base fuzzili update - #52
Open
Dudcom wants to merge 503 commits into
Open
Conversation
Author
|
we are in hell |
In line with loops, if/else, and block statements, now switch statements also have a unique label of type .jsBlockLabel. This label is only emitted when it’s used. For “break;” without a label, we still use switchBreak() that requires the .switchCase context. For “break label;”, we reuse blockBreak() which requires a .jsBlockLabel to be in scope. Bug: 504947197 Change-Id: I9fa291e62cb330694119693404d49e37ccbb4cb7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9223516 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Bug: 445356784 Change-Id: If9706cdc8876721e00289eb096f35b555981c129 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9151896 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 504947197 Change-Id: If1b2d420b60e54cee67e43ea91570bf4267e086f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9227078 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Bug: 504947197 Change-Id: Ia94e0b0521df38e9f3b94e434e7e80fda5cc063b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9227536 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 504947197 Change-Id: I82446d1bc4ad71ed518307e7ae3388639a0c6171 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9227556 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Many places were checking hasVisibleVariables, but then calling randomJsVariable() and assuming it will succeed. They should've used hasVisibleJsVariables instead. Bug: 342521422 Change-Id: I6e407c31751faf1a73bdb3497d515b39253c228a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9234178 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Currently, Fuzzilli has no native mechanism to declare an iterable that yeilds elements of only a specific type. As a result, Fuzzilli struggles to generate correct programs for code that operates on such iterables. While a workaround is possible by using custom types and CodeGenerators, that approach relies on ProgramBuilder's `setType`, which does not persist type info when the program is saved to the corpus. This CL introduces parameterizability to the `iterable` type with the addition of the `iterableElementType` to the `TypeExtension`. Importantly, the nature of Fuzzilli makes it so this type is just an assumption at generation time, and does not guarantee that the iterable will not hold elements of other types as a program grows and mutates. Accompanying this new feature is an update to the `format` method used for debugging. Parameterized iterables are serialized as "iterable<T>", where T is the serialization of the type stored in `iterableElementType`. Additionally, this CL updates internal type generation in `ProgramBuilder` so that parameterized iterables are generated as single-element arrays of the corresponding type parameter. Bug: 503429420 Change-Id: Ie49882d6eea61a992f51b6e1fab030e2e198144c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9234311 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Tigran Bantikyan <bantikyan@google.com>
Change-Id: I404ec9aba3dedd3caa4f198188c520154f886317 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9240360 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
ExplorationMutator may explore inner outputs, which adds instrumentation code immediately. However, such arbitrary JS code is not allowed in the outer switch context, before a `case` was seen. In general, exploring labels probably does not make sense, so this CL avoids all labels from being explored. Bug: 504947197 Change-Id: I9ed4b30e12fb277cc4136ec9d4edfa1c0e2166e9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9241640 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Those places were interested in visible JS variables. Bug: 342521422 Change-Id: I3c7fb727c2d212a76ce5488360f7c8cd011df2bb Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9244060 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
.resumesSurroundingContext is used for a start block that doesn't want to propagate the surrounding context but wants to resume the context surrounding the surrounding context (see implementation of skipsSurroundingContext). This change ensures that we don't use this on .isBlockEnd as a block end will always resume the surrounding context and we shouldn't set this attribute for that as its presence is completely ignored. Change-Id: Ie2c55fc19c591c68873e73446ecb2e8e8e5748ac Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9248740 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@google.com>
Bug: 498924945 Change-Id: Ib4dcf00db95622059098e1afa1d3680d78dba060 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9232421 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com>
This CL makes sure that "break <lbl>;" and "continue <lbl>;" instructions are never mutated in a way such that <lbl> is replaced with an arbitrary variable; only labels of the specific type will be chosen. Bug: 504947197 Change-Id: I2669f0f74f79b4570c40dfcb431c594185d3a279 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9252860 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Bug: 504947197 Change-Id: I77e956c3b1026a9715fa2c706254518a7d19e581 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9252780 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Fuzzilli's `jsArray`s are defined using a non-parameterized `iterable`. To support assumptions regarding the typing of a `jsArray`'s elements, this CL makes `jsArray` optionally parametrizable through the `createJsArrayType` function. This CL avoids introducing type serialization for the type argument. Rather, the CreateArray operation stores the type argument's group name. As a result, types without an associated group name, such as `.string` or `.iterable`, should not be used as a type argument. Parameterized iterables details: cc0ff34 Fixed: 503429420 Change-Id: I3c3d2f56b7bd4eba14682ac496b097df9f57cd7f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9249980 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
A bundle can contain one or several modules. A module provides a
.moduleTopLevle | .javascript context. Imports and exports can occur
only in the .moduleTopLevel context.
