base fuzzili update - #52
Open
Dudcom wants to merge 545 commits into
Open
Conversation
Author
|
we are in hell |
Bug: 514576448 Change-Id: I4f0236055f21611a582fef526a721e13f58ca2f9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9310040 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Auto-Submit: Raphaël Hérouart <rherouart@google.com>
Bug: 445356784 Change-Id: I3a07fe4d292dd5b988c655936e0abd889338cbe8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9310720 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This CL adds the `selectionMode` property to the `OptionsBag` struct to configure how `OptionsBag` selects the properties for the object literal it generates. The default behavior is preserved with the `anySubset` case. The new `exactlyOne` case configures `OptionsBag` to select exactly one property for the object literal. This CL also makes `OptionsBag` easily usable in profiles by adding an `additionalOptionsBag` property to the `Profile` struct and by removing the strict assert on the supported `OptionsBag` properties array. Bug: 512875834 Change-Id: I6b6348f515cc736ee281af9c9e384ac93eaf762c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9311541 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 514576448 Change-Id: I7d2b1580b49211e1ec184f78798588eb7b4ea6ca Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9313600 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 514906333 Change-Id: Ib94a058c73bab07f1b9292e102439af847593006 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9310083 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
…tions TAG=agy CONV=0a8bad59-c896-4fbd-925a-620838620623 Change-Id: I82d1eafe22df70aa455b98d0de8795820398a08c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9320640 Reviewed-by: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
BUG=515494290 TAG=agy CONV=3987abe0-de45-4002-95ae-4f62b5e0cf10 Change-Id: I0324d4ef618f2bae310eb392ddff5aa3b71b9c0d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9320641 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
Bug: 515363087 Change-Id: I06060612d8eee9bf783a849352435c5b4bf9c893 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9317280 Auto-Submit: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
1) Hide variables outside the worker function so that the function doesn't use them. 2) Make the main thread wait for the worker to finish. Fixed: 497549860 Change-Id: If3b22fae7e61cca33b1c55fbfab3fcf9f5f6abaf Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9282445 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
Previously, randomWasmTypeDef() would only return type definitions of non-ad-hoc signatures. With this fix, it should also return array and struct type definitions. Bug: 445356784 Change-Id: I6b131c42e61c17771fa211c213d64456b964bdb5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9320520 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
This CL adds support for the br_on_cast instruction. Bug: 474940922 Change-Id: Iadb552b42b1c721d0b5c462afda75aff91bb4791 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9300280 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Support for "import * as ns" import syntax, including the deferred import variant. Other imports (named, default, etc.) are future work. https://github.com/tc39/proposal-defer-import-eval Bug: 398218423 Change-Id: If0e691054f0668cd4eed2bbdc9532b0c520fec4a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9313400 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Olivier Flückiger <olivf@google.com>
This CL adds support for the br_on_cast_fail instruction. Bug: 474940922 Change-Id: Icacbd109fff843179f69806769437322f14326c8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9299601 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 515363087 Change-Id: I41e4b487ee08dbf7da22959c6c1d08e4099a6ad4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9317282 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Auto-Submit: Raphaël Hérouart <rherouart@google.com>
This was staged for V8 in https://crrev.com/c/7845195. Bug: 465715798 Change-Id: I1b01eea17c3c1049d66251de6a025747aef43bb7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9333500 Reviewed-by: Olivier Flückiger <olivf@google.com> Commit-Queue: Olivier Flückiger <olivf@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Node.js v26 branched, the new nightly version is v27. we need to stay up-to-date to be able to test new V8 features. Change-Id: I4eea87f24cfff0e2cb48cb21904d6c0c5bb97421 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9317781 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
This CL adapts WasmReturnCallDirectGenerator and WasmReturnCallIndirectGenerator to use `subsumes()` instead of equality to find functions with compatible output types. Bug: 445356784 Change-Id: I7c3113c54b7752809320e9d58fbbb11eaca10d4f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9318221 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL adds support for the ref.func instruction. Bug: 474940922 Change-Id: I885b966598a9d72c161d2ef7bee910032576a53d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9296864 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
