Conversation
Change the loop condition to compare the iteration index against 'indices.count - 1' instead of 'indices.last!'. Also added regression test testDestructuringSimplificationWithRest, which reproduces the original bug using sparse indices with 'lastIsRest' set to true, ensuring that DestructArray is simplified into GetElement and a residual DestructArray for the rest elements. Change-Id: Ic630615bb85231d703046be4dc669e4314927db2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9027276 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Dominik Klemba <tacet@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
While this feature is disabled by default, it is a non-experimental feature and other fuzzers already create exposure of this feature (see https://source.chromium.org/chromium/chromium/src/+/main:v8/tools/clusterfuzz/trials/clusterfuzz_trials_config.json;l=60;drc=84a1682b877e88c8912cebf44a8513c7d84206ed) Bug: 485657212 Change-Id: I899357c64d4e2dfd9385d3da5f445f0edc447765 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9035976 Reviewed-by: Darius Mercadier <dmercadier@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Change-Id: Icee437b92f284e7f9f7dc339d31ee157c6f876ae Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9032277 Reviewed-by: Samuel Groß <saelo@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 465497343 Change-Id: I81b857dc9dac3fb95f8cd3b0f45be04b396626d8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9043816 Commit-Queue: Michael Achenbach <machenbach@google.com> Auto-Submit: Michael Achenbach <machenbach@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Danylo Mocherniuk <mdanylo@google.com>
Change-Id: I7351c40670430f5b21ecff521eb5d419dc3ce2ac Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9051356 Reviewed-by: Dominik Klemba <tacet@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Dominik Klemba <tacet@google.com>
This is needed for a tool that uses the JavaScriptExecutor and produces a large amount of output (the list of all builtins available in the global scope). Bug: 487347678 Change-Id: Ib83ee2ae33a609e5b8ce1598b14892a8cedfd0a4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9047637 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/constructor Change-Id: Iaa324d06653a8dfeb2cc5e48b8357f5e4d2670c2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9051196 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Fuzzilli functionality for ref.cast added similarly to ref.test Bug: 474940922 Change-Id: I7cd3a28b05b7289c8ea0836be0c6d1024556e24c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8995238 Commit-Queue: Doga Yüksel <dyuksel@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
…d instance type See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/DisposableStack Bug: 487347678 Change-Id: I85e523864482d16d5b1f2a1c9d0cd3ba0cb77613 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9051796 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com>
…ds and instance types See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/AsyncDisposableStack Bug: 487347678 Change-Id: I6a0506f0e09c8597c8f24a22833083a99c0c4472 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9051797 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
getBigInt64 and getBigUin64 also take an optional second parameter which is a bool to mark if little-endian encoding should be used. Bug: 487347678 Change-Id: I352e74c7e5d74bd72f5c7ae35c8114bceba297d6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9050878 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 487347678 Change-Id: Ide8f3c5d4439981c729f14ecc96e4e54e4cfbe6f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9050879 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
This also requires some refactoring: 1) We need to extend createPrototypeObjectGroup() to also allow additional properties as BYTES_PER_ELEMENT appears on the TypedArray builtin (the constructor) and on its prototype (and due to the prototype also on any instance of such typed array). 2) Merge Uint8Array (which is somewhat special due to base64) with the other typed arrays to reduce the amount of duplication. Bug: 487347678 Change-Id: I795b16468ec9b52108dd41fee3ff54d74604df18 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9050880 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
With this change we support defining methods on classes and objects with non-identifier names, like number and string literals. Internally, all method names remain strings, reusing any type information. At lifting, we approximate simple identifiers and use them unquoted for method definition and for usage in dot notation. For definitions, we also support quoted strings and unquoted index values. At call sites, we ensure bracket notation where needed, supporting index access without quotes. This covers method names for plain objects and classes. This does not cover properties, getters and setters yet. We also add 2 custom method names to the environment that don't follow the previous identifier naming. Instructions that define such methods currently are: ObjectLiteralMethod ClassInstanceMethod ClassStaticMethod Instructions that use such methods are: CallMethod CallMethodWithSpread CallSuperMethod BindMethod We ignore definitions and calls of private methods. They also reuse the same typer logic, but naming rules are more strict here, non-identifiers are not supported and should never be produced. We need to separate now identifiers for private and other method names in the JS environment. This also extends the compiler to enable importing the new method types. Bug: 446634535 Change-Id: I2b8fbb8306e4b6bd901b61952c6da91d4210ae3f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9047716 Reviewed-by: Dominik Klemba <tacet@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