For now, modules can only have very simple imports and exports:
export {v1 as export0_1, v2 as export0_2};
import {v1 as v3, v2 as v4} from 'a.mjs';
More complex cases will be added later.
Bug: 342521422
Change-Id: Ie4b0b30ce2976981a5ec2279d3214196e1e62a6b
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9230416
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Marja Hölttä <marja@google.com>
Fuzzilli's current ordering for which source it uses to generate `.object()` types is: 1. Producing generators 2. Properties and methods 3. CodeGenerators marked with `produces` (distinct from item 1) 4. Generating object properties directly With producing properties and methods overshadowing CodeGenerators, using CodeGenerators for types with sophisticated generation logic, in order to ensure program quality, required workarounds and compromises such as not registering the type as a builtin. This CL reorders the logic to favor custom CodeGenerators with matching `produces` annotations. The CodeGenerators block is moved to be after the producing generators block. A 75% probability check is introduced for selecting whether to use CodeGenerators to maintain diversity in how Fuzzilli generates objects. Bug: 479225937 Change-Id: I59ead967e9710749cb13b433fb74c64ebc8ba085 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9253961 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This makes ProgramBuilderTests.testFindOrGenerateWithCodeGenerator not flaky by ensuring we will always use a generator if there is one and we didn't find another way for creating the object. Change-Id: Ie5cd0b787432588fb9152e0996a68a1644247167 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9266720 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
…iables Drive-by: Add ProbingMutator tests. Bug: 342521422 Change-Id: I234dd9bb1f7c026c9a30bd3aef50d39054bf8455 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9263440 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
Iterator.zipKeyed was added to V8 with https://crrev.com/c/7776198. This CL registers it for fuzzing, passing as a first parameter an object whose values are iterables. Bug: 465357675 Change-Id: Ic952e32aaa5551fb94ac3c1cba4c600602e4fb80 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9265100 Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Nikos Papaspyrou <nikolaos@google.com>
Bug: 445356784 Change-Id: Iad19076024c4e313b62edd94b3cca50d60a62281 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9197817 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
This CL adds support for the br_on_null instruction. Bug: 474940922 Change-Id: Ifbbc676becc471382ef35c347fc578437bab6063 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9250640 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
The analysis of VariableAnalyzer is simpler than the one in ProgramBuilder. In particular, it accounts for JS label variables even if they're currently hidden, which lead to an assertion failure in CodeGenMutator.mutate(). This CL fixes this by building additional variables if too few are visible. Bug: 504947197 Change-Id: I4c832385d655bfbb9ccdac6d0b09d8b429136c28 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9268280 Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
In many cases we either have a generic JS signature without any type information or we reuse the same JS function multiple times, in both cases we often end up using equivalent Wasm signature definition multiple times but defining a new signature for each of them. This change simplifies the generated code (and the lifted type section of the Wasm module) to not emit duplicate signatures for such imported JS functions. Bug: 445356784 Change-Id: I4ef30ba12aa333b44cf234c4ec5bf5bce6f3f031 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9234376 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
1) Try to generate more unique export names (which will stay unique if programs are spliced into another programs) in ProgramBuilder. This approach will still generate duplicate export names when a program is spliced into itself. 2) Handle duplicate exports gracefully in JSTyper Fixed: 510644538 Bug: 342521422 Change-Id: If371e40f9c112e6880efb56736bb7d42a2a92fa3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9273902 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
As long as V8's full bytecode verification isn't enabled in production, fuzzers should exercise different levels of the bytecode verification, as this may explore different areas of the code (e.g., disabling the verification in sandbox fuzzers will prevent them from bailing out at "harmless error was encountered: Bytecode verification failed" before an actual sandbox violation may ever be detected). Bug: 475707969, 461681036 Change-Id: I85bc2bf6a03fd003a10d5cbf7287dc58d0efaa8a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9275460 Commit-Queue: Maksim Ivanov <emaxx@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This adds a CodeGenerator for generating a set of homomorphic objects, and a ProgramTemplate for optimizing a function which has seen homomorphic objects. Change-Id: Iac8a52c4a021f48ee74bbe24f545b62fa7305697 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9278060 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL adds support for the br_on_non_null instruction. Bug: 474940922 Change-Id: I485b7b49e5c036acb29d55acfadaa707a6bf5664 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9274500 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
… OperationMutator Bug: 342521422 Change-Id: I64b68d2b3e5aa78b329d56494a76f9caac626480 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9278600 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
In this CL, we:
- Add `binaryen_version.txt` containing the pinned version '131'.
