base fuzzili update - #52

This adds a CodeGenerator for generating a set of homomorphic objects,
and a ProgramTemplate for optimizing a function which has seen
homomorphic objects.

Change-Id: Iac8a52c4a021f48ee74bbe24f545b62fa7305697
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9278060
Commit-Queue: Marja Hölttä <marja@google.com>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>

This CL adds support for the br_on_non_null instruction.

Bug: 474940922
Change-Id: I485b7b49e5c036acb29d55acfadaa707a6bf5664
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9274500
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Leon Bettscheider <bettscheider@google.com>

… OperationMutator

Bug: 342521422
Change-Id: I64b68d2b3e5aa78b329d56494a76f9caac626480
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9278600
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Marja Hölttä <marja@google.com>

To support assumptions regarding the typing of a `jsMap`'s elements,
this CL makes `jsMap` optionally parametrizable through the
`createJsMapType` function. This CL also introduces a `CreateMap`
operation that persists the key and value type arguments for the map.

This CL avoids introducing type serialization for the type arguments,
storing the type group names instead.

Parameterized iterables details:
cc0ff34

Bug: 510424762
Change-Id: I570fb962dc027d48e222acc62b85609cd1048d15
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9274841
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Tigran Bantikyan <bantikyan@google.com>

This CL includes outputs in the IL, similarly to how we
already do for WasmBranchOnNull. So they won’t be
dropped, but spilled.

We also don't drop outputs of WasmBranch now, as this
code is unreachable.

Change-Id: I7b6e9ee6a1bb91aa23dab5e68cf0237742f073ef
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9273901
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Leon Bettscheider <bettscheider@google.com>

as this can cause issues with variable visibility. (assert only)
Ad-hoc signatures exist so that we are always able to generate e.g.
a wasm function definition even if we are already in the .wasm context
and therefore can't emit a wasm type group any more (which are only
allowed in the .javascript context).

However, these signatures are there for that wasm function then, not
to use them as element types as part of other types (e.g. another
ad-hoc signature for a Wasm tag definition as such a tag can be
exported and reimported by a different module and then a throw of that
tag might need to create a value of the element's type (which is the
other ad-hoc signature that was only visible in the first Wasm module.)

Bug: 445356784
Fixed: 508306801
Change-Id: Idf10b4093913dc252dbead329fad7d54ff46615d
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9267281
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

With this change wasm functions can finally include wasm-gc index types
in their parameter and result types.

Bug: 445356784
Change-Id: I9a57724206d853218624fb8dcfa916169b82a573
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9197816
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Leon Bettscheider <bettscheider@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@google.com>

in block arugments. All usages have been adapted to using wasm-gc
signatures and therefore allow indexed wasm-gc types.

Bug: 445356784
Change-Id: I9db52423e11f5658c7ed20870d51d867eb17c573
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9288584
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@google.com>

Add support for CreateMap operations in VariadicInputReducer,
OperationMutator, and MinimizationPostProcessor.

Fixed: 510424762
Change-Id: Ia7fc6c70922dac8f265746895b0a6894611437d6
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9289344
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Tigran Bantikyan <bantikyan@google.com>

The flag was removed in:
https://crrev.com/c/7840605

Change-Id: I49e417d602fc6a6fd40e2ca852dc4c7965e84ff3
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9305241
Auto-Submit: Michael Achenbach <machenbach@google.com>
Reviewed-by: Clemens Backes <clemensb@google.com>
Commit-Queue: Clemens Backes <clemensb@google.com>

Bug: 447125167
Change-Id: I694c2feac0d42f1afb47f3ec2e9c94b2401382fe
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9279080
Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

Bug: 447125167
Change-Id: Ifa7899b5e12a30718f64ccac36e693aa91020e5d
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9288582
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com>

This flag used to be always set in fuzzers due to the implication from
`--fuzzing`, but the implication is removed now (crrev.com/c/7845199).
Hence randomize it with high probability (still not 100% to avoid having
blind spots), except for sandbox fuzzers where it'd not bring any benefit
due to them ignoring CHECKs.