Bug: 487347678 Change-Id: I37f8126dbd08e989f229246f68675540cfc8c9f4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9052178 Commit-Queue: Danylo Mocherniuk <mdanylo@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Bug: 487347678 Change-Id: I312d4574513d40fc0ecb43218ee62dcd8eada091 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9052179 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Danylo Mocherniuk <mdanylo@google.com>
The added properties are deprecated, but in the end it matters what we ship, not if it's deprecated. Bug: 487347678 Change-Id: I3e027d8a1ece8a6bdf31929fd3952d2589cc0bfa Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9052180 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Danylo Mocherniuk <mdanylo@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
Bug: 487347678 Change-Id: I11dd214d888556ded07b3d41afe387ae5c4c79cc Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9052181 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Danylo Mocherniuk <mdanylo@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Bug: 487347678 Change-Id: I08a1e7346eb50d85832e4d4df798ba5b52348382 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9052182 Commit-Queue: Danylo Mocherniuk <mdanylo@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
Change-Id: I13e3653837dbc4502252cbe2ac25e8b4dbb7c44f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9058297 Commit-Queue: Doga Yüksel <dyuksel@google.com> Reviewed-by: Doga Yüksel <dyuksel@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Bug: 487347678 Change-Id: I5fdc080270ee713b71c46faf867a800180c1ec22 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9058836 Commit-Queue: Danylo Mocherniuk <mdanylo@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Bug: 487347678 Change-Id: I649849a5e3d9511e82e5e47a5ffc61433ca8822e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9058837 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Danylo Mocherniuk <mdanylo@google.com>
- Proxy.revocabale - Promise.withResolvers - Number.parseFloat - Number.parseInt - Object.groupBy - Object.hasOwn Bug: 487347678 Change-Id: I67c3c1c0b0d517dc61cc8a26c69031b81cf9eccc Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9058838 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Danylo Mocherniuk <mdanylo@google.com>
Change-Id: I539c771195a5c9a5242c9650815496f8c255cdba Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064096 Commit-Queue: Doga Yüksel <dyuksel@google.com> Auto-Submit: Danylo Mocherniuk <mdanylo@google.com> Reviewed-by: Doga Yüksel <dyuksel@google.com>
and add a custom generator for Intl.DisplayNames.prototype.of() as it contains a tight coupling between the constructor arguments and the code provided to the "of" function as an argument. Bug: 487347678 Change-Id: Ia0ffd3f51599b501a6855b07931249abcf777984 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9063878 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manish Goregaokar <manishearth@google.com>
Bug: 487347678 Change-Id: I92fa5d5dccfcd3b5f5590ecea134265bb10d1190 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064297 Reviewed-by: Manish Goregaokar <manishearth@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
- <Error>.name for all builtin error types - <Error>.prototype.mesage and <Error>.prototype.name for all builtin error types - ArrayBuffer.prototype.sliceToImmutable - Date.prototype.toLocaleDateString - Date.prototype.toLocaleTimeString Bug: 487347678 Change-Id: I766290ca1e2ced9556448bf31dbbd4d8f6656576 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064298 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
Bug: 487347678 Change-Id: Ib8ecc8268ef60847919abe2dc6f081665930fde3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064299 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
V8-side change: https://crrev.com/c/7623762 Bug: 487620644 Change-Id: Iee848582cf8ed19085daea8c7715bf8c3f54f3d9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064480 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Change-Id: I95e6e68e0ce4d2051f3c267667aedef63207b6c2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064377 Commit-Queue: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
There are some test-only / d8-only functions that we don't need to or don't want to fuzz. Bug: 487347678 Change-Id: Idea475a3afdf4dcba2787e497fca45580299d265 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9051197 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
There is a large amount of properties on prototype objects that can only be called on a proper instance, e.g. trying to access > DisposableStack.prototype.disposed will throw an error as DisposableStack.prototype is not the expected receiver type (unlike new DisposableStack().disposed). While the property exists on the prototype, it should not be registered as the fuzzer can't really do anything useful with something that always throws. Bug: 487347678 Change-Id: Ie8b2e5d30caa819f512d6791afb1a22d11761c7f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9058839 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
