base fuzzili update #52
Open
Dudcom wants to merge 434 commits into
Open
Conversation
Bug: 445356784 Change-Id: I0eb33e4e3f800919b5c92bf6ce48ded45d372ac5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9108176 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 491410818 Change-Id: I400fbd530f32c3a8ee2c16cd71c73d24adf43357 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9110957 Commit-Queue: Darius Mercadier <dmercadier@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This works around false positives in connection with code referring to `f.arguments` in differential fuzzing. We now suppress any access to the `arguments` property and instead reject such samples. This has only an effect in differential fuzzing and is a no-op otherwise. We don't really care if the receiver actually is a function, and instead over-approximate this slightly. This might cover weird other ways of transferring the arguments to another object with `o.__proto__ = f`. Bug: 490382714 Change-Id: Ia7e78a6708f4d0db4c1ba671cfd279db8f57b70e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9102176 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
While this changes the IL to emit wasm-gc signatures for the functions, it doesn't yet actually allow using wasm-gc types in them. A few places (WasmDefineTable and WasmCallIndirect / WasmReturnCallIndirect) still need to be adapted to allow wasm-gc types before we can actually allow indexed wasm-gc types in function signatures. Bug: 445356784 Change-Id: I5715f584cfa5ee664f957a28e28bf80b6f3cdd9e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9115296 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com>
Change-Id: I4e2111aca7b7619584bffe9d008c60f55da18999 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9122916 Auto-Submit: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This simplifies and reduces a lot of code and prepares adding support for more kinds of class members without exploding the number of instructions due to the additional factor 2 for static and instance members. Concretely this merges instructions for all members (properties, elements and methods) that have a static and non-static (instance) variant. The static bit is represented by a variable in the instruction. This was also tested locally with and without this change, both with large number for class-related code generators. Both versions resulted in similar correctness stats without any crashes. Bug: 446634535 Change-Id: I57b3261e202dffeb57704d0040b2a8d02b50a9e6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9094176 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
The TableType will need to be adapted for tracking wasm-gc signatures. I just couldn't find a good reason why we'd need to store the TableType on Table.get and Table.set? Bug: 445356784 Change-Id: Ia115d287b27cc18f52a48ddce25b897f1a19b293 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9123736 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Change-Id: I99bc88a3cefdd5d4cbaf645b10e1cdcd66138a52 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9123977 Commit-Queue: Manos Koukoutos <manoskouk@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
The WasmThrowRefGenerator requires an exnref as an input. Without having a generator that produces it, it isn't very likely that there is an exnref available in the current program, so the generator cannot be run in most cases. Registering a generator producing that exnref (if a tag is available) helps significantly. Change-Id: Idbd9337f5a7339d58fe1f76e264569907f7081ce Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9123976 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Manos Koukoutos <manoskouk@google.com>
The first attempt of fixing this was commit 89691a1, however this means we might end up not typing the inner outputs (the tag's "elements" available inside the catch) which breaks the typer's assumptions that everything gets typed. Typing it with some dummy value can also lead to issues downstream (e.g. by the next instruction taking now an input that isn't of the needed type any more), so instead we solve this issue by always also adding a signature as an input. As the signature is defined in Wasm, input replacement can only happen with strict type checks, so it is safe to rely on this. It's a bit annoying for the WasmBeginCatch to take an extra input for this specific problem, however, WasmBeginCatch is anyways related to the "legacy" exception handling which isn't a properly spec'ed Wasm feature but a "browsers have been shipping this without a finished spec" kind of thing. Bug: 448860865 Change-Id: I06638ccbb5ed0c9dbb7355ac198b7ace25f521b8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9129497 Reviewed-by: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
The issue was introduced with commit 7fb8254 While I was running the fuzzer for multiple hours, the fuzzer is more persmissive in not crashing on invalid programs send over the wire, so this wasn't detected. Change-Id: I34f04902915539cb688c5c6eb6825d28a123ccb0 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9130176 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Olivier Flückiger <olivf@google.com>