- Add `Tools/bootstrap-binaryen.sh` to download and install the pinned Binaryen release in the requested directory.
TAG=agy
Bug: 535260640
Change-Id: I7dbcb0e2e6598ae1e06af784276f2ea1286c76b8
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9577363
Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Michael Achenbach <machenbach@google.com>
Also fix duplicate names by using the CodeGenerator as a prefix for each CodeGeneratorStub. (Previously these were overwriting each other, so the last one won.) Change-Id: I37657945683f48939d1d0bd98d8bf24b83ba5049 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9600395 Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This is a follow-up to https://crrev.com/i/9600395 improving readability of the statistics by printing nicer aggregate names for code generator stubs like > TryCatchGenerator/Catch instead of > TryCatchGenerator/BeginCatchGenerator Change-Id: I9e664cfe025dd42560337d53790aa5ae57af5b96 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9605275 Reviewed-by: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 515363087 Change-Id: I60fd783c0ba5b3669b2a6c5524fe5503dfbc95c9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9605255 Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
… FixupMutator Bug: 534650967 Change-Id: Id46ff7be2a9229ecd9449d7a6ee904a783c42ab6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9600058 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Remove constructorPath from jsSymbolConstructor and jsBigIntConstructor in JavaScriptEnvironment. Symbol and BigInt are non-constructible functions in JavaScript, so setting constructorPath caused assertion failures when generating constructor types. Also add testConstructorTypeGenerationForAllGroups to verify constructor type generation across all registered object groups. Bug: 515363087 Change-Id: I3bb3fea7a58cb572daec377ea22e454bff01ed79 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9609795 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
This just increases the diversity and doesn't really make the code harder to maintain. The minimizer right now doesn't seem to simplify getter-setter pairs for Object.configureProperty and so this is the easiest way to achieve all combinations. Still using a higher chance for generating both as that's probably the most likely configuration to flush out bugs. Bug: 534927910 Change-Id: Iafa3950c05066c49929002d59463c60170bd0b7a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9609596 Reviewed-by: Marja Hölttä <marja@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
This CL adds a new error type which we use to type variables with as soon as we have detected an invalid state. The error type will then be propagated to all outputs and inner outputs of instructions that have an error typed input, and we avoid processing those instructions further. As a consequence, the typer doesn't process instructions with invalid inputs and hence cannot crash (e.g., due to dangling references, caused by a faulty minimization due to missing data-flow tracking). The WasmLifter will fail and the JavaScriptLifter will emit a JS exception, so the program will be discarded. Another option we considered is to throw an exception as soon as an invalid state is found in the typer, but this idea was discarded as it requires many changes across the code base. Bug: 533316073 Change-Id: Ic5a1d7ee7674c07334ea8005c92d16216a28cfd6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9605075 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Bug: 537297697 Change-Id: I9c91025d1b3ce26b3eba8b47342ab74dd624194d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9575155 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
We used to generate an await right at the end. Allowing more code generation between the await and the function end makes it more probable that we use the result of the await in an interesting way. Change-Id: I021f2f2e333b53910bbba938af7bb7ee33241b48 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9613275 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
To better reach the the graph optimizer this flag disables the optimizations in the graph builder. This gives the optimizer more opportunities to trigger. Change-Id: Icf70d27fc375a7c4999d1030dc35b48b53ec56a6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9614295 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Olivier Flückiger <olivf@google.com> Auto-Submit: Olivier Flückiger <olivf@google.com>
Bug: 537297697 Change-Id: I11cf5bd8d7bd8d88428cf0c97fb7b59016281d7c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9614595 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Bug: 498924945 Change-Id: Id00b841a3691d2f4fde691de5bdc532c3262880d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9600057 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com>
