[heap] Turn on fuzzing for --no-use-map-space

Turn on fuzzing for disabled map space to get additional test coverage.

Bug: v8:12578
Change-Id: I82c577c8c24b51df627c873fde95fb239e16d36f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3592892
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80012}

tools/clusterfuzz/foozzie/v8_fuzz_flags.json

@@ -31,5 +31,6 @@
   [0.1, "--no-wasm-generic-wrapper"],
   [0.1, "--turbo-force-mid-tier-regalloc"],
   [0.0001, "--simulate-errors"],
-  [0.25, "--compact-maps"]
+  [0.25, "--compact-maps"],
+  [0.25, "--no-use-map-space"]
 ]

tools/clusterfuzz/trials/clusterfuzz_trials_config.json

@@ -23,6 +23,7 @@
     {"app_args": "--no-regexp-tier-up", "app_name": "d8", "probability": 0.2},
     {"app_args": "--no-untrusted-code-mitigations", "app_name": "d8", "probability": 0.1},
     {"app_args": "--no-use-ic", "app_name": "d8", "probability": 0.25},
+    {"app_args": "--no-use-map-space", "app_name": "d8", "probability": 0.25},
     {"app_args": "--no-wasm-generic-wrapper", "app_name": "d8", "probability": 0.1},
     {"app_args": "--regexp-interpret-all", "app_name": "d8", "probability": 0.1},
     {"app_args": "--simulate-errors", "app_name": "d8", "probability": 0.001},

tools/testrunner/testproc/fuzzer.py

@@ -38,6 +38,7 @@ EXTRA_FLAGS = [
     (0.1, '--no-liftoff'),
     (0.1, '--no-opt'),
     (0.2, '--no-regexp-tier-up'),
+    (0.25, '--no-use-map-space'),
     (0.1, '--no-wasm-tier-up'),
     (0.1, '--regexp-interpret-all'),
     (0.1, '--regexp-tier-up-ticks=10'),