base fuzzili update - #52
Open
Dudcom wants to merge 565 commits into
Open
Conversation
Author
|
we are in hell |
- Add support for i31ref in JavaScriptLifter for CreateWasmTable. - Update WasmDefineTableGenerator to randomly use funcref, externref, and i31ref. - Add missing WasmTableGenerator to generate JS-side WebAssembly.Table objects. Bug: 430171132 Change-Id: I4a435276d6e7a2d602738ae0b1b3f4c45788e0a7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9333760 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
Bug: 430171132 Change-Id: I4697952c9cef237c2cb9339343d6fec127d2c347 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9333860 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
The test is executed only when generating bundles, since it requires passing --bundles to d8 to run. TAG=agy CONV=5588ce4d-a98f-415f-b04b-5c6a9c3508b7 Change-Id: I7eb330ea3ce547f96fc55892c961a49515721546 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9336701 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Change-Id: Id0b6a94c906b48cbe6a194e77e47016868dd0e8a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9340380 Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Marja Hölttä <marja@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
These should now be in sync with what v8 supports. (V8 does not allow null types like noexternref and also disallows exnref.) The spec as written is much more restrictive. Until WebAssembly/spec#1980 gets resolved, we'll simply test what V8 supports and ignore these discrepancy issues for fuzzing. Bug: 430171132 Change-Id: Id1462e3b978305539e5adeda7beb86fa6719feba Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9336702 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 515363087 Change-Id: I8b5f3189ad34b3a6e117e3cf066e6afe62c20aba Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9336920 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL registers Iterator.prototype.includes for fuzzing, which was added to V8 with https://crrev.com/c/7867647. Bug: 504886973 Change-Id: I27af5809e4ab47eff7cb4db545f06940762db3c3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9334922 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Nikos Papaspyrou <nikolaos@google.com>
Bug: 474940922 Change-Id: I20f142ba41d3efa88872ae0dfa308170a8c0ff11 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956716 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
Change-Id: I6a7de94f7a30f30ab30ed17f1760fddaaa7b9758 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9347700 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
This CL adds support for the call_ref instruction. Bug: 474940922 Change-Id: If708e70dc9fcdd2f53f218f85e93c3d807a5ab9a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9330021 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This reverts unreviewed changes that were accidentally added to commit 8fbbfdc. Original change's description: > [wasm] Implement ref.as_non_null > > Bug: 474940922 > Change-Id: I20f142ba41d3efa88872ae0dfa308170a8c0ff11 > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956716 > Commit-Queue: Matthias Liedtke <mliedtke@google.com> > Auto-Submit: Matthias Liedtke <mliedtke@google.com> > Reviewed-by: Leon Bettscheider <bettscheider@google.com> Bug: 474940922 Change-Id: I5a8d7cc465384c304908502d0447cc3b6c9be6ef Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9347522 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
This CL adds support for the return_call_ref instruction. Bug: 474940922 Change-Id: I8b53203020238fc24c002cbe27f8f60c7fa7fee7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9317782 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Though `ref func` only if there is a visible Wasm function definition. Change-Id: I931a8ab63994f415f0a333fdde5fccee95d4037d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9347701 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
Bug: 515363087 Change-Id: I6fd7618baa5c357d2ab21fe0610f2d53ce4effd1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9345643 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Change-Id: I73725256a59e3d2bd9fe00cb302bc40e2e8a219b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9359700 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Olivier Flückiger <olivf@google.com> Commit-Queue: Olivier Flückiger <olivf@google.com>
Bug: 515363087 Change-Id: I56b113d9ff73c86e3f8458e31ae72499da8901e6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9362882 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 515363087 Change-Id: I3653827b5d1467c95c607306bb42cfa97d8cb0a9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9366042 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Fuzzilli does not have robust support for a function that can have two different types for a parameter. Overloads are not supported for builtins / constructors, and union types may be too much of an over-approximation. This change introduces an `.either` parameter that is resolved to just one of its types. Fixed: 515122865 Change-Id: I73d900b183386507ad7cc4a1551b0c4dd5770bf3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9351247 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 398218423 Change-Id: I0fe7cd10030e18c3014e4c8220830631d1b92cce Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9355960 Auto-Submit: Olivier Flückiger <olivf@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Filtering a `WeightedList` and then calling `randomElement` on the
result is a common pattern in Fuzzilli:
```
generator = fuzzer.codeGenerators.filter({
$0.requiredContext.isSubset(of: context)
}).randomElement()
```
In a few cases, the resulting variable (i.e. `generator`) is typed as an
optional. Consequently, the Swift compiler selects that it is more
appropriate to call `Sequence.filter`, returning an array object instead
of a `WeightedList`, and then call `Array.randomElement`, as that method
return an optional. As a result, the weighting of the `WeightedList`
elements is lost.