and skip their prototypes in FuzzilliDetectMissingBuiltins. Bug: 487347678 Change-Id: Ib74c990924c2b194f486c14c8578148240b9a1f5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064302 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
This test case is obsolete. For detecting missing builtins, there is now a script that can recursively scan the available global context of a JavaScript shell. Bug: 487347678 Change-Id: If785dc73fca43d693e29d1c22e345381568072bd Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064301 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
Bug: 487347678 Change-Id: I2157fdb4904c8cd5886c8cf9c3f230cab85fdd76 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9078877 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
Bug: 487347678 Change-Id: I00083540222506cfb09d7b1dfe5d040b7818a58b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9081256 Commit-Queue: Danylo Mocherniuk <mdanylo@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 445356784 Change-Id: I488149208dcda6e632ff1fc36d7c959978c3d470 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9078876 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com>
These are fixed in d8 via https://crrev.com/c/7642309. Bug: 487347678 Change-Id: I772ae90c0cee6a4c126f11d84934c132bc69c463 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9081257 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
Bug: 445356784 Change-Id: I583e24a56e0e97b589a9bd796ee7e4e23cd63d0d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9081258 Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
This flag is enabled by default and has been removed from v8 in: https://crrev.com/c/7642813 Change-Id: I442cd7dfcb0b7d457a06fb73d808285b336738fc Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9081797 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Also add DataView.prototype.setBigUint64 and its optional littleEndian parameter. Bug: 445356784 Change-Id: If49c62df8beb2c7202ad12bad58d220ca3f1a3ad Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9081796 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>
- Promise.all, Promise.race, Promise.allSettled expect a single (iterable) argument. - Date.now, Date.parse, Date.UTC don't return a Date, they return a number (the timestamp). The same applies to all the mutator / setter methods on Date.prototype. - String.prototype.localeCompare returns an integer, not a string. - String.prototype.match returns an array of matches, not a single string. - FinalizationRegistry.prototype.register doesn't return anything. - FinalizationRegistry.prototype.unregister returns a boolean (whether at least one cell was unregistered). - Reflect.getPrototypeOf, Reflect.isExtensible, and Reflect.ownKeys throw a TypeError if passed a primitive value, so type them as requiring an object. - DataView: The multi-byte getter and setter methods were missing the optional littleEndian boolean parameter. - Math.max and Math.min return a number (which might be NaN). - Object.assign, .defineProperty, .defineProperties and .freeze all return the object. - Array.fill, .reverse and .sort return the passed (modified) array. - The same is true for the typed arrays (Int8Array and friends). Change-Id: I1c96b03f3303aad8868a13102b6675126bcc3997 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9087136 Reviewed-by: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
Test cases that use OSR currently only do this through --jit-fuzzing triggering OSR in loops, often leading to brittle repros like the referenced bug. This creates a typical pattern in a code generator making use of the %OptimizeOsr() runtime function. Bug: 490353576 Change-Id: Id09459d8f7ba26a1b0eaec7e438de555b22fc7b5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9087056 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
Moves the randomness of the sandbox corruption engine from the JavaScript runtime to the Swift program generator. Functional changes: - Splits the monolithic `corrupt(obj, seed)` JS payload into modular entry points: `corruptDataWithBitflip`, `corruptDataWithIncrement`, `corruptDataWithReplace`, `corruptWithWorker`, and `corruptFunction`. - Replaces JS recursion with deterministic `pathArray` tuples generated by Fuzzilli, explicitly passing required entropy seeds (e.g., `[[Step.POINTER, offsetSeed], [Step.NEIGHBOR, hashQuery]]`). - `corruptFunction` evaluates the entire traversal path first and only hijacks the function if the final target is a JSFunction. - `corruptWithWorker` only sets up a background flipping race condition. - Operations, sizes, bit positions, sub-field offsets, and BigInt increment values are now calculated natively by Fuzzilli and passed to JS as explicit arguments. - Deletes the JS `Mutator` and `RNG` classes entirely, rendering the JS payload completely state-free. - Adds startup tests to explicitly verify the parser and read-only safety logic for all new corruption entry points. Bug: 490512258, 490522975 Change-Id: Ia4459efa2526ecd46aa6db441657905c057e1e37 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9053496 Reviewed-by: Michael Achenbach <machenbach@google.com> Auto-Submit: Dominik Klemba <tacet@google.com> Commit-Queue: Dominik Klemba <tacet@google.com>
