base fuzzili update - #52
Open
Dudcom wants to merge 515 commits into
Open
Conversation
Author
|
we are in hell |
This CL makes sure that "break <lbl>;" and "continue <lbl>;" instructions are never mutated in a way such that <lbl> is replaced with an arbitrary variable; only labels of the specific type will be chosen. Bug: 504947197 Change-Id: I2669f0f74f79b4570c40dfcb431c594185d3a279 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9252860 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Bug: 504947197 Change-Id: I77e956c3b1026a9715fa2c706254518a7d19e581 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9252780 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Fuzzilli's `jsArray`s are defined using a non-parameterized `iterable`. To support assumptions regarding the typing of a `jsArray`'s elements, this CL makes `jsArray` optionally parametrizable through the `createJsArrayType` function. This CL avoids introducing type serialization for the type argument. Rather, the CreateArray operation stores the type argument's group name. As a result, types without an associated group name, such as `.string` or `.iterable`, should not be used as a type argument. Parameterized iterables details: cc0ff34 Fixed: 503429420 Change-Id: I3c3d2f56b7bd4eba14682ac496b097df9f57cd7f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9249980 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
A bundle can contain one or several modules. A module provides a
.moduleTopLevle | .javascript context. Imports and exports can occur
only in the .moduleTopLevel context.
For now, modules can only have very simple imports and exports:
export {v1 as export0_1, v2 as export0_2};
import {v1 as v3, v2 as v4} from 'a.mjs';
More complex cases will be added later.
Bug: 342521422
Change-Id: Ie4b0b30ce2976981a5ec2279d3214196e1e62a6b
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9230416
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Marja Hölttä <marja@google.com>
Fuzzilli's current ordering for which source it uses to generate `.object()` types is: 1. Producing generators 2. Properties and methods 3. CodeGenerators marked with `produces` (distinct from item 1) 4. Generating object properties directly With producing properties and methods overshadowing CodeGenerators, using CodeGenerators for types with sophisticated generation logic, in order to ensure program quality, required workarounds and compromises such as not registering the type as a builtin. This CL reorders the logic to favor custom CodeGenerators with matching `produces` annotations. The CodeGenerators block is moved to be after the producing generators block. A 75% probability check is introduced for selecting whether to use CodeGenerators to maintain diversity in how Fuzzilli generates objects. Bug: 479225937 Change-Id: I59ead967e9710749cb13b433fb74c64ebc8ba085 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9253961 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This makes ProgramBuilderTests.testFindOrGenerateWithCodeGenerator not flaky by ensuring we will always use a generator if there is one and we didn't find another way for creating the object. Change-Id: Ie5cd0b787432588fb9152e0996a68a1644247167 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9266720 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
…iables Drive-by: Add ProbingMutator tests. Bug: 342521422 Change-Id: I234dd9bb1f7c026c9a30bd3aef50d39054bf8455 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9263440 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
Iterator.zipKeyed was added to V8 with https://crrev.com/c/7776198. This CL registers it for fuzzing, passing as a first parameter an object whose values are iterables. Bug: 465357675 Change-Id: Ic952e32aaa5551fb94ac3c1cba4c600602e4fb80 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9265100 Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Nikos Papaspyrou <nikolaos@google.com>
Bug: 445356784 Change-Id: Iad19076024c4e313b62edd94b3cca50d60a62281 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9197817 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
This CL adds support for the br_on_null instruction. Bug: 474940922 Change-Id: Ifbbc676becc471382ef35c347fc578437bab6063 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9250640 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
The analysis of VariableAnalyzer is simpler than the one in ProgramBuilder. In particular, it accounts for JS label variables even if they're currently hidden, which lead to an assertion failure in CodeGenMutator.mutate(). This CL fixes this by building additional variables if too few are visible. Bug: 504947197 Change-Id: I4c832385d655bfbb9ccdac6d0b09d8b429136c28 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9268280 Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
In many cases we either have a generic JS signature without any type information or we reuse the same JS function multiple times, in both cases we often end up using equivalent Wasm signature definition multiple times but defining a new signature for each of them. This change simplifies the generated code (and the lifted type section of the Wasm module) to not emit duplicate signatures for such imported JS functions. Bug: 445356784 Change-Id: I4ef30ba12aa333b44cf234c4ec5bf5bce6f3f031 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9234376 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