Bug: 475707969
Change-Id: Ia8a495af600acc40dcd188fc1726e1e039237c79
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9310081
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Maksim Ivanov <emaxx@google.com>

Add support for handling CreateArray operations with the
`elementGroupName` property set in OperationMutator and
MinimizationPostProcessor.

Bug: 503429420
Change-Id: I29170419cda15d9a73d0a9ad43aaa2ebd0322081
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9293280
Commit-Queue: Tigran Bantikyan <bantikyan@google.com>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>

Add randomized addition of --no-flush-bytecode, to occasionally test
this non-production scenario.

Don't explicitly add --flush-bytecode: it's the default value anyway,
and it didn't help to reenable it when flag implications (--jit-fuzzing
to --no-flush-bytecode) disable it.

Bug: 475707969
Change-Id: Ia2c2141430f222f6c3d7c4cb946762c725c65204
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9278461
Commit-Queue: Maksim Ivanov <emaxx@google.com>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>

Bug: 514576448
Change-Id: I5b818576409d654a039edac6dbcfa959352018aa
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9296863
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Marja Hölttä <marja@google.com>
Auto-Submit: Raphaël Hérouart <rherouart@google.com>

Bug: 514576448
Change-Id: I4f0236055f21611a582fef526a721e13f58ca2f9
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9310040
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Marja Hölttä <marja@google.com>
Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Auto-Submit: Raphaël Hérouart <rherouart@google.com>

Bug: 445356784
Change-Id: I3a07fe4d292dd5b988c655936e0abd889338cbe8
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9310720
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

This CL adds the `selectionMode` property to the `OptionsBag` struct to
configure how `OptionsBag` selects the properties for the object literal
it generates. The default behavior is preserved with the `anySubset`
case. The new `exactlyOne` case configures `OptionsBag` to select
exactly one property for the object literal.

This CL also makes  `OptionsBag` easily usable in profiles by adding an
`additionalOptionsBag` property to the `Profile` struct and by removing
the strict assert on the supported `OptionsBag` properties array.

Bug: 512875834
Change-Id: I6b6348f515cc736ee281af9c9e384ac93eaf762c
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9311541
Commit-Queue: Tigran Bantikyan <bantikyan@google.com>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>

Bug: 514576448
Change-Id: I7d2b1580b49211e1ec184f78798588eb7b4ea6ca
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9313600
Reviewed-by: Michael Achenbach <machenbach@google.com>
Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Reviewed-by: Marja Hölttä <marja@google.com>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>

Bug: 514906333
Change-Id: Ib94a058c73bab07f1b9292e102439af847593006
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9310083
Reviewed-by: Leon Bettscheider <bettscheider@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

…tions

TAG=agy
CONV=0a8bad59-c896-4fbd-925a-620838620623

Change-Id: I82d1eafe22df70aa455b98d0de8795820398a08c
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9320640
Reviewed-by: Raphaël Hérouart <rherouart@google.com>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Marja Hölttä <marja@google.com>

BUG=515494290
TAG=agy
CONV=3987abe0-de45-4002-95ae-4f62b5e0cf10

Change-Id: I0324d4ef618f2bae310eb392ddff5aa3b71b9c0d
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9320641
Commit-Queue: Marja Hölttä <marja@google.com>
Reviewed-by: Michael Achenbach <machenbach@google.com>

Bug: 515363087
Change-Id: I06060612d8eee9bf783a849352435c5b4bf9c893
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9317280
Auto-Submit: Raphaël Hérouart <rherouart@google.com>
Reviewed-by: Marja Hölttä <marja@google.com>
Reviewed-by: Michael Achenbach <machenbach@google.com>
Commit-Queue: Raphaël Hérouart <rherouart@google.com>

1) Hide variables outside the worker function so that the function
doesn't use them.

