Test: fuzz exact semantics across every execution tier and backend

[chrisbbreuer]

Parent: #459
Depends on: #465–#490 as their surfaces land

Goal

Continuously prove that interpreter, VM, baseline JIT, optimizer, and Wasm native tiers are semantically identical across optimization plans, GC timing, no-GIL schedules, and declared architectures.

Scope

• Build owned seeded generators for JavaScript source/bytecode shapes, Wasm modules/functions, objects/arrays/typed data, closures/environments, exceptions/finally, async/generators, modules, GC roots, atomics, and host callbacks.
• Execute the same case with tree-walker, VM, baseline, optimizer, Wasm interpreter/baseline/optimizer, GC modes, serialized/no-GIL, and applicable backend feature sets forced on/off.
• Compare result bits/types, exception name/message/metadata, observable mutations/order, output, steps/watchdog, jobs/microtasks, tier counters, GC relocation, memory bytes, and teardown.
• Randomize tier thresholds, invalidation/deopt timing, collection/safepoints, allocation failure, thread schedule points, CPU features, and code-cache pressure deterministically.
• Shrink failures to one reproducible seed/source/module and retain corpus regressions.

No-workaround rules

• No permanent suppressions, flaky retry-until-pass, result-only comparison, unsupported path counted as a tier success, or seed blacklist without a terminal documented semantic disposition.
• The generator and shrinker remain owned code with no external fuzz runtime dependency.

Acceptance

• Every new native/optimizer opcode, IR operation, backend, recovery outcome, and runtime fast path adds generator coverage before release.
• Normal, ReleaseSafe, TSan, moving-GC, no-GIL, OOM/fault, debugger/termination, and lifecycle profiles have bounded deterministic CI witnesses.
• Longer scheduled runs publish seed/rate/coverage inventories and retain every actionable minimized failure.
• Cross-architecture traces can be compared without claiming emulated performance.
• Zero unexplained skips/suppressions and exact denominator sanity checks are enforced.

Foundation

Existing threadfuzz, seeded optimizer differentials, test262, PR-249, Wasm corpus inventories, and forced enable_jit controls.

[chrisbbreuer]

Forced-tier differential infrastructure landed on main in cff13e9f.

Context.TestingOptions.bytecode_execution_mode now provides two explicit harness contracts: tree_walker suppresses plain synchronous bytecode, while required throws InternalError when a program or called plain function lacks compiled bytecode. Required mode therefore cannot count a silent fallback as VM coverage. Production contexts remain automatic.

Initial exact witnesses execute identical closure/property/array/loop source in both modes and compare result bits plus externally visible state. A second pair compares unhandled exception class/message and the mutation committed before the throw. Admission counters prove the intended tier in each context, and a parameter-prologue rejection fixture proves unsupported lowering fails closed.

Validation: focused Debug and TSan; full sharded unit suite 1,474/1,474 with 0 leaks; BunPress manifest/build and 89-file docs link gate. Flips 0 test262 cases.

This is the execution-control foundation, not completion of the issue: seeded source/module generation, shrinking, GC/schedule/fault randomization, and broader tier/backend matrices remain open.

[chrisbbreuer]

The forced-tier matrix expanded on main in 28b00703.

Tree-walker vs required-bytecode execution now compares exact result bits and observable traces for catch/finally, class construction, private method branding, and object-method super, including a second super lookup after a nested method activation returns. Admission counters continue to prove both paths, and derived/field-initializing constructors fail closed with an exact reason rather than masquerading as VM coverage.

The exact-parent test262 differential was used as an active bug finder: it exposed 528 missing-private-brand failures and 2 unresolved computed-private-key failures during development. Both were fixed before landing; final class statements are 4,367/4,367 and object expressions 1,170/1,170 in baseline and candidate, with zero gains or regressions.

This adds deterministic scope/activation coverage to the foundation. Seeded generation, shrinking, fault/schedule randomization, and the broader native/Wasm backend matrix remain open.