To resolve this, this CL updates the `WeightedList.randomElement`
overload to return an optional type as well.
Minimal example: https://godbolt.org/z/6vGWzq9PY
Fixed: 521398642
Change-Id: I9a2681c7795036f5953accde518e550f021d8fac
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9371100
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Declarations Bug: 515363087 Change-Id: Ia5de523536d0be873ea6dfa58260f80b8402536a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9371140 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Allow top level await in modules by adding .async to beginBundleModule. Drive-By: Rename .asyncFunction to .async Fixed: 521338444 Change-Id: I3c8bac11b6f41bf2565596b8c3ef2f79161e198f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9362884 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Olivier Flückiger <olivf@google.com> Auto-Submit: Olivier Flückiger <olivf@google.com>
exposed group interface. Bug: 515363087 Change-Id: Id50b6d4ec3308a5b039b82670ec2f4c5db288330 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9375340 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
It will run Tools/presubmit.py which already existed (but had to be manually run). Change-Id: I89fff893e441144dfe50663e23b613ce9e58d625 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9231116 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
…and cannot generate more This can happen when we have enough non-JS variables (eg modules and labels) but not enough JS variables. There was already a safeguard to generate more code in this case, but if we're not in .javaScript context, that won't work. This CL just makes the mutator bail out instead. Fixed: 521241274 Change-Id: Id39090b27e8bc8c3948b17d1765b6292a418fb9a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9374180 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Raphaël Hérouart <rherouart@google.com>
Bug:498924945 TAG=agy Change-Id: I9e7cf4eabb5af5df23aa49d8ffcf86fc58416c5b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9268503 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL * adds `concreteHeapSupertype` to WasmTypeDescription, * implements `subsumes()`, `intersection()`, and `union()` based on that, and * uses them in WasmTypeDefinition and WasmReferenceType. Bug: 517707090 Change-Id: I59c36b73cc30e5269302404d1bd2f508d0cb22d2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9351448 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This fixes bugs for named variables, with-statements and private properties, where generic property names slipped into the generation of these more restrictive identifiers. Named variables and properties in with-statements can only be proper JS identifiers, while generic property names are broader. The same holds for valid names that can be used for private properties. This creates a separate custom identifier list that doesn't include unorthodox cases like symbols and numbers. Named variables, with-statements and private properties are now solely generated from this separate list. TAG=agy Fixed: 518435525 Change-Id: Ie3566467e7f729661a04eba47debc18bc53d610f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9375380 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Michael Achenbach <machenbach@google.com>
…iables InliningReducer could crash when encountering disposable variables (or other instructions that fallthrough to the same check) at the top-level of a module (e.g. inside a bundle module entry point) where activeSubroutineDefinitions is empty. This fix safely unwraps activeSubroutineDefinitions.last to avoid force-unwrapping nil. TAG=agy CONV=3d0eb06a-4c48-4640-92dc-a149665be30b Change-Id: I55bdc95e0d622fc94dd6709338e3fca6dad6192b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9378962 Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Olivier Flückiger <olivf@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Olivier Flückiger <olivf@google.com>
- Decouple `isGuarded` (try-catch) and `isOptional` (optional chaining `?.`) across operations in `operations.proto`, `JsOperations.swift`, and `ProgramBuilder.swift` - Add `isOptional` to operations that support optional chaining in JavaScript syntax - Add `isGuarded` to `UpdateProperty` and `UpdatePrivateProperty` to allow them to be wrapped in try-catch - Update FuzzIL `JavaScriptLifter.swift` to rely on `isOptional` for `?.` and decouple it from `haveSpecialHandlingForGuardedOp` - Regenerate Protobuf swift bindings - Update `LifterTest.swift` expectations and builder syntax to correctly test combinations of `isOptional` and `isGuarded` Bug: 537236612 Change-Id: I6374de16ad742566a1cdd243ada1b5ac44ae13a1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9729375 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 476974566 Change-Id: I21cfcffec9b6ed20cf38bb224d44df5638d2d754 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9748516 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Change-Id: Idaa2f824303a4a6c6062affcbb3d68a345fd2605 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9672936 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
