_field_bytecodes` with a 0.5 probability. Include `--proto_assign_seq_lazy_func_opt` with a 0.5 probability in fuzzili. This flag does imply the flag it replaces. Seq count is fixed to 1 to stress the pattern. Bug: 449885256 Bug: 474269456 Change-Id: I4e9928c2c3b23ebc129bfae67d06dc286a8dfba7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9095116 Reviewed-by: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Change-Id: I9f2aedf60a7d3d8eec7011243e6ddac5af94aa74 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9099036 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Darius Mercadier <dmercadier@google.com>
Same as commit 226938a but now for the tail call variant (in preparation for using wasm-gc signatures for wasm functions.) Bug: 445356784 Change-Id: I5b2501b45a4a3f7e15c8814008d2d6d5bc9a9974 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9108116 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Manos Koukoutos <manoskouk@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Currently, when Fuzzilli fails to execute a script via the REPRL protocol (e.g., if the target fails to launch and send the HELO message, or crashes unexpectedly), the resulting error message is opaque (e.g., "Did not receive HELO message from child: Bad file descriptor"). Fuzzilli already captures the target's stdout and stderr in memory-mapped files by default, this change extracts those buffers and appends them to the Fuzzilli warning and error logs whenever `reprl_execute` fails. This surfaces the actual crash dump, missing dependencies, or startup errors directly in the logs, making debugging broken targets locally or on bots significantly easier. Bug: 492209808 Change-Id: If94fc9eadc97645ab240f648b7e6cf42378d091e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9095283 Auto-Submit: Giovanni Ortuño Urquidi <ortuno@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
V8 has lots of optimizations around smi ranges (e.g. untagging smis). Change-Id: I1393d1c30a61ef43d45f3ede4a74e6fe0b6c0e2d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9111056 Reviewed-by: Darius Mercadier <dmercadier@google.com> Commit-Queue: Darius Mercadier <dmercadier@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Bug: 445356784 Change-Id: I0eb33e4e3f800919b5c92bf6ce48ded45d372ac5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9108176 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 491410818 Change-Id: I400fbd530f32c3a8ee2c16cd71c73d24adf43357 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9110957 Commit-Queue: Darius Mercadier <dmercadier@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This works around false positives in connection with code referring to `f.arguments` in differential fuzzing. We now suppress any access to the `arguments` property and instead reject such samples. This has only an effect in differential fuzzing and is a no-op otherwise. We don't really care if the receiver actually is a function, and instead over-approximate this slightly. This might cover weird other ways of transferring the arguments to another object with `o.__proto__ = f`. Bug: 490382714 Change-Id: Ia7e78a6708f4d0db4c1ba671cfd279db8f57b70e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9102176 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
While this changes the IL to emit wasm-gc signatures for the functions, it doesn't yet actually allow using wasm-gc types in them. A few places (WasmDefineTable and WasmCallIndirect / WasmReturnCallIndirect) still need to be adapted to allow wasm-gc types before we can actually allow indexed wasm-gc types in function signatures. Bug: 445356784 Change-Id: I5715f584cfa5ee664f957a28e28bf80b6f3cdd9e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9115296 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com>
Change-Id: I4e2111aca7b7619584bffe9d008c60f55da18999 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9122916 Auto-Submit: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This simplifies and reduces a lot of code and prepares adding support for more kinds of class members without exploding the number of instructions due to the additional factor 2 for static and instance members. Concretely this merges instructions for all members (properties, elements and methods) that have a static and non-static (instance) variant. The static bit is represented by a variable in the instruction. This was also tested locally with and without this change, both with large number for class-related code generators. Both versions resulted in similar correctness stats without any crashes. Bug: 446634535 Change-Id: I57b3261e202dffeb57704d0040b2a8d02b50a9e6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9094176 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
The TableType will need to be adapted for tracking wasm-gc signatures. I just couldn't find a good reason why we'd need to store the TableType on Table.get and Table.set? Bug: 445356784 Change-Id: Ia115d287b27cc18f52a48ddce25b897f1a19b293 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9123736 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Change-Id: I99bc88a3cefdd5d4cbaf645b10e1cdcd66138a52 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9123977 Commit-Queue: Manos Koukoutos <manoskouk@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
The WasmThrowRefGenerator requires an exnref as an input. Without having a generator that produces it, it isn't very likely that there is an exnref available in the current program, so the generator cannot be run in most cases. Registering a generator producing that exnref (if a tag is available) helps significantly. Change-Id: Idbd9337f5a7339d58fe1f76e264569907f7081ce Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9123976 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Manos Koukoutos <manoskouk@google.com>