2) Make the main thread wait for the worker to finish.

Fixed: 497549860
Change-Id: If3b22fae7e61cca33b1c55fbfab3fcf9f5f6abaf
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9282445
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Marja Hölttä <marja@google.com>

Previously, randomWasmTypeDef() would only return type definitions
of non-ad-hoc signatures.
With this fix, it should also return array and struct type definitions.

Bug: 445356784
Change-Id: I6b131c42e61c17771fa211c213d64456b964bdb5
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9320520
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Leon Bettscheider <bettscheider@google.com>

This CL adds support for the br_on_cast instruction.

Bug: 474940922
Change-Id: Iadb552b42b1c721d0b5c462afda75aff91bb4791
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9300280
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Leon Bettscheider <bettscheider@google.com>

Support for "import * as ns" import syntax, including the deferred
import variant. Other imports (named, default, etc.) are future
work.

https://github.com/tc39/proposal-defer-import-eval

Bug: 398218423
Change-Id: If0e691054f0668cd4eed2bbdc9532b0c520fec4a
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9313400
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Olivier Flückiger <olivf@google.com>

This CL adds descriptor and describes clauses to struct
types.

WasmCustomDescriptorsStructTypesGenerator is disabled
until we add the new instructions and subtyping.
Otherwise, we would generate many invalid programs and
LiveTests would fail.

Bug: 502246833
Change-Id: Ic19fc508686944563a8b96419982007c2c4a3123
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9643576
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

While this doesn't matter for actual fuzzer runs as they create a single
Fuzzer object per thread, this can be an issue for LSAN reports of test
cases as they each create a new fuzzer instance.

Change-Id: I4fa0020f14db0411b55094d56243f6f4117137f7
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9650455
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

Change-Id: I167b86107cbe2f529299e37503a8242b2e3bb1a4
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9650456
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>

Change-Id: I2b209b10c55b412dc77f1c1ecd92bffaa73733b9
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9659015
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

This CL adds subtyping for custom descriptor struct types.

Bug: 502246833
Change-Id: Iecc1643b336411e6320769385ebc663e66b380e6
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9650235
Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>

This might slightly increase the chance of ending up either explicitly
(e.g. via CallFunction vs. CallMethod on the exports object) or
implicitly (e.g. via passing it into some builtin that uses it as a
callback) executing the chosen Wasm function.

Bug: 498924945
Change-Id: I02374a64daa0785e96a8257e40ecbf1db4bccb01
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9665016
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

Fuzzilli itself doesn't generate ref.cast_desc_eq instructions, so
this can only be found by the Binaryen integration.

Corresponding V8 change: https://crrev.com/c/8236732

Bug: 498924945
Change-Id: Ibb9b6e66efacc283ef68288024acedfbeb909a01
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9666335
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>

as well as the wrong logic in subsumes().

Bug: 408162715
Change-Id: Id00203eb36429f0fc85267ec1bf04112573165fa
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9665436
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>

A nil receiver type means that we lost all type information about the
receiver (e.g. because the receiver resolved to .nothing) indicating
that there isn't any receiver for which we'd know that calling this
unbound function would be safe.
We change the generators to always emit a guard in these probably rare
cases.

Bug: 408162715
Change-Id: If56a706fffdedb3ea69327667035104fd0cf1ff5
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9670675
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

without visible JS variables.

TAG=agy

Change-Id: If6204cad1dd4bd6e80f747c69cf22c78f7ffb4cb
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9673595
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>

In JavaScript, optional chaining (`?.`) on the left-hand side of an
assignment is disallowed by static early error rules:
https://tc39.es/ecma262/#sec-static-semantics-assignmenttargettype

Previously, lifting a guarded SetPrivateProperty instruction emitted
`obj?.#prop = val;`, producing an uncatchable parse-time SyntaxError.
This change aligns SetPrivateProperty with SetProperty and
UpdatePrivateProperty to always emit standard member access
(`obj.#prop = val;`) on the assignment target.