This is too slow to be convenient, the CI is already reasonably slow for testing both d8 + Node.js + presubmit-checks on Linux debug. Bug: 498924945 Change-Id: I9ea5e9797d7dcb391d83965304c523fee2099793 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9752235 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
The previous fix (crrev.com/i/9605075) only handles the following case: - module 1 exports a global - module 2 uses this global - the minimizer removes the global from module 1 (because it’s unused in module 1, and we don’t track cross-module data flow), and now module 1 exports none/too few globals, leading to a crash in module 2: `Fatal error: Attempted to read an unowned reference but object 0x74e8138d5120 was already destroyed` However, another crash that recently showed up: `Could not cast value of type 'Fuzzilli.WasmArrayTypeDescription' (0x5c01ddd42478) to 'Fuzzilli.WasmSignatureTypeDescription' (0x5c01ddd42388).` This crash can occur if: - module 1 exports two globals of different types (e.g., signature and array) - module 2 uses the `signature` global - the minimizer removes the `signature` global from module 1 - module 1 now loads the `array` global from “wg0” instead and tries to use it as a signature (- similar crashes can occur, e.g., if module 1 exports two structs with a different count of fields, and the one with fewer fields is minimized but module 2 tries to access a field index not present in the remaining one) This CL addresses this as follows: - We add defensive code in JSTyper. For example, for `wasmStructGet()`, we check that the input really is a reference to a struct type that has a sufficient amount of fields. Otherwise, we type its output to `.error`. Bug: 533316073 Change-Id: Ib0c57fc875f9ad80a3d3f0aee1ef73c57bf8fb8d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9695815 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
V8-side-change: https://crrev.com/c/8268300 Fixed: 547292289 Change-Id: I69d471dce10207667d34b7dd8cebd3612c818ba1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9703955 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Bug: 547936520 Change-Id: I2485c48f0984d6ee7d99cd7b2623cb37180a6f33 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9760515 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
Similar to best-practices in V8, agents, skills and rules defined in the repo should be opt-in (e.g. by linking them from .agents/). At least the Google-internal Antigravity-variant automatically loads from the _agents directory (besides .agents) as well. Change-Id: Ica956d6198e0df9fabb7906896fafdb7637947c1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9750755 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 502246833 Change-Id: If3d588494155327a8902a0cfac71f40112abeec4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9678195 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
- BinaryOperator::NULL_COALESCE - NamedVariableDeclarationMode::CONST Change-Id: I55b7fbd60bb3d02780a84ee6f894840a7cd0cfe4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9767255 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
OperationMutator.mutateOperation implemented mutations for these operations, but they never kicked in since the isMutable attribute was not set. Drive-by: fix the importVariables handling in mutateOperation; we cannot add outputs trivially, so let's not add outputs. Bug: 555668474 Change-Id: I478fecfd4745e92bf39b98f104904ca59a72565d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9760875 Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Change-Id: I2fc9e002323bd776e34285071d4a4b04e37fa1cc Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9768355 Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 556210739 Bug: 555668474 Change-Id: I2e8e08b2d7a8ccf3e73019a10c797267b14b32d9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9772815 Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
WebAssembly/binaryen#9068 updated the Binaryen fuzzer to stop producing descriptors with mismatched finality. Pull that change into Fuzzilli ahead of requiring matching finality in V8 to avoid breakage. Bug: 403372470 Change-Id: I62a79f4d58a93ff40f95f8c6124b818db729fb8b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9768257 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
