Commit Graph

146 Commits

Author SHA1 Message Date
Michael Achenbach
9c5108c83e [foozzie] Disable --multi-mapped-mock-allocator for correctness fuzzing
No-Try: true
Bug: chromium:1337522
Change-Id: I086cec1209d6646441f128d9de9493987fc49490
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3711754
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81236}
2022-06-20 08:40:37 +00:00
Dominik Inführ
5b73adc2fe [tools] Enable --no-use-map-space again on fuzzers
--no-use-map-space should now be fixed, it is already enabled with
--future.

Bug: v8:12578, chromium:1317880
Change-Id: I9ea10dfaebf7b17cb1c953e272bc3358932a10b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3702232
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81173}
2022-06-15 09:20:22 +00:00
Michael Achenbach
40d2fab61c [foozzie] Disallow flags with too many known failures
This filters the flags --maglev and --no-use-map-space when passed to
foozzie. Most open bugs are known or spurious, but all take up the
limited hashes for correctness bugs, which prevents finding other
bugs. Filtering on the source-side will make those reports appear
as fixed.

Bug: chromium:1324097, chromium:1317880
Change-Id: Ibf1b04bdfdd2395c3bda5787b4843c6bb5ca8f8e
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3641171
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80468}
2022-05-11 12:22:22 +00:00
Michael Achenbach
7e9715d8a9 Revert "[maglev] Turn on fuzzing for --maglev"
This reverts commit b8b7a3a2f9.

Reason for revert:
https://crbug.com/1324097
https://crbug.com/v8/12859

Let's maybe only reland the clusterfuzz_trials part until the rest
is sorted out.

Original change's description:
> [maglev] Turn on fuzzing for --maglev
>
> Turn on fuzzing for Maglev to get additional test coverage.
>
> Bug: v8:7700
> Change-Id: I5b72d851639e31dff1bd91361cd81ad448c2d69e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629334
> Auto-Submit: Jakob Linke <jgruber@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80416}

Bug: v8:7700, chromium:1324097, v8:12859
Change-Id: I926319988c3b9a2bc6dd083c69691a6536838782
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634963
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80440}
2022-05-10 08:01:14 +00:00
Jakob Linke
b8b7a3a2f9 [maglev] Turn on fuzzing for --maglev
Turn on fuzzing for Maglev to get additional test coverage.

Bug: v8:7700
Change-Id: I5b72d851639e31dff1bd91361cd81ad448c2d69e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629334
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80416}
2022-05-09 09:22:14 +00:00
Camillo Bruni
e3e8ea5d65 [flags] Rename --opt to --turbofan
To be consistent with the all the other tiers and avoid confusion, we
rename --opt to ---turbofan, and --always-opt to --always-turbofan.

Change-Id: Ie23dc8282b3fb4cf2fbf73b6c3d5264de5d09718
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610431
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80336}
2022-05-03 12:10:30 +00:00
Michael Achenbach
2056305c75 [foozzie] Drop unsuitable flag from correctness fuzzing
Using this flag has led to several duplicate issues. We need to stop
using the flag for a while until the issues are investigated.
Potentially these are all false positives.

No-Try: true
Bug: chromium:1317880
Change-Id: I09f4e1c642befc3a8f5b88c2eb003931dc112826
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602508
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80114}
2022-04-22 13:48:26 +00:00
Dominik Inführ
394812a603 [heap] Turn on fuzzing for --no-use-map-space
Turn on fuzzing for disabled map space to get additional test coverage.

Bug: v8:12578
Change-Id: I82c577c8c24b51df627c873fde95fb239e16d36f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3592892
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80012}
2022-04-19 08:56:07 +00:00
Michael Achenbach
307e30c1eb [foozzie] Fix arguments in wrapper
No-Try: true
Bug: chromium:1288926
Change-Id: Ie28021a34649aeaa68c34252ffe181163a7df2ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568466
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79740}
2022-04-04 12:31:29 +00:00
Michael Achenbach
dfe465d1ba [foozzie] Switch wrapper to Py3
No-Try: true
Bug: chromium:1288926
Change-Id: I05402b802f6d17dfea1211a682d3ed38f83e5aeb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3565722
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79726}
2022-04-04 08:30:06 +00:00
Al Muthanna Athamina
95a85701fd Allow V8 to run all unittests presubmit
Search for all files with testing naming convention and run that on v8_presubmit.
Also modify all PRESUBMIT files in the tools directory to include any test file
with the appropriate naming convention.