1) Try to generate more unique export names (which will stay unique if programs are spliced into another programs) in ProgramBuilder. This approach will still generate duplicate export names when a program is spliced into itself. 2) Handle duplicate exports gracefully in JSTyper Fixed: 510644538 Bug: 342521422 Change-Id: If371e40f9c112e6880efb56736bb7d42a2a92fa3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9273902 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
As long as V8's full bytecode verification isn't enabled in production, fuzzers should exercise different levels of the bytecode verification, as this may explore different areas of the code (e.g., disabling the verification in sandbox fuzzers will prevent them from bailing out at "harmless error was encountered: Bytecode verification failed" before an actual sandbox violation may ever be detected). Bug: 475707969, 461681036 Change-Id: I85bc2bf6a03fd003a10d5cbf7287dc58d0efaa8a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9275460 Commit-Queue: Maksim Ivanov <emaxx@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This adds a CodeGenerator for generating a set of homomorphic objects, and a ProgramTemplate for optimizing a function which has seen homomorphic objects. Change-Id: Iac8a52c4a021f48ee74bbe24f545b62fa7305697 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9278060 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This CL adds support for the br_on_non_null instruction. Bug: 474940922 Change-Id: I485b7b49e5c036acb29d55acfadaa707a6bf5664 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9274500 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
… OperationMutator Bug: 342521422 Change-Id: I64b68d2b3e5aa78b329d56494a76f9caac626480 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9278600 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
To support assumptions regarding the typing of a `jsMap`'s elements, this CL makes `jsMap` optionally parametrizable through the `createJsMapType` function. This CL also introduces a `CreateMap` operation that persists the key and value type arguments for the map. This CL avoids introducing type serialization for the type arguments, storing the type group names instead. Parameterized iterables details: cc0ff34 Bug: 510424762 Change-Id: I570fb962dc027d48e222acc62b85609cd1048d15 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9274841 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Tigran Bantikyan <bantikyan@google.com>
This CL includes outputs in the IL, similarly to how we already do for WasmBranchOnNull. So they won’t be dropped, but spilled. We also don't drop outputs of WasmBranch now, as this code is unreachable. Change-Id: I7b6e9ee6a1bb91aa23dab5e68cf0237742f073ef Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9273901 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>
as this can cause issues with variable visibility. (assert only) Ad-hoc signatures exist so that we are always able to generate e.g. a wasm function definition even if we are already in the .wasm context and therefore can't emit a wasm type group any more (which are only allowed in the .javascript context). However, these signatures are there for that wasm function then, not to use them as element types as part of other types (e.g. another ad-hoc signature for a Wasm tag definition as such a tag can be exported and reimported by a different module and then a throw of that tag might need to create a value of the element's type (which is the other ad-hoc signature that was only visible in the first Wasm module.) Bug: 445356784 Fixed: 508306801 Change-Id: Idf10b4093913dc252dbead329fad7d54ff46615d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9267281 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
With this change wasm functions can finally include wasm-gc index types in their parameter and result types. Bug: 445356784 Change-Id: I9a57724206d853218624fb8dcfa916169b82a573 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9197816 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
in block arugments. All usages have been adapted to using wasm-gc signatures and therefore allow indexed wasm-gc types. Bug: 445356784 Change-Id: I9db52423e11f5658c7ed20870d51d867eb17c573 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9288584 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>
Add support for CreateMap operations in VariadicInputReducer, OperationMutator, and MinimizationPostProcessor. Fixed: 510424762 Change-Id: Ia7fc6c70922dac8f265746895b0a6894611437d6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9289344 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Tigran Bantikyan <bantikyan@google.com>
The flag was removed in: https://crrev.com/c/7840605 Change-Id: I49e417d602fc6a6fd40e2ca852dc4c7965e84ff3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9305241 Auto-Submit: Michael Achenbach <machenbach@google.com> Reviewed-by: Clemens Backes <clemensb@google.com> Commit-Queue: Clemens Backes <clemensb@google.com>
Bug: 447125167 Change-Id: I694c2feac0d42f1afb47f3ec2e9c94b2401382fe Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9279080 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 447125167 Change-Id: Ifa7899b5e12a30718f64ccac36e693aa91020e5d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9288582 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com>
