base fuzzili update

.github/workflows/swift.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   build_test:
-    timeout-minutes: 30
+    timeout-minutes: 40
     strategy:
       # If macos-latest fails, we still don't want to cancel ubuntu-latest or the other way around.
       fail-fast: false
@@ -23,26 +23,72 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - name: Install jsvu
+        run: npm install jsvu -g
+      - name: Install d8
+        run: jsvu --os=default --engines=v8
+      - name: d8 version
+        run: ~/.jsvu/engines/v8/v8 --version
+      # TODO(mliedtke): This is too slow in comparison to its limited benefit. Decide what to do
+      # with it, either drop it or find a better way of testing this.
+      #
+      # - name: Install Binaryen
+      #   run: |
+      #     Tools/bootstrap-binaryen.sh ~/.binaryen
+      #     echo "$HOME/.binaryen/bin" >> $GITHUB_PATH
+      - name: Install Node.js dependencies for Compiler/Parser tests
+        working-directory: ./Sources/Fuzzilli/Compiler/Parser
+        run: npm install
+      - uses: actions/setup-node@v7
         with:
-          node-version: 25-nightly
+          node-version: 27-nightly
+      - name: V8 version used by Node.js
+        run: node -p process.versions.v8
       - name: Swift Version
         run: swift --version
-      - uses: actions/checkout@v2
       - name: Build
-        run: swift build -c ${{ matrix.kind }} -v
+        run: swift build -c ${{ matrix.kind }}
       - name: Install protobuf
         # Install protoc so the presubmit can also validate the generated *.pb.swift files.
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.kind == 'debug' }}
-        run: sudo apt install -y protobuf-compiler
+        run: sudo apt update && sudo apt install -y protobuf-compiler
       - name: Run presubmit checks
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.kind == 'debug' }}
         run: python3 Tools/presubmit.py
       - name: Run tests with Node.js
-        run: swift test -c ${{ matrix.kind }} -v
+        run: Tools/run_tests.py Tests/failing_nodejs.txt -c ${{ matrix.kind }} --no-parallel
+      - name: Run tests with d8
+        run: FUZZILLI_TEST_SHELL=~/.jsvu/engines/v8/v8 Tools/run_tests.py Tests/failing_jsvu.txt -c ${{ matrix.kind }} --no-parallel
+
+  asan:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
       - name: Install jsvu
         run: npm install jsvu -g
       - name: Install d8
         run: jsvu --os=default --engines=v8
-      - name: Run tests with d8
-        run: FUZZILLI_TEST_SHELL=~/.jsvu/engines/v8/v8 swift test -c ${{ matrix.kind }} -v
+      - name: d8 version
+        run: ~/.jsvu/engines/v8/v8 --version
+      # TODO(mliedtke): This is too slow in comparison to its limited benefit. Decide what to do
+      # with it, either drop it or find a better way of testing this.
+      #
+      # - name: Install Binaryen
+      #   run: |
+      #     Tools/bootstrap-binaryen.sh ~/.binaryen
+      #     echo "$HOME/.binaryen/bin" >> $GITHUB_PATH
+      - name: Swift Version
+        run: swift --version
+      - name: Install LLVM
+        run: sudo apt update && sudo apt install -y llvm
+      - name: Run tests with leak sanitization
+        run: |
+          set -o pipefail
+          export ASAN_SYMBOLIZER_PATH=$(which llvm-symbolizer)
+          export FUZZILLI_TEST_SHELL=~/.jsvu/engines/v8/v8
+          export ASAN_OPTIONS=detect_leaks=1
+          export LSAN_OPTIONS=suppressions=$PWD/Tests/lsan_suppressions.txt
+          swift test --sanitize=address --no-parallel 2>&1 | swift demangle

.gitignore

@@ -13,3 +13,13 @@ Cloud/GCE/config.sh
 # node.js dependencies, used by the JavaScript parser for the FuzzIL compiler
 node_modules
 package-lock.json
+
+# AI-related files.
+/.agents
+/.gemini
+/GEMINI.md
+/AGENTS.md
+
+# Python
+__pycache__/
+*.py[cod]