so the mutation isn't a noop half the time. Change-Id: I2acd76e8da2286b2c198900e30a9b11710a15c50 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9773596 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Declare remaining concrete leaf Operation classes in JsOperations and WasmOperations as final. Bug: 556210739 Change-Id: Ic070d762146eaad8c4050186cac533715ff13367 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9772578 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Follow-up to crrev.com/i/9729375 clearing out two TODOs: - Decouple receiver optionality (e.g. `obj?.method()`) from method/function invocation optionality (e.g. `obj.method?.()`) via separate `isReceiverOptional` and `isCallOptional` flags across Protobuf, AST parser, compiler, lifters, mutators, and simplifiers. - Make `CallSuperMethod` guardable (`isGuarded`). Bug: 537236612 Change-Id: Ie9b88c519e7b88d8c5cf7428a79ebc1de177ea4c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9748515 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
…te operations Follow-up to crrev.com/i/9729375 Bug: 537236612 Change-Id: I719d63ff8dbba821399c048246008169c0077f31 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9760135 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Similar to JavaScriptLifter.swift or Instruction.swift, this switch statement has no condition, it is supposed to handle every opcode. Swift by default requires all switch statements to be exhaustive, offering compile time safety rather than a runtime error. Bug: 556210739 Change-Id: I6e748990d62fc6eef1e72841cfe9966af219294e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9775275 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
…lity Tests started failing after crrev.com/c/8341512 landed. This CL ensures that finality matches between descriptor and described type. Bug: 502246833 Change-Id: I6be9de171a54dfb855af4170e747a86cc0b3682b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9779795 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 502246833 Change-Id: I6c270792ad9d813c3f7c71b313dbf6cba102ef56 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9708575 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
The `JavaScriptEnvironment.type(ofGroup groupName: String)` method looks up a type in the `groups` dictionary. This dictionary maps group names to `ObjectGroup`s registered in the environment. Enumerations have group names, but they are not associated with an `ObjectGroup`. As a result, the `type` method is fails to return a type of the given group if that type is an enumeration. Array and map operations that used this `type` function to look up an element type were failing for enum elements. This CL adds an overload of the method that searches within both the environment's `ObjectGroup`s and enumerations to find a type with the specified group. Bug: 503429420 Change-Id: Iea5c88fa31f1719beb31890f3f5cefdac19ba60d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9772957 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Tigran Bantikyan <bantikyan@google.com>
Change-Id: Ie775384b6cd9a2edf118998f1607267f457d19b1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9788035 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
bug: None Change-Id: Ide1650d780cfd706f2ebc27488af08af43edfb1f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9788036 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
- Include missing propertyName in UpdateProperty, guarded flag in Update* operations, and methodName in BindMethod. - Bracket customName across LoadInteger and LoadString. - Include group annotations for CreateArray and CreateMap. - Include metadata for Explore, Probe, and Fixup. - Lift outputs for Nop and WasmNop instructions. - Improve Wasm lifting: - signedness in WasmStructGet - isShared in WasmRefI31 - byte counts in WasmDefineDataSegment - element inputs in WasmDefineElementSegment. TAG=agy Change-Id: Ia377b8ccab42502a40f4b78a3e9e31f9037302aa Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9776555 Reviewed-by: Raphaël Hérouart <rherouart@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 502246833 Change-Id: Ib123557cf6affa096a82c142974b1e6f2b8ee3a9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9707156 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Emit special objects using d8.test helper functions: - createInterceptorObject - createAccessCheckedObject - createSpecialObject TAG=agy Change-Id: I535ac75355ce908e90bf9761c6a407f5984365a9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9792816 Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 502246833 Change-Id: I073029652f3f8150067ca74c4d8689ab6cac2881 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9719395 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 482365585 Change-Id: Ibea7ae71a182d52786ddbb0a29af71d6a55b2d62 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9797316 Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Auto-Submit: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
Change-Id: If1d9dc20020bcbea05e8dedf0777e3be4fd56d96 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9793236 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
13 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
updating with head