The table type can be easily inferred by the input table, so the table.get doesn't need a type immediate. For fuzzilli however, the input table can also come from JS (created by CreateWasmTable). Later on, the fuzzer can replace that table input with an arbitrary other input. This means that we need to encode the element type in the table.get operation, so that the JSTyper always knows the correct result type. I removed this in commit 7e5724c (among other things that are indeed unnecessary). Bug: 430171132 Change-Id: Icffc95fadb79979d7125a33d797868c5a6ad50e5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9337021 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
This allows fuzzilli to use the same handler object in different proxy objects. Helps testing upcoming proxy ICs. Bug: 516717223 Change-Id: Ia5c47196a9233e3696b81d0b31c63a728c57fa50 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9336380 Commit-Queue: Olivier Flückiger <olivf@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Olivier Flückiger <olivf@google.com>
- Add support for i31ref in JavaScriptLifter for CreateWasmTable. - Update WasmDefineTableGenerator to randomly use funcref, externref, and i31ref. - Add missing WasmTableGenerator to generate JS-side WebAssembly.Table objects. Bug: 430171132 Change-Id: I4a435276d6e7a2d602738ae0b1b3f4c45788e0a7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9333760 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
Bug: 430171132 Change-Id: I4697952c9cef237c2cb9339343d6fec127d2c347 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9333860 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
The test is executed only when generating bundles, since it requires passing --bundles to d8 to run. TAG=agy CONV=5588ce4d-a98f-415f-b04b-5c6a9c3508b7 Change-Id: I7eb330ea3ce547f96fc55892c961a49515721546 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9336701 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Change-Id: Id0b6a94c906b48cbe6a194e77e47016868dd0e8a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9340380 Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Marja Hölttä <marja@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
These should now be in sync with what v8 supports. (V8 does not allow null types like noexternref and also disallows exnref.) The spec as written is much more restrictive. Until WebAssembly/spec#1980 gets resolved, we'll simply test what V8 supports and ignore these discrepancy issues for fuzzing. Bug: 430171132 Change-Id: Id1462e3b978305539e5adeda7beb86fa6719feba Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9336702 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 515363087 Change-Id: I8b5f3189ad34b3a6e117e3cf066e6afe62c20aba Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9336920 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL registers Iterator.prototype.includes for fuzzing, which was added to V8 with https://crrev.com/c/7867647. Bug: 504886973 Change-Id: I27af5809e4ab47eff7cb4db545f06940762db3c3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9334922 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Nikos Papaspyrou <nikolaos@google.com>
Bug: 474940922 Change-Id: I20f142ba41d3efa88872ae0dfa308170a8c0ff11 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956716 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
Change-Id: I6a7de94f7a30f30ab30ed17f1760fddaaa7b9758 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9347700 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
In JSTyper, async class and object literal methods previously defaulted to returning .jsPromise() (resolvingTo: .jsAnything). This change aligns async methods with standalone async functions by inferring the promise resolving type from the method's return value: `.jsPromise(resolvingTo: resultType.returnType.promiseResolvingTo)`. TAG=agy Change-Id: I9ab1e4dace9a9d04d7dc6c7fb915a3a18b2558a2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9676859 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
1. Fix String.prototype.trim return type to .jsString.
2. Register missing OptionsBag.jsTemporalDurationCompareSettings in
init().
3. Fix Object.entries return type to .jsArray.
4. Fix Intl.Locale numeric property to .boolean, and getTextInfo return
type to .object(withProperties: ["direction"]).
5. Update constructor callabilities: Function to .functionAndConstructor
and Temporal / Intl constructors to .constructor.
6. Make parameter optionality conform to spec for Object.create,
Array.prototype.sort, Array.prototype.join, and Date.prototype.set*.
7. Synchronize globalThis property registration with
globalThisGroup.instanceType in finalizeGlobalThisGroup().
8. Fix duplicate enum assertion message in registerObjectGroup().
9. Make TypedArray.prototype.join and TypedArray.prototype.sort
parameter optionality conform to spec.
10. Update Date.prototype.setHours and Date.prototype.setUTCHours to
support optional 4th milliseconds argument.