Change-Id: I6a3f252f20742dac630864ab4b07e493dbde46ec Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9133476 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Similar to method names, this supports all allowed ways to define properties. Approximated valid identifiers will be used as is, everything else will be quoted, except positive integers. Since such a property can leak into the type information of an object or class, also all property accesses are adapted now, similar to method calls. This also refactors the import of object fields and methods, unifying the same property-key logic used in class definitions. Computed getters and setters for object literals and classes are still a TODO. This also lifts some restrictions from runtime assisted mutators, which previously only allowed simple identifiers as property names. Bug: 446634535 Change-Id: I35a65c0073fee9bac238205557958e80c60e1186 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9111376 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 495679730 Change-Id: I45c1af939f3e1a81fc1c3a2649652e25c644cc82 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9137477 Reviewed-by: Darius Mercadier <dmercadier@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
When a program instrumented by RuntimeAssistedMutator crashes, we avoid calling processCrash() on it immediately. This is because the boilerplate code added during instrumentation makes such crashes difficult to minimize (see, e.g., https://g-issues.chromium.org/issues/488963988?pli=1&authuser=0). Instead, we follow this procedure: 1. Always log the crash of the instrumented program. 2. Check if the process()'d version of the instrumented program also crashes. 3. If yes, we call processCrash() on that program instead, as its more straightforward to minimize. Bug: 488963988 Change-Id: Iffefc9435f4ef31a3fbf798d374a04f9f1fc115a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9129498 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
We need at least "warning" level to see logs from worker threads. Change-Id: I4ec5d9d89f5697cf5710a250888e054789716f78 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9151416 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
Fixed: 496097209 Change-Id: Icb0f88bcf619791fa3a45af7f0f2cd73428d37df Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9141456 Auto-Submit: Michael Achenbach <machenbach@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This was removed in https://crrev.com/c/7708297 Bug: 42202693 Change-Id: Ia3b8b197b28b62ba6eb73aeda498ae748fb093ee Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9155336 Auto-Submit: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
This enables computed getters and setters for classes and adds the remaining bits to support computed getters and setters for object expressions. Also fully supports and tests getters and setters with non-identifier names for classes. Bug: 446634535 Change-Id: Ib18477c237674b8b9c911f36ba3e53daed136fb8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9100459 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
This CL transpiles crashing instrumented FuzzIL programs to JS (to insert the JS boilerplate code required for, e.g., explore()), and then transpiles this JS code back to FuzzIL and reports that program. This change will allow to apply Fuzzilli's own program minimization technique also on the boilerplate code. We hope that this will result in smaller reported programs. Bug: 488963988 Change-Id: I1e5ee51409c4c5e26db80e96d4f61060e12f0bd1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9155916 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 430616180 Change-Id: I168f494c2a1c0510fb6524495da4adb10ccd00cc Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9155816 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
To align better with the current formatting. No other reason. Also add a few swift-ignore-format annotations for weights. Bug: 430616180 Change-Id: I07b5dae4938578a49ec393faaf18959e2867e58f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9155817 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
The implicit import mechanism in Wasm needs a rework sooner or later. For now, let's make it more robust in this case. Fixed: 498266575 Change-Id: I17cc0021cbe945d5db16029c451e3ea6bfb55ff1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9159837 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
Author
|
we are in hell |
Change-Id: I9e7e47344d5c9fb3e56545be210788e1d8e492ef Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9155596 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
RAB/GSAB was shipped a while ago, we don't need the boosted weights any more Change-Id: Ic7da221bc2d47b1966906566d1e0ca4616251153 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9160936 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Change-Id: If51387c564c5c4245d23122be751ce46682b0fee Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9159756 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Mostly just to match the naming of `newValue` and the subtyping idea of the forUseAs where we try to find something that is a subtype of the current variable's type, not the other way around. Change-Id: I3144025a0e1850892936087fdf275d318943f963 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9159757 Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Bug: 430616180 Change-Id: I12f41e8c87913481f05f3bf350acdb88ac08c163 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9155818 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
Bug: 430616180 Change-Id: I6784d3f4232e11b272cbb7a345713edff05c7426 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9156216 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