The first attempt of fixing this was commit 89691a1, however this means we might end up not typing the inner outputs (the tag's "elements" available inside the catch) which breaks the typer's assumptions that everything gets typed. Typing it with some dummy value can also lead to issues downstream (e.g. by the next instruction taking now an input that isn't of the needed type any more), so instead we solve this issue by always also adding a signature as an input. As the signature is defined in Wasm, input replacement can only happen with strict type checks, so it is safe to rely on this. It's a bit annoying for the WasmBeginCatch to take an extra input for this specific problem, however, WasmBeginCatch is anyways related to the "legacy" exception handling which isn't a properly spec'ed Wasm feature but a "browsers have been shipping this without a finished spec" kind of thing. Bug: 448860865 Change-Id: I06638ccbb5ed0c9dbb7355ac198b7ace25f521b8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9129497 Reviewed-by: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
The issue was introduced with commit 7fb8254 While I was running the fuzzer for multiple hours, the fuzzer is more persmissive in not crashing on invalid programs send over the wire, so this wasn't detected. Change-Id: I34f04902915539cb688c5c6eb6825d28a123ccb0 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9130176 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Olivier Flückiger <olivf@google.com>
Change-Id: I6a3f252f20742dac630864ab4b07e493dbde46ec Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9133476 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Similar to method names, this supports all allowed ways to define properties. Approximated valid identifiers will be used as is, everything else will be quoted, except positive integers. Since such a property can leak into the type information of an object or class, also all property accesses are adapted now, similar to method calls. This also refactors the import of object fields and methods, unifying the same property-key logic used in class definitions. Computed getters and setters for object literals and classes are still a TODO. This also lifts some restrictions from runtime assisted mutators, which previously only allowed simple identifiers as property names. Bug: 446634535 Change-Id: I35a65c0073fee9bac238205557958e80c60e1186 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9111376 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 495679730 Change-Id: I45c1af939f3e1a81fc1c3a2649652e25c644cc82 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9137477 Reviewed-by: Darius Mercadier <dmercadier@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
When a program instrumented by RuntimeAssistedMutator crashes, we avoid calling processCrash() on it immediately. This is because the boilerplate code added during instrumentation makes such crashes difficult to minimize (see, e.g., https://g-issues.chromium.org/issues/488963988?pli=1&authuser=0). Instead, we follow this procedure: 1. Always log the crash of the instrumented program. 2. Check if the process()'d version of the instrumented program also crashes. 3. If yes, we call processCrash() on that program instead, as its more straightforward to minimize. Bug: 488963988 Change-Id: Iffefc9435f4ef31a3fbf798d374a04f9f1fc115a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9129498 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
We need at least "warning" level to see logs from worker threads. Change-Id: I4ec5d9d89f5697cf5710a250888e054789716f78 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9151416 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
Fixed: 496097209 Change-Id: Icb0f88bcf619791fa3a45af7f0f2cd73428d37df Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9141456 Auto-Submit: Michael Achenbach <machenbach@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This was removed in https://crrev.com/c/7708297 Bug: 42202693 Change-Id: Ia3b8b197b28b62ba6eb73aeda498ae748fb093ee Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9155336 Auto-Submit: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
This enables computed getters and setters for classes and adds the remaining bits to support computed getters and setters for object expressions. Also fully supports and tests getters and setters with non-identifier names for classes. Bug: 446634535 Change-Id: Ib18477c237674b8b9c911f36ba3e53daed136fb8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9100459 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
Bug: 498924945 TAG=agy Change-Id: Idf0bab6bef6811f82abd8bfc5586e4d699b90d4a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9376411 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This reverts commit a799a23. Reason for revert: Suspected to crash with: Fatal error: Code generators must contain at least one generator to be used in the prefix Original change's description: > [code generators] Introduce explicit "useInPrefix" > > Before this CL, we chose which CodeGenerators to use in the prefix based > on IsValueGenerator property (= all stubs in the generator require no > inputs and produce something). > > However, we want to have CodeGenerators which satisfy that > property, but which are not used in the prefix. > > This CL solves this problem by adding an explicit way to mark which code > generators should be used in the prefix. > > CONV=fe946adb-0cf0-4d0b-a600-a45a70ecddad > TAG=agy > Bug: 526979176 > Change-Id: Ib5dd42efbaf082e7196992c00aa867a23c4609b0 > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9457934 > Commit-Queue: Marja Hölttä <marja@google.com> > Reviewed-by: Matthias Liedtke <mliedtke@google.com> Bug: 526979176 Change-Id: I1acc51b237c4ece57cf9ef7b4637a6bd16c6ebf6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482515 Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Marja Hölttä <marja@google.com>