Bug: chromium:1306474
Change-Id: I61c1b7c71badbbc3b99705289588aa8280824d66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532266
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79651}
2022-03-29 11:14:09 +00:00
Marja Hölttä
3a43f6552e [fuzzing] Re-enable fuzzing for staged harmony features
The fuzzers were passing the flag --es-staging which doesn't exist. This
CL updates them to pass the flag --harmony which does exist.

Change-Id: I02c83026e5b9bdf49e51e700f16702bf56cd49e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3522064
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79464}
2022-03-14 16:06:04 +00:00
Tamer Tas
a513793048 [infra] migrate simple PRESUBMIT scripts to py3
R=machenbach@chromium.org,alexschulze@chromium.org

Bug: chromium:1298869
Change-Id: I1ef1ac1d48ccbea81cfebcc360194f5003da17d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474672
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Auto-Submit: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79171}
2022-02-18 13:43:30 +00:00
Dominik Inführ
2b63d5d093 [heap] Add flag for disabling map space
Now that we are able to compact map space, we can also get rid of the
map space and allocate maps in the old space instead. This CL introduces
a FLAG_map_space for enabling/disabling the map space but the map space
remains enabled by default for now.

Without a separate space for maps, the GC can't prevent relocation of
maps anymore. Therefore this CL always allows compaction of maps when
running without a map space. Rename flag to --compact-maps to better fit
this scenario.

mkgrokdump and debug_helper also need to be updated to look for maps
also in the old space. The map space is now optional.

Bug: v8:12578
Change-Id: Ic4e4abd0b58bee26e64329b1c92dbccb07d8105a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3424483
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79165}
2022-02-18 09:03:07 +00:00
Jakob Gruber
c9d003f807 Consistent names for --interrupt-budget flags
1. feedback_vector_allocation -> feedback_allocation like elsewhere.
2. A consistent --interrupt-budget prefix.
3. Remove the on-by-default --feedback-allocation-on-bytecode-size.

Bug: v8:7700
Change-Id: I1d0af11e89398973a65bf9cb7c7722740d9452ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463718
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79097}
2022-02-15 11:54:58 +00:00
Michael Achenbach
171fb3b9af [clusterfuzz] Split directory structure
After https://crrev.com/c/3416191 there are too many mixed concerns in
the clusterfuzz directory. We split it into js-fuzzer, foozzie and
trials.

Change-Id: I9a21ee83985e6113d77acba4583e99df88723c60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3443505
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78981}
2022-02-07 15:38:46 +00:00
Dominik Inführ
a6843b1370 [heap] Turn on fuzzing for map space compaction
Turn on fuzzing to get additional test coverage.

Bug: v8:12578
Change-Id: Ia614fb9e4ba519163024f3b7b40f22ad6ebb3297
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3442677
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78977}
2022-02-07 13:49:35 +00:00
Al Muthanna Athamina
5e294b1741 Add clusterfuzz trials config file with presubmit checks
We can now specify the trials for clusterfuzz using the file
clusterfuzz_trials_config.json. There is also a presubmit check
to make sure that it is formatted correctly.

Change-Id: Iafb7063b63b1daeb7653830542d13b419cf187d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3416191
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78848}
2022-01-28 16:52:24 +00:00
Michael Achenbach
67cdb3767c [foozzie] Ensure sparkplug is off for baseline comparison
No-Try: true
Bug: v8:12054
Change-Id: I118d1680939d1282c580530f8aa12a4cf72e54d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277875
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77866}
2021-11-12 10:54:05 +00:00
Clemens Backes
14ad5cd194 [foozzie] Test the --turbo-force-mid-tier-regalloc flag
This flag will force the usage of the mid-tier register allocator, which
is otherwise only used for huge functions, hence does not get much
fuzzer coverage.