Bug:498924945 TAG=agy Change-Id: I3a8d353800bf9349ea23e446e3562c49af98f3de Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9475800 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This was removed with https://crrev.com/c/7960065 Bug: 525363217 Change-Id: Iaf4772b0f965ddd0bf823e2d7f33d2e0fa5e8642 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9489875 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
…isposables to avoid throwing. Bug: 524562043 Change-Id: Ibbd2b13b0dff18b3a149a98d836b5f0092959ca6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9432394 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 524213342 Change-Id: Ia5b05c04a4068ce9d698a4ea35b6a49b2624fe2b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9492736 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Michael Achenbach <machenbach@google.com>
This adds tests for the exploration mutator. To make them deterministic, two helper functions for determining the runtime values to explore are factored out for testing. Additionally, tests need to ignore the non-deterministic seed passed to explore. With these changes, we can now test the instrumentation and processing of explore and compare the expected JS programs. One of the tests should cover the logic for https://crbug.com/527887612. Bug: 527887612, 524213342 Change-Id: If7ad6dc9dc94d7736b7bbcc4a0dd447568c226fb Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482875 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Michael Achenbach <machenbach@google.com>
Enables generation of non-identical subtypes for structs. Specifically: - Width: Possibly add an additional field in the subtype. - Depth: Immutable fields w/ non-final index types: find an existing subtype of the field to use in the struct subtype. Bug: 517707090 Change-Id: Ic1c905c40802f238d699d63b95a5c68d1b58200e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9483575 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
We now check for inconsistencies before the mutation loop and after every mutation. The error message now includes the name of the mutator and the exception from the inconsistency check. Bug: 524213342 Change-Id: I445a75e9d1d235489bd2494bc3b53f63bda5fb7a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9495915 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
The new stress flag landed in V8 in crrev.com/c/8035161. Bug: 474302353 Change-Id: Iea61431726cf7d51d13ecd136c02b810c7701c4a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9496095 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Omer Katz <omerkatz@google.com>
Enables generation of non-identical subtypes of signatures. Specifically, we search for - an existing subtype (for covariant outputs); - an existing supertype (for contravariant parameters); and use them in the subtype of the signature. Bug: 517707090 Change-Id: I42c90cebf34719ae5a531db23d061b2c76f81455 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9485235 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Bug: 524562043 Change-Id: Idea3856321cdcfa50c15e38c01b4a0743d418bd6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9500780 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 526972176 Change-Id: I694374c246115afd25552b8fcaaa5d8957420544 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9497376 Reviewed-by: Clemens Backes <clemensb@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 475707969 Change-Id: I7873e0d8e2702314c50ee22e7e80d25e2162e4d2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9501735 Reviewed-by: Maksim Ivanov <emaxx@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Clemens Backes <clemensb@google.com>
https://crrev.com/i/9471895 fixed a bug that lead to the discovery of the present issue. The following error spiked in the logs after that CL landed: `HybridEngineFixupMutator] Failed to process action: Missing input 2 for operation SetProperty` The problem is that FixupMutator only passes 2 inputs to `setProperty`, but 3 are required. Before https://crrev.com/i/9471895 landed, this problem was masked because `translateInput(2)`, called from RuntimeAssistedMutator, was equivalent to `translateInput(0)`. ``` case .SetProperty: let o = try translateInput(0) let v = try translateInput(2) ``` This CL adds the missing input. Bug: 527887612 Change-Id: If6719836c37a80eb3eeabb54e76f3e2a77740ca3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9498035 Reviewed-by: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
When generating a subtype for an index type that contains an abstract reference type in a field/element, use `randomWasmReferenceType()` to generate a compatible "subtype" of that field/element, which can be either an abstract or an index type. Bug: 517707090 Change-Id: Ic81f8361b6e489b2839613dea34f1eb730550c49 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9487556 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
The current extra checking of program inconsistencies is running into the known bug https://crbug.com/508306801. Since this particular inconsistency can not lead to the symptoms we saw in the exploration mutator, we skip the variable visibility check for now, but only in the extra checking we added for debugging. Bug: 524213342, 508306801 Change-Id: I0925b19b4d460e3660e2027cfa2317f5467eb231 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9508495 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