Change-Id: Ibf8b83d2442dfe5b538e450c05fad9ce00f359d6
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9672675
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Michael Achenbach <machenbach@google.com>
Reviewed-by: Michael Achenbach <machenbach@google.com>

Change-Id: I3b0d3d55b213aecc94cb0e12843b7c2572a26cd5
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9672975
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

https://developer.mozilla.org/en-US/docs/WebAssembly/Reference/JavaScript_interface/validate_static#return_value

Change-Id: I413cd116d66f3f2912f87f9e83bdc0440931006d
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9673596
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

.. and enable acquire-release-atomics flag.

Bug: 498924945
Fixed: 535260641
Change-Id: Id4f863c74b540d1879bb324e10a1cca8939588d2
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9673715
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Auto-Submit: Rezvan Mahdavi Hezaveh <rezvan@google.com>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>

Change-Id: I90e62d7e7d6805e98ad869d746967682dd421c7a
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9678017
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Michael Achenbach <machenbach@google.com>
Reviewed-by: Michael Achenbach <machenbach@google.com>

- Fix empty method name in Duration construction ("from")
- Fix argument count for PlainYearMonth and PlainMonthDay constructors
- Fix malformed subsecond separator in UTC offset strings
- Fix PlainMonthDay.prototype.with returning PlainYearMonth instead of
  PlainMonthDay
- Fix PlainMonthDay.prototype.equals accepting PlainYearMonth parameters
- Fix Duration.prototype.total return type to number instead of Duration
- Fix ZonedDateTime.prototype.getTimeZoneTransition returning
  Instant | nullish
- Remove duplicate "auto" entry in jsTemporalUnitEnum

Change-Id: If94ec911e1966d97cb7bd64c9c9533429081f958
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9678375
Commit-Queue: Manish Goregaokar <manishearth@google.com>
Reviewed-by: Manish Goregaokar <manishearth@google.com>

In JSTyper, async class and object literal methods previously
defaulted to returning .jsPromise() (resolvingTo: .jsAnything).

This change aligns async methods with standalone async functions by
inferring the promise resolving type from the method's return value:
`.jsPromise(resolvingTo: resultType.returnType.promiseResolvingTo)`.

TAG=agy

Change-Id: I9ab1e4dace9a9d04d7dc6c7fb915a3a18b2558a2
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9676859
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Michael Achenbach <machenbach@google.com>
Commit-Queue: Michael Achenbach <machenbach@google.com>

1. Fix String.prototype.trim return type to .jsString.
2. Register missing OptionsBag.jsTemporalDurationCompareSettings in
   init().
3. Fix Object.entries return type to .jsArray.
4. Fix Intl.Locale numeric property to .boolean, and getTextInfo return
   type to .object(withProperties: ["direction"]).
5. Update constructor callabilities: Function to .functionAndConstructor
   and Temporal / Intl constructors to .constructor.
6. Make parameter optionality conform to spec for Object.create,
   Array.prototype.sort, Array.prototype.join, and Date.prototype.set*.
7. Synchronize globalThis property registration with
   globalThisGroup.instanceType in finalizeGlobalThisGroup().
8. Fix duplicate enum assertion message in registerObjectGroup().
9. Make TypedArray.prototype.join and TypedArray.prototype.sort
   parameter optionality conform to spec.
10. Update Date.prototype.setHours and Date.prototype.setUTCHours to
    support optional 4th milliseconds argument.

TAG=agy

Change-Id: I4b787be0ae8a82c71290452d9ac3466b87b03635
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9677317
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>

and mark one more "join" method's separator parameter as optional.

Change-Id: I253e9d0f50fc7f63b27a2d57c885c12acedd51a2
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9682955
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

This reverts commit 60a81c6.