R=machenbach@chromium.org

Bug: v8:12330
Change-Id: I30b602b54adf858a2a3aaf73d8828875c1f6df7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234492
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77500}
2021-10-21 14:02:05 +00:00
Michael Achenbach
7c69f0c915 [js-fuzzer] Replace more bogus assert output
Bug: chromium:1256831
Change-Id: I51a7872996849c42fdc75c1691c1e4103e2a45c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3220349
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77383}
2021-10-13 15:22:44 +00:00
Michael Achenbach
0ffc1ba5fc [js-fuzzer] Make db more robust to failing code fragments.
Until now, the cross-over mutator would choke on several expressions
from DB and bail out (just wastes some time). We also have a script,
test_db.js to test on how many expressions it is going to bail out.

With this change, we already omit adding such expressions to the
DB in the first place. As a result, the test_db script now returns
zero failing expressions (while all other expressions remain).

Regression tests that now no longer apply are removed, instead a
test is added that ensures that a failing expression isn't added
to the DB.

No-Try: true
Bug: chromium:1044942
Change-Id: I14a4fe802c99114cf3a8f71188273475a7cb9c13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3129340
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76598}
2021-08-31 11:28:21 +00:00
Michael Achenbach
e08e941a95 [js-fuzzer] Fix broken db tester
This was missing in one of the last refactorings.

No-Try: true
Bug: chromium:1044942
Change-Id: I2c6bfc75251fad61f35a75afec3a1b2682175d68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3127705
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76589}
2021-08-30 17:37:22 +00:00
Michael Achenbach
ed6a7173a1 [foozzie] Also treat SIGABRT as crash
As with other crashes, also SIGABRT cuts of execution earlier. While
the reason might be interesting in normal fuzzing, in correctness
fuzzing, it leads to spurious reports due to the output differences.

No-Try: true
Bug: chromium:1242193
Change-Id: I6ee9a8e2a0254255d02b0106575931b523fbf666
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3124808
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76569}
2021-08-30 11:19:22 +00:00
Michael Achenbach
b673a32d6f [js-fuzzer] Remove logic to block runtime functions in fuzzer
The runtime-function blocking is implemented in V8 behind the
--fuzzing flag since a while now. The legacy blocklist on the fuzzer
side can be removed since some time now - it already diverted.

No-Try: true
Bug: chromium:1044942
Change-Id: I55f92419beb4d4462cbe03918dbf84d9c979862d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3124810
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76556}
2021-08-30 07:43:32 +00:00
Michael Achenbach
8fa3b4aed6 [js-fuzzer] Remove bogus test changes
The CL https://crrev.com/c/2928505 changed tests without changing the
fuzzer with the result that tests fail now.

It's not helpful to switch to using new API methods in generated fuzz
tests, as they'd then not bisect well backwards to older V8 versions.

No-Try: true
Change-Id: Ia307e88b4532bd792091b23374889f2b0e490fce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3124809
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76552}
2021-08-28 07:20:00 +00:00
Michael Achenbach
f16da87de2 [foozzie] Drop incompatible flags
This adds the option to list disallowed flags for differential
fuzzing directly in the harness. Flags that can crash in smoke
tests shoule be added there.

No-Try: true
Bug: chromium:1240812
Change-Id: I57c772bedeac0ca6ba023c6b4929515b4b0e6cca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3103314
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76369}
2021-08-18 16:19:11 +00:00
Georg Neis
2257f6b145 [compiler][test] Remove --block-concurrent-recompilation
- Remove flag --block-concurrent-recompilation and its implementation,
  including %UnblockConcurrentCompilation.
- Rewrite tests that used it in terms of the primitives introduced in
  my previous CL:
  https://chromium-review.googlesource.com/c/v8/v8/+/3071400/
- Remove "sync"/"no sync" arguments from %GetOptimizationStatus,
  assertOptimized, etc. These are now always "no sync": they don't
  do any magic.
- Remove "if %IsConcurrentRecompilationSupported then quit" from some
  tests in favor of --concurrent-recompilation in their Flags line.