Previous version: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9457934 Previous description: Before this CL, we chose which CodeGenerators to use in the prefix based on IsValueGenerator property (= all stubs in the generator require no inputs and produce something). However, we want to have CodeGenerators which satisfy that property, but which are not used in the prefix. This CL solves this problem by adding an explicit way to mark which code generators should be used in the prefix. Fix: Update CodeGenerators in various files to pass useInPrefix: true as needed. CONV=fe946adb-0cf0-4d0b-a600-a45a70ecddad TAG=agy Bug: 526979176 Change-Id: I20abc01ef6b28f69aa39861143c7cb9e253608fe Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482715 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
…putMutable Mutating the input of a pending bundle module doesn't make sense, since it would disconnect the pending bundle module declaration and definition. TAG=agy CONV=54baa3fa-0849-4897-bf71-1d1444d3dece Change-Id: I2bfec9f49e41a1d9f73fdc9abc0b8612fe380771 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9483335 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
- EnvironmentTest.swift - InstructionTests.swift - Leb128Test.swift - ProbingMutatorTests.swift - ProgramSerializationTest.swift - RingBufferTest.swift - TestUtils.swift Bug: 522635668 Change-Id: I54f26fd83eb0b393ea9f3d5ab8aabc95cc972dd2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482716 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Otherwise workers are going to crash as they take over the generator and mutator of the main config but miss the wasmOptPath. Bug: 498924945 Change-Id: Ia5137e731823e9387b7cbd38a8b3328ac70158e9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9484055 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com>
Don't replace non-jsvariable inputs with inputs which might be of a different type. Additionally, mark label-related operations as isNotInputMutable. Change-Id: Iafce817bc7781aa6f919d59e9faf8855ae6c9f82 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9483695 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
Otherwise this causes reports that this generator has too restrictive dynamic requirements when running without --bundle, e.g.: Code generators with too restrictive dynamic requirements: Name | Success | Invocations DynamicImportGenerator | 0.00% | 12487 This way, if we are in the .bundle context, we can even schedule the generation of a module before emitting the import. Bug: 398218423 Change-Id: I3d758298f750796cce01b143cf87ad65df9c98d7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9484355 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@google.com>
This moves the logic to construct an identical subtype for a given supertype from code generators. In follow-up CLs, this function will become recursive and more capable. Bug: 517707090 Change-Id: I64cf7a6ae4f37f16d48f633670e9af9203149098 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9475595 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Enables generation of non-identical subtypes for arrays. Specifically: - Immutable arrays w/ (elementType is nullable reference type): make element type in subtype non-nullable with p=50%. - Immutable arrays w/ (elementType is reference to index type): find an existing subtype for the element type. Bug: 517707090 Change-Id: I9d8fd570274b4e94042dba59be22bc425b87ed51 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482876 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL contains a couple of minor cleanups. Bug: 529687716 Change-Id: Iadc25fe651f4ed9ddd79ccaa400355af75c126d9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9489395 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Bug:498924945 TAG=agy Change-Id: I3a8d353800bf9349ea23e446e3562c49af98f3de Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9475800 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This was removed with https://crrev.com/c/7960065 Bug: 525363217 Change-Id: Iaf4772b0f965ddd0bf823e2d7f33d2e0fa5e8642 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9489875 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
…isposables to avoid throwing. Bug: 524562043 Change-Id: Ibbd2b13b0dff18b3a149a98d836b5f0092959ca6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9432394 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 524213342 Change-Id: Ia5b05c04a4068ce9d698a4ea35b6a49b2624fe2b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9492736 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Michael Achenbach <machenbach@google.com>
This adds tests for the exploration mutator. To make them deterministic, two helper functions for determining the runtime values to explore are factored out for testing. Additionally, tests need to ignore the non-deterministic seed passed to explore. With these changes, we can now test the instrumentation and processing of explore and compare the expected JS programs. One of the tests should cover the logic for https://crbug.com/527887612. Bug: 527887612, 524213342 Change-Id: If7ad6dc9dc94d7736b7bbcc4a0dd447568c226fb Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482875 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Michael Achenbach <machenbach@google.com>
Enables generation of non-identical subtypes for structs. Specifically: - Width: Possibly add an additional field in the subtype. - Depth: Immutable fields w/ non-final index types: find an existing subtype of the field to use in the struct subtype. Bug: 517707090 Change-Id: Ic1c905c40802f238d699d63b95a5c68d1b58200e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9483575 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