Reason for revert: experiment finished

Original change's description:
> [v8] Introduce unsafe flag for binaryen integration evaluation
>
> Fuzzilli itself doesn't generate ref.cast_desc_eq instructions, so
> this can only be found by the Binaryen integration.
>
> Corresponding V8 change: https://crrev.com/c/8236732
>
> Bug: 498924945
> Change-Id: Ibb9b6e66efacc283ef68288024acedfbeb909a01
> Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9666335
> Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@google.com>
> Auto-Submit: Matthias Liedtke <mliedtke@google.com>

Bug: 498924945, 546884393
Bug: 498924945
Change-Id: Ic89faeef0e298c5ee9daa9598c723ae774b7aa22
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9686395
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com>

…e mutation

Before this change, private property generators had ~0.19% invocation success rate because referencing an undeclared private field (#foo) inside a class is a SyntaxError that cannot be caught by runtime try-catch blocks. Hence, rather than emitting invalid code, the Generators were returning without generating any instruction.

1. Extended ILType.object(...) to track privateProperties and privateMethods
2. When private member generators run inside a class method before properties are declared, referenced names are recorded and automatically emitted at EndClassDefinition(). This eliminates syntax errors and raises private generator success rates to 100.00%.
3. Updated OperationMutator selecting valid private members from scope for mutations.

Bug: 534650967
Bug: 522217077
Change-Id: I6c1ce14c58559c959866ecafab050435f76f44c8
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9614016
Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Reviewed-by: Michael Achenbach <machenbach@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>

- Temporal.Instant.from and Temporal.Duration.from do not accept an
  options bag. Update temporalFromSignature to emit 1-parameter
  signatures when settingsArg is nil.
- Explicitly pass settingsArg: jsTemporalOverflowSettings for PlainTime,
  PlainYearMonth, PlainMonthDay, and PlainDate from() overloads.

Change-Id: I4dfbf7cddf10c99d35abc436dc8d4e3203f5d9df
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9678376
Reviewed-by: Manish Goregaokar <manishearth@google.com>
Commit-Queue: Manish Goregaokar <manishearth@google.com>

Bug: 529283573
Change-Id: I894b4391d2465421b44e3a0d277c5e4015a2b84e
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9694915
Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>

Bug: 498924945
Change-Id: I5da4f0dfc050d389bdc5168bc45d67f3d530b262
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9699455
Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com>

Currently, only --wasm-features=custom-descriptors is supported.

This will allow to enable custom descriptors related code, including
lifting "exactness", selectively.

Bug: 502246833
Change-Id: I4272a7e06555303ccd134c74c6121ee236ab19f6
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9680135
Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>

This CL makes the output of the existing instructions
	wasmArrayNewFixed
	wasmArrayNewDefault
	wasmStructNew
	wasmStructNewDefault
	wasmRefFunc
	wasmRefNull
exact, depending on the “enableCustomDescriptors” config.

It also adds support for lifting the “exact” property to Wasm Code, adjusts subtyping for exact types, and supports exact index-typed globals.

Bug: 502246833
Change-Id: I7098977f0b16d6372e5d3106d7c711ea8a1fa410
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9665935
Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>

However, they won't get generated by the fuzzer yet because
`WasmCustomDescriptorsStructTypesGenerator` is not enabled until
all instructions and generators are implemented and adapted.

Bug: 502246833
Change-Id: Iee0d7d179a9fbf6d6ac0484eb0fc3dbba5df892c
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9670676
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

This CL makes the `indexTypes` parameter of `wasmDefineStructType()`
default to []. This cleans up the code a bit.

Change-Id: I492c2802041afeb4432293c5a4a27e84db51bc6a
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9673597
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

Bug: 515363087
Change-Id: I044310fb22e58953207c45e1b160e2719e639f4e
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9691916
Commit-Queue: Raphaël Hérouart <rherouart@google.com>
Reviewed-by: Michael Achenbach <machenbach@google.com>