765f3c33b9
Before this change, the mutation order of js-fuzzer was hard-coded and always executed in the same order. This e.g. prevents certain mutation interactions. E.g. in the typical V8 pattern: %Prep(foo);foo(N);foo(N);%Opt(foo);foo(N); This gets typically inserted by the FunctionCallMutator, but none of the arguments N would get mutated later, since e.g. the NumberMutator is executed earlier. This change adds an experiment that makes the top-level mutation flow more flexible. With a probability of 20% each we now also: - Shuffle the different mutators. - Run a few random extra mutators after the first round. We annotate the output files with comments if the experiment was chosen to easier analyze later if interesting new bugs were found. Change-Id: I581d43b41a8e1d87ff1e8cab435a1b6e834db0f1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096477 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Liviu Rau <liviurau@chromium.org> Cr-Commit-Position: refs/heads/main@{#84863} |
||
|---|---|---|
| .github | ||
| bazel | ||
| build_overrides | ||
| custom_deps | ||
| docs | ||
| gni | ||
| include | ||
| infra | ||
| samples | ||
| src | ||
| test | ||
| testing | ||
| third_party | ||
| tools | ||
| .bazelrc | ||
| .clang-format | ||
| .clang-tidy | ||
| .editorconfig | ||
| .flake8 | ||
| .git-blame-ignore-revs | ||
| .gitattributes | ||
| .gitignore | ||
| .gn | ||
| .mailmap | ||
| .style.yapf | ||
| .vpython3 | ||
| .ycm_extra_conf.py | ||
| AUTHORS | ||
| BUILD.bazel | ||
| BUILD.gn | ||
| CODE_OF_CONDUCT.md | ||
| codereview.settings | ||
| COMMON_OWNERS | ||
| DEPS | ||
| DIR_METADATA | ||
| ENG_REVIEW_OWNERS | ||
| INFRA_OWNERS | ||
| INTL_OWNERS | ||
| LICENSE | ||
| LICENSE.fdlibm | ||
| LICENSE.strongtalk | ||
| LICENSE.v8 | ||
| LOONG_OWNERS | ||
| MIPS_OWNERS | ||
| OWNERS | ||
| PPC_OWNERS | ||
| PRESUBMIT.py | ||
| README.md | ||
| RISCV_OWNERS | ||
| S390_OWNERS | ||
| WATCHLISTS | ||
| WORKSPACE | ||
V8 JavaScript Engine
V8 is Google's open source JavaScript engine.
V8 implements ECMAScript as specified in ECMA-262.
V8 is written in C++ and is used in Google Chrome, the open source browser from Google.
V8 can run standalone, or can be embedded into any C++ application.
V8 Project page: https://v8.dev/docs
Getting the Code
Checkout depot tools, and run
fetch v8
This will checkout V8 into the directory v8 and fetch all of its dependencies.
To stay up to date, run
git pull origin
gclient sync
For fetching all branches, add the following into your remote
configuration in .git/config:
fetch = +refs/branch-heads/*:refs/remotes/branch-heads/*
fetch = +refs/tags/*:refs/tags/*
Contributing
Please follow the instructions mentioned at v8.dev/docs/contribute.