This flag used to be always set in fuzzers due to the implication from `--fuzzing`, but the implication is removed now (crrev.com/c/7845199). Hence randomize it with high probability (still not 100% to avoid having blind spots), except for sandbox fuzzers where it'd not bring any benefit due to them ignoring CHECKs. Bug: 475707969 Change-Id: Ia8a495af600acc40dcd188fc1726e1e039237c79 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9310081 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Maksim Ivanov <emaxx@google.com>
Add support for handling CreateArray operations with the `elementGroupName` property set in OperationMutator and MinimizationPostProcessor. Bug: 503429420 Change-Id: I29170419cda15d9a73d0a9ad43aaa2ebd0322081 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9293280 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Add randomized addition of --no-flush-bytecode, to occasionally test this non-production scenario. Don't explicitly add --flush-bytecode: it's the default value anyway, and it didn't help to reenable it when flag implications (--jit-fuzzing to --no-flush-bytecode) disable it. Bug: 475707969 Change-Id: Ia2c2141430f222f6c3d7c4cb946762c725c65204 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9278461 Commit-Queue: Maksim Ivanov <emaxx@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Bug: 498924945 Change-Id: Id00b841a3691d2f4fde691de5bdc532c3262880d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9600057 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com>
Properties and methods represent an open bound constraint, so a .object(withProperties: ["foo"]) is an object that has at least the "foo" property, therefore properties need to be unioned when intersecting two objects. If different properties are present, this does not produce a bottom type, we just "gain knowledge" about the available properties. Change-Id: I20db7c9eaa338ce596427717ded578bfcf308d1f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9614635 Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
In this CL: 1) Add the promiseResolvingTo type to ILType, so we can track which types our promises resolve to. Handle union, intersection, subsumption, merging. 2) Async functions return a promise whose resolving type is the type of the return statement. 3) The type of `await <promise>` is the promiseResolvingTo of that promise. 4) Dynamic import returns a promise whose promiseResolvingTo is the type of the corresponding module object. Bug: 521351268 Change-Id: I98717122fb73095618ccaaedc8b694b5edf3da66 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9609335 Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Change-Id: Ie43ceed1e5e8206e3994f6b8587a75a5326eeba2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9631436 Reviewed-by: Marja Hölttä <marja@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>
This reverts most of commit a7f8a77. Reason for revert: There are other places where we use the contributor name in logging and these places now print things like Synthetic(Begin, Begin, End, End) which is not very helpful. Change-Id: Iae5b9405925312bb8d01d243a9fcb5f277147f9a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9632155 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
By recreating them, we have separate objects with separate Contributor counters, so that they are tracked individually (just like all other generator stubs). Change-Id: I33ce408a4f11aa77d89ae8699d88fcaa9ffac269 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9632156 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Fixed: 542466166 Change-Id: I51c3c73075834d4db211ad5304ba3a04e6af36dc Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9631416 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
in classes and objects for static, async and generator functions. Bug: 534927910 Change-Id: I8da31299c59ee2b0c1c060630cb6d7d1e2da0631 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9631735 Reviewed-by: Marja Hölttä <marja@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
When Ctrl+C-ing FuzzilliCli, the fuzzer waited for a graceful shutdown for the main thread but didn't do the same for the other processes. This resulted in some JS runners not being shut down properly leaving some of these child processes running afterwards. This change fixes this by waiting for all jobs to handle their shutdown-events. Note that this does not change the behavior for crashes of the fuzzer itself. If it crashes, we will not run any such shutdown-events. Change-Id: I46611558f8546ea411f906216e2f8a5c7e14c003 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9634456 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
This CL adds exact types and typing rules. Bug: 502246833 Change-Id: Iad0f2816f7a4ec59c04ac4027614b676fe458424 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9631435 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Change-Id: I7020a22159513797df4362f4070261c801d1c463 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9643575 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Change-Id: Ie81c1504c7e950f58460435ab58b14cd3707f63c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9636056 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@google.com>