.swift-format

@@ -0,0 +1,79 @@
+{
+  "fileScopedDeclarationPrivacy" : {
+    "accessLevel" : "private"
+  },
+  "indentBlankLines" : false,
+  "indentConditionalCompilationBlocks" : true,
+  "indentSwitchCaseLabels" : false,
+  "indentation" : {
+    "spaces" : 4
+  },
+  "lineBreakAroundMultilineExpressionChainComponents" : false,
+  "lineBreakBeforeControlFlowKeywords" : false,
+  "lineBreakBeforeEachArgument" : false,
+  "lineBreakBeforeEachGenericRequirement" : false,
+  "lineBreakBetweenDeclarationAttributes" : false,
+  "lineLength" : 100,
+  "maximumBlankLines" : 1,
+  "multiElementCollectionTrailingCommas" : true,
+  "noAssignmentInExpressions" : {
+    "allowedFunctions" : [
+      "XCTAssertNoThrow"
+    ]
+  },
+  "orderedImports" : {
+    "includeConditionalImports" : false
+  },
+  "prioritizeKeepingFunctionOutputTogether" : false,
+  "reflowMultilineStringLiterals" : "never",
+  "respectsExistingLineBreaks" : true,
+  "rules" : {
+    "AllPublicDeclarationsHaveDocumentation" : false,
+    "AlwaysUseLiteralForEmptyCollectionInit" : false,
+    "AlwaysUseLowerCamelCase" : true,
+    "AmbiguousTrailingClosureOverload" : true,
+    "AvoidRetroactiveConformances" : true,
+    "BeginDocumentationCommentWithOneLineSummary" : false,
+    "DoNotUseSemicolons" : true,
+    "DontRepeatTypeInStaticProperties" : true,
+    "FileScopedDeclarationPrivacy" : true,
+    "FullyIndirectEnum" : true,
+    "GroupNumericLiterals" : true,
+    "IdentifiersMustBeASCII" : true,
+    "NeverForceUnwrap" : false,
+    "NeverUseForceTry" : false,
+    "NeverUseImplicitlyUnwrappedOptionals" : false,
+    "NoAccessLevelOnExtensionDeclaration" : true,
+    "NoAssignmentInExpressions" : true,
+    "NoBlockComments" : true,
+    "NoCasesWithOnlyFallthrough" : true,
+    "NoEmptyLinesOpeningClosingBraces" : false,
+    "NoEmptyTrailingClosureParentheses" : true,
+    "NoLabelsInCasePatterns" : true,
+    "NoLeadingUnderscores" : false,
+    "NoParensAroundConditions" : true,
+    "NoPlaygroundLiterals" : true,
+    "NoVoidReturnOnFunctionSignature" : true,
+    "OmitExplicitReturns" : false,
+    "OneCasePerLine" : true,
+    "OneVariableDeclarationPerLine" : true,
+    "OnlyOneTrailingClosureArgument" : true,
+    "OrderedImports" : true,
+    "ReplaceForEachWithForLoop" : true,
+    "ReturnVoidInsteadOfEmptyTuple" : true,
+    "TypeNamesShouldBeCapitalized" : true,
+    "UseEarlyExits" : false,
+    "UseExplicitNilCheckInConditions" : true,
+    "UseLetInEveryBoundCaseVariable" : true,
+    "UseShorthandTypeNames" : true,
+    "UseSingleLinePropertyGetter" : true,
+    "UseSynthesizedInitializer" : true,
+    "UseTripleSlashForDocumentationComments" : true,
+    "UseWhereClausesInForLoops" : false,
+    "ValidateDocumentationComments" : false
+  },
+  "spacesAroundRangeFormationOperators" : false,
+  "spacesBeforeEndOfLineComments" : 2,
+  "tabWidth" : 8,
+  "version" : 1
+}

CONTRIBUTING.md

@@ -22,7 +22,9 @@ use GitHub pull requests for this purpose. Consult
 [GitHub Help](https://help.github.com/articles/about-pull-requests/) for more
 information on using pull requests.
 
-## Community Guidelines
+## Community Guidelines & AI Coding Policy
 
 This project follows [Google's Open Source Community
 Guidelines](https://opensource.google.com/conduct/).
+
+It also follows the [Chromium AI Coding Policy](https://chromium.googlesource.com/chromium/src/+/main/agents/ai_policy.md).

OWNERS

@@ -1,5 +1,7 @@
+bettscheider@chromium.org
 cffsmith@google.com
 machenbach@google.com
+marja@google.com
 mdanylo@google.com
 mliedtke@google.com
 pawkra@google.com

PRESUBMIT.py

@@ -0,0 +1,19 @@
+# Copyright 2026 Google LLC
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import sys
+# depot_tools runs presubmit scripts in an isolated environment where the
+# repository root is not in sys.path. We must explicitly add it to import local
+# packages.
+sys.path.insert(0, '.')
+
+from Tools import presubmit
+
+def CheckChangeOnUpload(input_api, output_api):
+    results = []
+    try:
+        presubmit.check_all()
+    except Exception as e:
+        results.append(output_api.PresubmitError(str(e)))
+    return results