Changes the failure rate for LiveTests.testWasmCodeGenerationAndCompilationAndExecution from 25% to 35%. This threshold should be reduced again once ref.cast is properly handled. Change-Id: I92938e5c58ce6171627cc003a13d5344c9cafe70 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9087656 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Dominik Klemba <tacet@google.com> Commit-Queue: Dominik Klemba <tacet@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Change-Id: I28783d963f1ac4678f2e2cdd170f9a8c5182e299 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9091116 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Michael Achenbach <machenbach@google.com>
and support iterables in OptionsBags. Iterator.zip was added to V8 with https://crrev.com/c/7605659. Bug: 465357675 Change-Id: Ia5e5c49831f8ad10c166bb32a264ee90a1aadead Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9090936 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Olivier Flückiger <olivf@google.com> Commit-Queue: Nikos Papaspyrou <nikolaos@google.com> Reviewed-by: Nikos Papaspyrou <nikolaos@google.com>
…codes` Include `--private_field_bytecodes` with a 0.5 probability. Include `--proto_assign_seq_lazy_func_opt` with a 0.5 probability in fuzzili. This flag does imply the flag it replaces. Seq count is fixed to 1 to stress the pattern. Bug: 449885256 Bug: 474269456 Change-Id: I4e9928c2c3b23ebc129bfae67d06dc286a8dfba7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9095116 Reviewed-by: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Change-Id: I9f2aedf60a7d3d8eec7011243e6ddac5af94aa74 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9099036 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Darius Mercadier <dmercadier@google.com>
Same as commit 226938a but now for the tail call variant (in preparation for using wasm-gc signatures for wasm functions.) Bug: 445356784 Change-Id: I5b2501b45a4a3f7e15c8814008d2d6d5bc9a9974 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9108116 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Manos Koukoutos <manoskouk@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Currently, when Fuzzilli fails to execute a script via the REPRL protocol (e.g., if the target fails to launch and send the HELO message, or crashes unexpectedly), the resulting error message is opaque (e.g., "Did not receive HELO message from child: Bad file descriptor"). Fuzzilli already captures the target's stdout and stderr in memory-mapped files by default, this change extracts those buffers and appends them to the Fuzzilli warning and error logs whenever `reprl_execute` fails. This surfaces the actual crash dump, missing dependencies, or startup errors directly in the logs, making debugging broken targets locally or on bots significantly easier. Bug: 492209808 Change-Id: If94fc9eadc97645ab240f648b7e6cf42378d091e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9095283 Auto-Submit: Giovanni Ortuño Urquidi <ortuno@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
V8 has lots of optimizations around smi ranges (e.g. untagging smis). Change-Id: I1393d1c30a61ef43d45f3ede4a74e6fe0b6c0e2d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9111056 Reviewed-by: Darius Mercadier <dmercadier@google.com> Commit-Queue: Darius Mercadier <dmercadier@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Bug: 445356784 Change-Id: I0eb33e4e3f800919b5c92bf6ce48ded45d372ac5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9108176 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bug: 491410818 Change-Id: I400fbd530f32c3a8ee2c16cd71c73d24adf43357 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9110957 Commit-Queue: Darius Mercadier <dmercadier@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
This works around false positives in connection with code referring to `f.arguments` in differential fuzzing. We now suppress any access to the `arguments` property and instead reject such samples. This has only an effect in differential fuzzing and is a no-op otherwise. We don't really care if the receiver actually is a function, and instead over-approximate this slightly. This might cover weird other ways of transferring the arguments to another object with `o.__proto__ = f`. Bug: 490382714 Change-Id: Ia7e78a6708f4d0db4c1ba671cfd279db8f57b70e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9102176 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Profiles moved from FuzzilliCli/Profiles to Fuzzilli/Profiles. BunProfile.swift moved and import adjusted. .github/workflows/swift.yml reverted (OAuth lacks workflow scope; upstream changes were trivial -v flags and apt update).
alii
force-pushed
the
disable-ffi-and-sync-upstream
branch
from
358c3b5 to
a61ae38
Compare
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (4)
Disabled knowledge base sources:
WalkthroughAdds WebAssembly GC reference-cast support, updates protobuf schemas for Wasm calls, broadens JavaScript environment and profiling API visibility, introduces a post-processor rejection path, improves lifter/compiler/generator support for non-identifier method keys and Intl.DisplayNames, adds tooling to detect missing builtins, and includes many tests and utilities updates. Changes
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges googleprojectzero/fuzzilli main (60 commits).
Main relevant change: profiles moved from
Sources/FuzzilliCli/Profiles/intoSources/Fuzzilli/Profiles/(now part of the library). BunProfile.swift moved andimport Fuzzillidropped accordingly.Other upstream highlights:
FuzzilliDetectMissingBuiltinstool.github/workflows/swift.ymlis reverted to our version (OAuth lacks workflow scope; upstream changes were just-vflags andapt update— trivial).Includes the FFI fix from #6 as a parent commit — if #6 merges first this diff will only show the sync.