Properties and methods represent an open bound constraint, so a .object(withProperties: ["foo"]) is an object that has at least the "foo" property, therefore properties need to be unioned when intersecting two objects. If different properties are present, this does not produce a bottom type, we just "gain knowledge" about the available properties. Change-Id: I20db7c9eaa338ce596427717ded578bfcf308d1f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9614635 Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
In this CL: 1) Add the promiseResolvingTo type to ILType, so we can track which types our promises resolve to. Handle union, intersection, subsumption, merging. 2) Async functions return a promise whose resolving type is the type of the return statement. 3) The type of `await <promise>` is the promiseResolvingTo of that promise. 4) Dynamic import returns a promise whose promiseResolvingTo is the type of the corresponding module object. Bug: 521351268 Change-Id: I98717122fb73095618ccaaedc8b694b5edf3da66 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9609335 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Change-Id: Ie43ceed1e5e8206e3994f6b8587a75a5326eeba2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9631436 Reviewed-by: Marja Hölttä <marja@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
This reverts most of commit a7f8a77. Reason for revert: There are other places where we use the contributor name in logging and these places now print things like Synthetic(Begin, Begin, End, End) which is not very helpful. Change-Id: Iae5b9405925312bb8d01d243a9fcb5f277147f9a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9632155 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
By recreating them, we have separate objects with separate Contributor counters, so that they are tracked individually (just like all other generator stubs). Change-Id: I33ce408a4f11aa77d89ae8699d88fcaa9ffac269 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9632156 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Fixed: 542466166 Change-Id: I51c3c73075834d4db211ad5304ba3a04e6af36dc Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9631416 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
in classes and objects for static, async and generator functions. Bug: 534927910 Change-Id: I8da31299c59ee2b0c1c060630cb6d7d1e2da0631 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9631735 Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
When Ctrl+C-ing FuzzilliCli, the fuzzer waited for a graceful shutdown for the main thread but didn't do the same for the other processes. This resulted in some JS runners not being shut down properly leaving some of these child processes running afterwards. This change fixes this by waiting for all jobs to handle their shutdown-events. Note that this does not change the behavior for crashes of the fuzzer itself. If it crashes, we will not run any such shutdown-events. Change-Id: I46611558f8546ea411f906216e2f8a5c7e14c003 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9634456 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
This CL adds exact types and typing rules. Bug: 502246833 Change-Id: Iad0f2816f7a4ec59c04ac4027614b676fe458424 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9631435 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Change-Id: I7020a22159513797df4362f4070261c801d1c463 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9643575 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Change-Id: Ie81c1504c7e950f58460435ab58b14cd3707f63c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9636056 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@google.com>
Change-Id: I782b31cd424460bfdd499a970669068d921335f4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9643656 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Change-Id: Iafffa816f1283db25c5254a9229d21b8deb7191d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9645495 Reviewed-by: Olivier Flückiger <olivf@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This CL adds descriptor and describes clauses to struct types. WasmCustomDescriptorsStructTypesGenerator is disabled until we add the new instructions and subtyping. Otherwise, we would generate many invalid programs and LiveTests would fail. Bug: 502246833 Change-Id: Ic19fc508686944563a8b96419982007c2c4a3123 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9643576 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
While this doesn't matter for actual fuzzer runs as they create a single Fuzzer object per thread, this can be an issue for LSAN reports of test cases as they each create a new fuzzer instance. Change-Id: I4fa0020f14db0411b55094d56243f6f4117137f7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9650455 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Change-Id: I167b86107cbe2f529299e37503a8242b2e3bb1a4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9650456 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Change-Id: I2b209b10c55b412dc77f1c1ecd92bffaa73733b9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9659015 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
13 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
updating with head