TAG=agy
Change-Id: I4b787be0ae8a82c71290452d9ac3466b87b03635
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9677317
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
and mark one more "join" method's separator parameter as optional. Change-Id: I253e9d0f50fc7f63b27a2d57c885c12acedd51a2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9682955 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This reverts commit 60a81c6. Reason for revert: experiment finished Original change's description: > [v8] Introduce unsafe flag for binaryen integration evaluation > > Fuzzilli itself doesn't generate ref.cast_desc_eq instructions, so > this can only be found by the Binaryen integration. > > Corresponding V8 change: https://crrev.com/c/8236732 > > Bug: 498924945 > Change-Id: Ibb9b6e66efacc283ef68288024acedfbeb909a01 > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9666335 > Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> > Commit-Queue: Matthias Liedtke <mliedtke@google.com> > Auto-Submit: Matthias Liedtke <mliedtke@google.com> Bug: 498924945, 546884393 Bug: 498924945 Change-Id: Ic89faeef0e298c5ee9daa9598c723ae774b7aa22 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9686395 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com>
…e mutation Before this change, private property generators had ~0.19% invocation success rate because referencing an undeclared private field (#foo) inside a class is a SyntaxError that cannot be caught by runtime try-catch blocks. Hence, rather than emitting invalid code, the Generators were returning without generating any instruction. 1. Extended ILType.object(...) to track privateProperties and privateMethods 2. When private member generators run inside a class method before properties are declared, referenced names are recorded and automatically emitted at EndClassDefinition(). This eliminates syntax errors and raises private generator success rates to 100.00%. 3. Updated OperationMutator selecting valid private members from scope for mutations. Bug: 534650967 Bug: 522217077 Change-Id: I6c1ce14c58559c959866ecafab050435f76f44c8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9614016 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
- Temporal.Instant.from and Temporal.Duration.from do not accept an options bag. Update temporalFromSignature to emit 1-parameter signatures when settingsArg is nil. - Explicitly pass settingsArg: jsTemporalOverflowSettings for PlainTime, PlainYearMonth, PlainMonthDay, and PlainDate from() overloads. Change-Id: I4dfbf7cddf10c99d35abc436dc8d4e3203f5d9df Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9678376 Reviewed-by: Manish Goregaokar <manishearth@google.com> Commit-Queue: Manish Goregaokar <manishearth@google.com>
Bug: 529283573 Change-Id: I894b4391d2465421b44e3a0d277c5e4015a2b84e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9694915 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 498924945 Change-Id: I5da4f0dfc050d389bdc5168bc45d67f3d530b262 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9699455 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com>
Currently, only --wasm-features=custom-descriptors is supported. This will allow to enable custom descriptors related code, including lifting "exactness", selectively. Bug: 502246833 Change-Id: I4272a7e06555303ccd134c74c6121ee236ab19f6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9680135 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL makes the output of the existing instructions wasmArrayNewFixed wasmArrayNewDefault wasmStructNew wasmStructNewDefault wasmRefFunc wasmRefNull exact, depending on the “enableCustomDescriptors” config. It also adds support for lifting the “exact” property to Wasm Code, adjusts subtyping for exact types, and supports exact index-typed globals. Bug: 502246833 Change-Id: I7098977f0b16d6372e5d3106d7c711ea8a1fa410 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9665935 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
However, they won't get generated by the fuzzer yet because `WasmCustomDescriptorsStructTypesGenerator` is not enabled until all instructions and generators are implemented and adapted. Bug: 502246833 Change-Id: Iee0d7d179a9fbf6d6ac0484eb0fc3dbba5df892c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9670676 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
This CL makes the `indexTypes` parameter of `wasmDefineStructType()` default to []. This cleans up the code a bit. Change-Id: I492c2802041afeb4432293c5a4a27e84db51bc6a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9673597 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Bug: 515363087 Change-Id: I044310fb22e58953207c45e1b160e2719e639f4e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9691916 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
…er operations is not redundant Bug: 552300848 Change-Id: Ic384c15945970e6b835f20be8864c3600e54e5b8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9723615 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
Bug: 552300848 Change-Id: I90609f3fad2a9b0a7e55c838af13b55c0d5567fb Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9723675 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
…tionAndCompilation testBinaryenWasmCodeGenerationAndCompilation is flaky and blocking unrelated CLs Bug: 553335553 Change-Id: Ic31f5be496726f9ae03d6d5b8873c052844700d0 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9733395 Reviewed-by: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