Bug: v8:12041, v8:7790
Change-Id: I966aae4fec85e6f9e7aeed2ba2c12e9198a3991f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3077149
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76298}
2021-08-16 10:15:53 +00:00
Ross McIlroy
4ab70f6b21 [Compiler] Remove untrusted code mitigations.
These are no longer enabled, so remove the code mitigation logic from
the codebase.

BUG=chromium:1003890

Change-Id: I536bb1732e8463281c21da446bbba8f47ede8ebe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3045704
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76256}
2021-08-12 12:58:24 +00:00
Camillo Bruni
a345a442d3 [d8][mjsunit][tools] Improve d8 file API
- Add d8.file.read() and d8.file.execute() helpers
- Change tools and tests to use new d8.file helper
- Unify error throwing in v8::Shell::ReadFile

Change-Id: I5ef4cb27f217508a367106f01e872a4059d5e399
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928505
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74883}
2021-06-01 13:37:57 +00:00
Michael Achenbach
8590942c84 [foozzie] Prioritize reporting differences with x64 if present
tldr: This adds an on-demand comparison with x64 when a difference to
a non-x64 build is detected.

Normally foozzie compares the baseline build (just ignition), with
two secondary builds. One, the default, always uses the shipping
configuration, the second passes additional flags. Both can use a
different architecture than the baseline build as well.

Differences between ignition and turbofan are then often detected
independent of the architectures used, but reported several times
(for each compared architecture).

This makes the reporting more specific, by running another build on
demand that uses the baseline architecture, but otherwise the same
configuration that showed a difference. If it shows the difference as
well, the baseline architecture is used for the report.

As a result only pure architecture differences will be reported with
an architecture other than x64.

This also adds some minor refactorings to reduce the code complexity
when looping over comparisons.

For testing this, the fake-d8s are extended with different behavior
for different flags passed. We add two test cases for testing:
x64 vs. ia32 with difference in x64 and ia32
x64 vs. ia32 with difference only in ia32

Bug: chromium:1196633
No-Try: true
Test: tools/clusterfuzz/v8_foozzie_test.py
Change-Id: Ic470ae8f0b37fb1628b32e4fafc0c39377e16f8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897099
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74612}
2021-05-17 17:57:03 +00:00
Michael Achenbach
2e91177874 [foozzie] Make stubbing-out typed arrays more robust
Fuzz tests could mess with some library methods used by stubs for
NaN-pattern problems in typed arrays. This change makes the stubs
more robust.

Bug: chromium:1197627
Change-Id: I84975f798d616fd5e82fd9ab84ad01fc35336a04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2820968
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73896}
2021-04-12 07:53:51 +00:00
Clemens Backes
7f38169b2e [wasm] Test --no-wasm-generic-wrapper in the stress variant
Generic wasm wrappers are enabled by default now (since
https://crrev.com/c/2562241), so we can remove the flag from the
nooptimization variant. Instead, we should have a configuration which
tests --no-wasm-generic-wrapper to find bugs in the compiled wrappers
earlier.

Also add an entry for contradictory flags, and reformat that list to
respect the 80 columns limit.

R=machenbach@chromium.org
CC=ahaas@chromium.org

Bug: v8:10982
Change-Id: I780aaedbbf7fe761c39a41af1ff2db58c7447a76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2773057
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73560}
2021-03-22 09:45:59 +00:00
Leszek Swirski
791e085d2f [sparkplug] Add always_sparkplug variant
Add an always_sparkplug testing variant, and fix a couple of issues it
found.

Bug: v8:11420
Change-Id: I7d87a41e3413f40271a0140118531f075d633b23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2773047
Reviewed-by: Patrick Thier <pthier@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73529}
2021-03-19 09:52:50 +00:00
Leszek Swirski
668513d8ab [sparkplug] Add fuzzer support for CompileBaseline
Robustify %CompileBaseline against fuzzing, and allowlist it in the
fuzzer.