We now check for inconsistencies before the mutation loop and after every mutation. The error message now includes the name of the mutator and the exception from the inconsistency check. Bug: 524213342 Change-Id: I445a75e9d1d235489bd2494bc3b53f63bda5fb7a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9495915 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
The new stress flag landed in V8 in crrev.com/c/8035161. Bug: 474302353 Change-Id: Iea61431726cf7d51d13ecd136c02b810c7701c4a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9496095 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Omer Katz <omerkatz@google.com>
Enables generation of non-identical subtypes of signatures. Specifically, we search for - an existing subtype (for covariant outputs); - an existing supertype (for contravariant parameters); and use them in the subtype of the signature. Bug: 517707090 Change-Id: I42c90cebf34719ae5a531db23d061b2c76f81455 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9485235 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Bug: 524562043 Change-Id: Idea3856321cdcfa50c15e38c01b4a0743d418bd6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9500780 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 526972176 Change-Id: I694374c246115afd25552b8fcaaa5d8957420544 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9497376 Reviewed-by: Clemens Backes <clemensb@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 475707969 Change-Id: I7873e0d8e2702314c50ee22e7e80d25e2162e4d2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9501735 Reviewed-by: Maksim Ivanov <emaxx@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Clemens Backes <clemensb@google.com>
https://crrev.com/i/9471895 fixed a bug that lead to the discovery of the present issue. The following error spiked in the logs after that CL landed: `HybridEngineFixupMutator] Failed to process action: Missing input 2 for operation SetProperty` The problem is that FixupMutator only passes 2 inputs to `setProperty`, but 3 are required. Before https://crrev.com/i/9471895 landed, this problem was masked because `translateInput(2)`, called from RuntimeAssistedMutator, was equivalent to `translateInput(0)`. ``` case .SetProperty: let o = try translateInput(0) let v = try translateInput(2) ``` This CL adds the missing input. Bug: 527887612 Change-Id: If6719836c37a80eb3eeabb54e76f3e2a77740ca3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9498035 Reviewed-by: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
When generating a subtype for an index type that contains an abstract reference type in a field/element, use `randomWasmReferenceType()` to generate a compatible "subtype" of that field/element, which can be either an abstract or an index type. Bug: 517707090 Change-Id: Ic81f8361b6e489b2839613dea34f1eb730550c49 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9487556 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
The current extra checking of program inconsistencies is running into the known bug https://crbug.com/508306801. Since this particular inconsistency can not lead to the symptoms we saw in the exploration mutator, we skip the variable visibility check for now, but only in the extra checking we added for debugging. Bug: 524213342, 508306801 Change-Id: I0925b19b4d460e3660e2027cfa2317f5467eb231 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9508495 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
The `OP_CONSTRUCT_METHOD` handler accepts two parameters, `v` and `inputs`, though only `inputs` is used. The rest of the code assumes that `inputs` is the first argument of every handler, as noted in the comment preceding the `ACTION_HANDLERS` object and as seen in the handler's invocation: ``` context.output = handler(concreteInputs, context.currentThis); ``` Consequently, `context.currentThis` is passed in lieu of the inputs, and there are no valid `OP_CONSTRUCT_METHOD` calls. Bug: 531684877, 529687716 Change-Id: Ib53f102085388611f482e3eadebcf7b266d78b3c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9507098 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL enables randomWasmBlockOutputTypes() to also generate index types. Change-Id: I8ee24c2c0525a3ef2feb3dddcd8e16852b4a7472 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9508895 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Lifting must be deterministic, so in object literals, we must have the properties always in the same order. Before this CL, that was guaranteed by sorting them. This CL removes the sorting and instead uses data structures which are already ordered. This is more robust and also allows us to generate code which was not possible before. (E.g., an options bag where the keys appear in an unexpected order is an interesting case to test.) TAG=agy CONV=35c7cc7f-a078-4761-860a-7fb97352d47c Fixed: 522153837 Change-Id: I81249cd2d719ce3281775e354d654ab39fd15f6f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9470855 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
This CL adds support for compiling JavaScript function parameter destructuring (objects and arrays) into FuzzIL, and lifting it back to JS.
Computed Keys and Inner Default Values ain't supported.
Bug: 515363087
Change-Id: I6157c3e634c91bcc6bedefeaf7b0861be1fe64b2
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9464375
Reviewed-by: Michael Achenbach <machenbach@google.com>
Commit-Queue: Raphaël Hérouart <rherouart@google.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
14 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
updating with head