The `OP_CONSTRUCT_METHOD` handler accepts two parameters, `v` and `inputs`, though only `inputs` is used. The rest of the code assumes that `inputs` is the first argument of every handler, as noted in the comment preceding the `ACTION_HANDLERS` object and as seen in the handler's invocation: ``` context.output = handler(concreteInputs, context.currentThis); ``` Consequently, `context.currentThis` is passed in lieu of the inputs, and there are no valid `OP_CONSTRUCT_METHOD` calls. Bug: 531684877, 529687716 Change-Id: Ib53f102085388611f482e3eadebcf7b266d78b3c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9507098 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL enables randomWasmBlockOutputTypes() to also generate index types. Change-Id: I8ee24c2c0525a3ef2feb3dddcd8e16852b4a7472 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9508895 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Lifting must be deterministic, so in object literals, we must have the properties always in the same order. Before this CL, that was guaranteed by sorting them. This CL removes the sorting and instead uses data structures which are already ordered. This is more robust and also allows us to generate code which was not possible before. (E.g., an options bag where the keys appear in an unexpected order is an interesting case to test.) TAG=agy CONV=35c7cc7f-a078-4761-860a-7fb97352d47c Fixed: 522153837 Change-Id: I81249cd2d719ce3281775e354d654ab39fd15f6f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9470855 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
This CL adds support for compiling JavaScript function parameter destructuring (objects and arrays) into FuzzIL, and lifting it back to JS.
Computed Keys and Inner Default Values ain't supported.
Bug: 515363087
Change-Id: I6157c3e634c91bcc6bedefeaf7b0861be1fe64b2
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9464375
Reviewed-by: Michael Achenbach <machenbach@google.com>
Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 524562043 Change-Id: I841e66284496f96c21bc03a426675a55880dadae Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9487835 Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
This CL adds support for generating start functions in Wasm modules. The start function is chosen at random. To make tests pass deterministically, buildWasmModule() now has a `possiblyWithStartFunction` boolean parameter, which is `false` in tests. Bug: 521299807 Change-Id: I00979a94424aa48804bc066a83c8a5ad18a05ee7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9520875 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Bug: 522635668 Change-Id: I7b6153376739d6db4a182594c62514da331977d8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9501815 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
The input mutator attempts to replace an input of an instruction with an alternative. However, the replacement can be `nil` due to strict wasm type requirements (`type.Is` can return `nil`). In this case, the instruction is never appended and hence missing in the adopted program. Because `adopt` was already called on the instruction inputs and output, its output variable is already counted in the new program but never created, leading to a variable gap. This adds the missing append logic and demonstrates the problem with a test case. Bug: 524213342 Change-Id: I56abd2b8041c2b85c85cb3c9aaa2fb4c7669f90c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9538095 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
Bug: None Change-Id: Ic9eb13867b290d250e1b90385950b61f31a3b1fe Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9537896 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 533244087 Change-Id: I61e2462e1005b86ccdb7cf5d3c24f4402c62ca8d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9547656 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
Change-Id: Ifce5d55461dc24eaf5e377ece714c769b8603994 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9553895 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Bug: 524562043 Change-Id: I4e4d5e22f55a5ce67b3f520346b981d685404acf Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9537895 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
In the last WebAssembly GC meeting, we decide to use bit 4 instead of bit 5 in relaxed atomics proposal. We are removing its flag while implementations are getting updated. Bug:535260641 Change-Id: I0b6ecaeab0e963515271dee2a1d9e699f524e0cd Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9553034 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
The existing LazyDeoptFuzzer program template depends on recursion, eager deopting the current function, and hoping the call stack also contains another instances of the current function in an interesting way (not only as trivial recursion). This might be tricky to get right, since the recursion might interfere with the interesting usage. The IndirectLazyDeoptFuzzer program template takes a different approach: we add a trigger function f1 for lazy-deopting another function f2, and then hope that f2 uses f1 in an interesting way (e.g., passes it to a builtin as a callback). Fixed: 535009509 Change-Id: I3faf0fe2fe3b408f82792276726df4e279404271 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9559275 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL adds support for globals with index types. Bug: 533316073 Change-Id: I417c6eee3034590100a1c833c27038b5b866655b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9529335 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
13 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
updating with head