Bug: v8:11420
Change-Id: I44947014c8c9362d80ea98636dbbaa5d07d6a177
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739643
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73325}
2021-03-10 17:49:18 +00:00
Michael Achenbach
bc403dcb97 [test] Temporarily drop no-sse flags from differential fuzzing
No-Try: true
Bug: v8:11442
Change-Id: I13849c9fa90fa5a971c24694db56a07cc1cccc24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2692570
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72707}
2021-02-12 15:29:46 +00:00
Michael Achenbach
886d7cfee4 Reland "Enable simulating errors to test fuzzer reliability"
This is a reland of 4ad08c82f7

The reland organizes the different error types in separate functions
for separate call stacks. Error simulation is also guarded by
a minimum file size to prevent Clusterfuzz from getting stuck with
its bad-build check.

Original change's description:
> Enable simulating errors to test fuzzer reliability
>
> This adds a d8 flag --simulate-errors, which on shutdown will cause
> certain errors. This enables testing the reliability of sanitizers.
>
> This will cause a fatal error, a dcheck (if available) or a
> violation that can be detected with one of the following sanitizers:
> ASAN, UBSAN, MSAN, CFI.
>
> The same flag used in differential fuzzing will cause an error
> subsumed with the error state "fake_difference".
>
> Bug: chromium:1152412
> Change-Id: I4b36c6fe716797004d634263617d22ca67b05600
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2554999
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71430}

Bug: chromium:1152412
Change-Id: I604258b4c1ebd215c26b1de6b2822663f857bf64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565125
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71538}
2020-12-01 16:26:43 +00:00
Michael Achenbach
1f36c542ae [foozzie] Make harness more robust to unknown flags
When one comparison run crashes, we cap the outputs to compare to the
shorter one. If one of those, however, contains ignored lines, the
comparison get's skewed.

This makes the main source of ignored lines more robust (the line
printed for unknown flags), by not printing it in the first place in
the context of differential fuzzing.

Bug: chromium:1153871
Change-Id: If2e534959779be14a686be5e43630cbf66e215a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567692
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71522}
2020-12-01 10:49:41 +00:00
Michael Achenbach
c0b46d976e Revert "Enable simulating errors to test fuzzer reliability"
This reverts commit 4ad08c82f7.

Reason for revert: Need to retry with bugs in separate stack
frames.

Original change's description:
> Enable simulating errors to test fuzzer reliability
>
> This adds a d8 flag --simulate-errors, which on shutdown will cause
> certain errors. This enables testing the reliability of sanitizers.
>
> This will cause a fatal error, a dcheck (if available) or a
> violation that can be detected with one of the following sanitizers:
> ASAN, UBSAN, MSAN, CFI.
>
> The same flag used in differential fuzzing will cause an error
> subsumed with the error state "fake_difference".
>
> Bug: chromium:1152412
> Change-Id: I4b36c6fe716797004d634263617d22ca67b05600
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2554999
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71430}

TBR=machenbach@chromium.org,clemensb@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1152412
Change-Id: If20cdef372b0e7e92e7080687f446539a587a815
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565120
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71475}
2020-11-30 09:30:08 +00:00
Michael Achenbach
bea9978700 [foozzie] Insensitive terms clean-up
No-Try: true
Bug: v8:10619
Change-Id: I1e227c64fa34caf010271b299d9310d19bdfc53a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563273
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71454}
2020-11-27 16:57:24 +00:00
Michael Achenbach
4f2f106206 [foozzie] Use separate crash state for simulated crashes
The error simulation works and crashes during the smoke test are
detected. But now this masks real crashes (https://crbug.com/1153200),
therefore this change subsumes smoke-test crashes with
--simulate-errors under a separate crash state.

Now Clusterfuzz will detect the case "unexpected crash" as fixed, but
create a new bug for "simulated crash". Which we will keep open
forever.

No-Try: true
Bug: chromium:1152412
Change-Id: I511af167d33430d9b89692151cb8abaf3a90c715
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563270
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71452}
2020-11-27 14:58:44 +00:00
Michael Achenbach
b652ba7597 [foozzie] Switch on error-simulation experiment
This passes the --simulate-errors flag for differential fuzzing with
a probability of 0.01%.