For running shorter experiments that measure any statistics, it is useful to start worker threads with a deterministic delay as it otherwise creates too much variance in measurements. It is still useful to start workers later for the commented reasons, but now they can be started in an experiment setup with e.g. a delay of 120 seconds each. This is particularly useful when running experiments with a low `--corpusGenerationIterations` parameter. Bug: 476974566 Change-Id: If90d92c7b1d777281408561a9828f14357cc023b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9739195 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Add `ILType.namedInteger(ofName:)` and `namedInteger` generator support, mirroring the existing `namedString` design. This feature is introduced with various `namedInteger`s for generating bounded integer types (e.g., uint8, int16, uint32). Bug: 553587894 Change-Id: I87b835d3148449539451983bebea038c88530135 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9734538 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Tigran Bantikyan <bantikyan@google.com>
TAG=agy Bug: 498924945, 535260641 Change-Id: I73479be7306782db26ae19e8353fda18cf876ba7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9729009 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com>
…deGenerationAndCompilation" This reverts commit e154660. Reason for revert: Fixed the Binaryen versioning Fix Link: https://chrome-internal-review.git.corp.google.com/c/v8/fuzzilli/+/9729009 Original change's description: > [test] Increase failure rate tolerance for testBinaryenWasmCodeGenerationAndCompilation > > testBinaryenWasmCodeGenerationAndCompilation is flaky and blocking > unrelated CLs > > Bug: 553335553 > Change-Id: Ic31f5be496726f9ae03d6d5b8873c052844700d0 > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9733395 > Reviewed-by: Michael Achenbach <machenbach@google.com> > Reviewed-by: Matthias Liedtke <mliedtke@google.com> > Commit-Queue: Raphaël Hérouart <rherouart@google.com> Bug: 553335553 Change-Id: If4018be5108a742944b1e9698a8cd34a7eda2ed0 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9738219 Auto-Submit: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com>
- Decouple `isGuarded` (try-catch) and `isOptional` (optional chaining `?.`) across operations in `operations.proto`, `JsOperations.swift`, and `ProgramBuilder.swift` - Add `isOptional` to operations that support optional chaining in JavaScript syntax - Add `isGuarded` to `UpdateProperty` and `UpdatePrivateProperty` to allow them to be wrapped in try-catch - Update FuzzIL `JavaScriptLifter.swift` to rely on `isOptional` for `?.` and decouple it from `haveSpecialHandlingForGuardedOp` - Regenerate Protobuf swift bindings - Update `LifterTest.swift` expectations and builder syntax to correctly test combinations of `isOptional` and `isGuarded` Bug: 537236612 Change-Id: I6374de16ad742566a1cdd243ada1b5ac44ae13a1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9729375 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 476974566 Change-Id: I21cfcffec9b6ed20cf38bb224d44df5638d2d754 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9748516 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Change-Id: Idaa2f824303a4a6c6062affcbb3d68a345fd2605 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9672936 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
This is too slow to be convenient, the CI is already reasonably slow for testing both d8 + Node.js + presubmit-checks on Linux debug. Bug: 498924945 Change-Id: I9ea5e9797d7dcb391d83965304c523fee2099793 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9752235 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
The previous fix (crrev.com/i/9605075) only handles the following case: - module 1 exports a global - module 2 uses this global - the minimizer removes the global from module 1 (because it’s unused in module 1, and we don’t track cross-module data flow), and now module 1 exports none/too few globals, leading to a crash in module 2: `Fatal error: Attempted to read an unowned reference but object 0x74e8138d5120 was already destroyed` However, another crash that recently showed up: `Could not cast value of type 'Fuzzilli.WasmArrayTypeDescription' (0x5c01ddd42478) to 'Fuzzilli.WasmSignatureTypeDescription' (0x5c01ddd42388).` This crash can occur if: - module 1 exports two globals of different types (e.g., signature and array) - module 2 uses the `signature` global - the minimizer removes the `signature` global from module 1 - module 1 now loads the `array` global from “wg0” instead and tries to use it as a signature (- similar crashes can occur, e.g., if module 1 exports two structs with a different count of fields, and the one with fewer fields is minimized but module 2 tries to access a field index not present in the remaining one) This CL addresses this as follows: - We add defensive code in JSTyper. For example, for `wasmStructGet()`, we check that the input really is a reference to a struct type that has a sufficient amount of fields. Otherwise, we type its output to `.error`. Bug: 533316073 Change-Id: Ib0c57fc875f9ad80a3d3f0aee1ef73c57bf8fb8d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9695815 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
V8-side-change: https://crrev.com/c/8268300 Fixed: 547292289 Change-Id: I69d471dce10207667d34b7dd8cebd3612c818ba1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9703955 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Bug: 547936520 Change-Id: I2485c48f0984d6ee7d99cd7b2623cb37180a6f33 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9760515 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
Similar to best-practices in V8, agents, skills and rules defined in the repo should be opt-in (e.g. by linking them from .agents/). At least the Google-internal Antigravity-variant automatically loads from the _agents directory (besides .agents) as well. Change-Id: Ica956d6198e0df9fabb7906896fafdb7637947c1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9750755 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 502246833 Change-Id: If3d588494155327a8902a0cfac71f40112abeec4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9678195 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
- BinaryOperator::NULL_COALESCE - NamedVariableDeclarationMode::CONST Change-Id: I55b7fbd60bb3d02780a84ee6f894840a7cd0cfe4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9767255 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
updating with head