Package.swift

@@ -19,60 +19,90 @@ import PackageDescription
 let package = Package(
     name: "Fuzzilli",
     platforms: [
-        .macOS(.v13),
+        .macOS(.v13)
     ],
     products: [
-        .library(name: "Fuzzilli",targets: ["Fuzzilli"]),
+        .library(name: "Fuzzilli", targets: ["Fuzzilli"])
     ],
     dependencies: [
-        .package(url: "https://github.com/apple/swift-protobuf.git", from: "1.31.0"),
+        // We use an exact version here as we also use this version to generate the .pb.swift to
+        // ensure that they are always regenerated with a consistent version. So this entry locks
+        // the version. It can be bumped arbitrarily, however, the generated files should be
+        // regenerated, whenever the version is bumped.
+        .package(url: "https://github.com/apple/swift-protobuf.git", exact: "1.35.0"),
         .package(
-          url: "https://github.com/apple/swift-collections.git",
-          .upToNextMinor(from: "1.2.0")
+            url: "https://github.com/apple/swift-collections.git",
+            .upToNextMinor(from: "1.2.0")
+        ),
+        .package(
+            url: "https://github.com/apple/swift-algorithms.git",
+            .upToNextMinor(from: "1.2.1")
         ),
     ],
     targets: [
-        .target(name: "libsocket",
-                dependencies: []),
+        .target(
+            name: "libsocket",
+            dependencies: []),
+
+        .target(
+            name: "libreprl",
+            dependencies: []),
+
+        .target(
+            name: "libcoverage",
+            dependencies: [],
+            cSettings: [.unsafeFlags(["-O3"])],  // Using '-c release' when building uses '-O2', so '-O3' provides a performance gain
+            linkerSettings: [.linkedLibrary("rt", .when(platforms: [.linux]))]),
 
-        .target(name: "libreprl",
-                dependencies: []),
+        .target(
+            name: "Fuzzilli",
+            dependencies: [
+                .product(name: "SwiftProtobuf", package: "swift-protobuf"),
+                .product(name: "Collections", package: "swift-collections"),
+                "libsocket",
+                "libreprl",
+                "libcoverage",
+            ],
+            exclude: [
+                "Protobuf/operations.proto",
+                "Protobuf/program.proto",
+                "Protobuf/sync.proto",
+                "Protobuf/README.md",
+                "Protobuf/gen_programproto.py",
+            ],
+            resources: [
+                // The ast.proto file is required by the node.js parser
+                .copy("Protobuf/ast.proto"),
+                .copy("Compiler/Parser"),
+            ]),
 
-        .target(name: "libcoverage",
-                dependencies: [],
-                cSettings: [.unsafeFlags(["-O3"])],     // Using '-c release' when building uses '-O2', so '-O3' provides a performance gain
-                linkerSettings: [.linkedLibrary("rt", .when(platforms: [.linux]))]),
+        .executableTarget(
+            name: "REPRLRun",
+            dependencies: ["libreprl"]),
 
-        .target(name: "Fuzzilli",
-                dependencies: [
-                    .product(name: "SwiftProtobuf", package: "swift-protobuf"),
-                    .product(name: "Collections", package: "swift-collections"),
-                    "libsocket",
-                    "libreprl",
-                    "libcoverage"],
-                exclude: [
-                    "Protobuf/operations.proto",
-                    "Protobuf/program.proto",
-                    "Protobuf/sync.proto",
-                    "Protobuf/README.md",
-                    "Protobuf/gen_programproto.py"],
-                resources: [
-                    // The ast.proto file is required by the node.js parser
-                    .copy("Protobuf/ast.proto"),
-                    .copy("Compiler/Parser")]),
+        .executableTarget(
+            name: "FuzzilliCli",
+            dependencies: ["Fuzzilli"]),
 
-        .executableTarget(name: "REPRLRun",
-                dependencies: ["libreprl"]),
+        .executableTarget(
+            name: "FuzzILTool",
+            dependencies: ["Fuzzilli"]),
 
-        .executableTarget(name: "FuzzilliCli",
-                dependencies: ["Fuzzilli"]),
+        // Tool that runs d8 in Dumpling mode. First time it runs with Maglev
+        // and Turbofan. Second time without. In both runs frames are dumped
+        // in certain points to the files. The dumps are later compared for
+        // equality. If they are not equal, it means that there's likely a bug
+        // in V8.
+        .executableTarget(
+            name: "RelateTool",
+            dependencies: ["Fuzzilli"]),
 
-        .executableTarget(name: "FuzzILTool",
-                dependencies: ["Fuzzilli"]),
+        .executableTarget(name: "FuzzilliDetectMissingBuiltins", dependencies: ["Fuzzilli"]),
 
-        .testTarget(name: "FuzzilliTests",
-                    dependencies: ["Fuzzilli"],
-                    resources: [.copy("CompilerTests")]),
+        .testTarget(
+            name: "FuzzilliTests",
+            dependencies: ["Fuzzilli", .product(name: "Algorithms", package: "swift-algorithms")],
+            resources: [.copy("CompilerTests")]),
     ],
     swiftLanguageVersions: [.v5]
 )