No-Try: true
Bug: chromium:1152412
Change-Id: I3146c0ea5706be8b5ec13ee8740e1d185e008075
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562248
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71432}
2020-11-26 15:55:04 +00:00
Michael Achenbach
4ad08c82f7 Enable simulating errors to test fuzzer reliability
This adds a d8 flag --simulate-errors, which on shutdown will cause
certain errors. This enables testing the reliability of sanitizers.

This will cause a fatal error, a dcheck (if available) or a
violation that can be detected with one of the following sanitizers:
ASAN, UBSAN, MSAN, CFI.

The same flag used in differential fuzzing will cause an error
subsumed with the error state "fake_difference".

Bug: chromium:1152412
Change-Id: I4b36c6fe716797004d634263617d22ca67b05600
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2554999
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71430}
2020-11-26 15:10:05 +00:00
Michael Achenbach
0a9bcd013a [js-fuzzer] Disallow flag that causes false positives.
Don't pass the correctness-fuzzing suppressions to normal fuzzing as
they turn stack overflows and invalid string length checks into
crashes.

This became first now a problem after the flag was passed in an mjsunit
test case.

No-Try: true
Bug: chromium:1151600,chromium:1151599
Change-Id: I5d29900a4b155762cae447fc102055eab1916309
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2551112
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71333}
2020-11-23 09:45:09 +00:00
Clemens Backes
14fbff26a8 [js-fuzzer][doc] Add a better download URL
For people not too familiar with cloud storage, the direct URL makes it
easier to download the zip archive.

R=machenbach@chromium.org

Bug: chromium:1142437, v8:10891
Change-Id: I6b29ebaac37489a73c4f75473d07e04e7200f2c3
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543395
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71276}
2020-11-19 13:06:29 +00:00
Clemens Backes
3d6169c61b [js-fuzzer] Slightly improve error messages
It took me a while to figure out how to set up everything to run the
fuzzer locally. These improved error messages would have helped to find
errors earlier.

R=machenbach@chromium.org

Bug: chromium:1142437
Change-Id: I414de0a8448cd81fdbf999cc7c3c8cf9394354f6
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2543397
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71239}
2020-11-17 17:55:08 +00:00
Michael Achenbach
5488c686b1 [js-fuzzer] Extend supported executables
No-Try: true
Bug: chromium:1142437
Change-Id: Icba7a00ac996c0f81a67e0141496829e657a9a64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2539917
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71203}
2020-11-16 13:04:35 +00:00
Edward Lesmes
e5c6a3bd75 Add DIR_METADATA files to v8.
Generate DIR_METADATA files and remove metadata from OWNERS
files for v8.

R=jkummerow@chromium.org, ochang@chromium.org, yangguo@chromium.org

Bug: chromium:1113033
Change-Id: I82cbb62e438d82dbbc408e87120af39fa9da0afa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476680
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Edward Lesmes <ehmaldonado@chromium.org>
Auto-Submit: Edward Lesmes <ehmaldonado@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70669}
2020-10-20 22:12:28 +00:00
Marja Hölttä
4f5ea814ca [Atomics.waitAsync] Mock Atomics.waitAsync in correctness fuzzing
It's inherently timing-dependent, leading to false positives.

Bug: chromium:1127612, v8:10239

Change-Id: Ibf6f3cb07f520a404daf8e860a0c2e5f2319529e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423707
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70046}
2020-09-22 11:04:58 +00:00
Michael Achenbach
320d98709f Open source js-fuzzer
This is a JavaScript fuzzer originally authored by Oliver Chang. It
is a mutation based fuzzer using Babel code transformations. For more
information see the included README.md.

The original code was altered:
- Add new V8 copyright headers.
- Make the test expectation generator aware of the headers.
- Fix file endings for presubmit checks.
- Fix `npm test` on fresh checkout with a new fake DB.
- Make test skipping work with new v8/tools location.
- OWNERS file.
- New title section in README.md.

No-Try: true
Bug: chromium:1109770
Change-Id: Ie71752c0a37491a50500c49060a3c526716ef933
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2320330
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69164}
2020-07-31 11:34:39 +00:00