Change-Id: I782b31cd424460bfdd499a970669068d921335f4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9643656 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Change-Id: Iafffa816f1283db25c5254a9229d21b8deb7191d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9645495 Reviewed-by: Olivier Flückiger <olivf@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This CL adds descriptor and describes clauses to struct types. WasmCustomDescriptorsStructTypesGenerator is disabled until we add the new instructions and subtyping. Otherwise, we would generate many invalid programs and LiveTests would fail. Bug: 502246833 Change-Id: Ic19fc508686944563a8b96419982007c2c4a3123 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9643576 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
While this doesn't matter for actual fuzzer runs as they create a single Fuzzer object per thread, this can be an issue for LSAN reports of test cases as they each create a new fuzzer instance. Change-Id: I4fa0020f14db0411b55094d56243f6f4117137f7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9650455 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Change-Id: I167b86107cbe2f529299e37503a8242b2e3bb1a4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9650456 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Change-Id: I2b209b10c55b412dc77f1c1ecd92bffaa73733b9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9659015 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This CL adds subtyping for custom descriptor struct types. Bug: 502246833 Change-Id: Iecc1643b336411e6320769385ebc663e66b380e6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9650235 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This might slightly increase the chance of ending up either explicitly (e.g. via CallFunction vs. CallMethod on the exports object) or implicitly (e.g. via passing it into some builtin that uses it as a callback) executing the chosen Wasm function. Bug: 498924945 Change-Id: I02374a64daa0785e96a8257e40ecbf1db4bccb01 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9665016 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Fuzzilli itself doesn't generate ref.cast_desc_eq instructions, so this can only be found by the Binaryen integration. Corresponding V8 change: https://crrev.com/c/8236732 Bug: 498924945 Change-Id: Ibb9b6e66efacc283ef68288024acedfbeb909a01 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9666335 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
as well as the wrong logic in subsumes(). Bug: 408162715 Change-Id: Id00203eb36429f0fc85267ec1bf04112573165fa Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9665436 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
A nil receiver type means that we lost all type information about the receiver (e.g. because the receiver resolved to .nothing) indicating that there isn't any receiver for which we'd know that calling this unbound function would be safe. We change the generators to always emit a guard in these probably rare cases. Bug: 408162715 Change-Id: If56a706fffdedb3ea69327667035104fd0cf1ff5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9670675 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
without visible JS variables. TAG=agy Change-Id: If6204cad1dd4bd6e80f747c69cf22c78f7ffb4cb Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9673595 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
In JavaScript, optional chaining (`?.`) on the left-hand side of an assignment is disallowed by static early error rules: https://tc39.es/ecma262/#sec-static-semantics-assignmenttargettype Previously, lifting a guarded SetPrivateProperty instruction emitted `obj?.#prop = val;`, producing an uncatchable parse-time SyntaxError. This change aligns SetPrivateProperty with SetProperty and UpdatePrivateProperty to always emit standard member access (`obj.#prop = val;`) on the assignment target. Change-Id: Ibf8b83d2442dfe5b538e450c05fad9ce00f359d6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9672675 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
Change-Id: I3b0d3d55b213aecc94cb0e12843b7c2572a26cd5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9672975 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
https://developer.mozilla.org/en-US/docs/WebAssembly/Reference/JavaScript_interface/validate_static#return_value Change-Id: I413cd116d66f3f2912f87f9e83bdc0440931006d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9673596 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
.. and enable acquire-release-atomics flag. Bug: 498924945 Fixed: 535260641 Change-Id: Id4f863c74b540d1879bb324e10a1cca8939588d2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9673715 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Change-Id: I90e62d7e7d6805e98ad869d746967682dd421c7a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9678017 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
- Fix empty method name in Duration construction ("from")
- Fix argument count for PlainYearMonth and PlainMonthDay constructors
- Fix malformed subsecond separator in UTC offset strings
- Fix PlainMonthDay.prototype.with returning PlainYearMonth instead of
PlainMonthDay
- Fix PlainMonthDay.prototype.equals accepting PlainYearMonth parameters
- Fix Duration.prototype.total return type to number instead of Duration
- Fix ZonedDateTime.prototype.getTimeZoneTransition returning
Instant | nullish
- Remove duplicate "auto" entry in jsTemporalUnitEnum
Change-Id: If94ec911e1966d97cb7bd64c9c9533429081f958
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9678375
Commit-Queue: Manish Goregaokar <manishearth@google.com>
Reviewed-by: Manish Goregaokar <manishearth@google.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
13 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
updating with head