7 Commits
Author SHA1 Message Date
Olivier Flückiger 45a6b7b009 [d8][fuzzilli] Fix REPRL loop failure handling for JS bundles
In REPRL mode, when d8 receives a script prefixed with
// JS_BUNDLE_SCRIPT, it executes it using TryExecuteBundle. If the
bundle execution fails (e.g., due to an uncaught exception),
SourceGroup::Execute would immediately return false.

This prevents the error from bubbling up all the way to the fuzzili
repl loop.

This CL fixes this by:
1. Introducing a static 'fuzzilli_reprl_failed_' flag in Shell to
   track execution failures in REPRL mode.
2. Modifying SourceGroup::Execute to set this flag and return 'true'
   (success) on failure when in REPRL mode, preventing immediate
   failure propagation.
3. Checking this flag in the main REPRL loop to override the result
   to 1 (failure) before sending the status (256) back to Fuzzilli.

This ensures that the failure is correctly reported to Fuzzilli, but
the internal execution flow of d8 is not disrupted by returning
false from SourceGroup::Execute.

We also add regression test cases for this in v8_fuzzilli_test.

TAG=agy
CONV=4ee702ec-3d55-45c1-936d-c006eccef65f

Change-Id: I9d3cf068898673f486a3368590cd7d8592a06696
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7902595
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#107793}
2026-06-05 06:26:36 -07:00
Samuel Groß 6210313f8f [fuzzilli] Repair test/fuzzilli
The builds were failing with "error: 'main' should not be 'extern "C"'"

Drive-By: update libreprl to the latest version.
Change-Id: I9f80f24b5456e90bcfa377a462355b2fde58323b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5832026
Reviewed-by: Stephen Röttger <sroettger@google.com>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#95915}
2024-09-02 11:48:47 +00:00
Michael Achenbach e3b750c335 [test] Use pathlib in test framework
This turns all paths in the test frameworks and all its suite
implementations from strings into pathlib paths. This makes the
framework more future-proof, simplifies a lot of code and
enhances readability. It comes with the risk of introducing new
bugs. This is lowered using an experimental test comparison
script: https://crrev.com/c/4648372.

Some detailed changes:
- The "path" of a test case is now a pathlib path (also in cases
where the path doesn't correspond to a location on the file
system). This path is always relative to the test root.
- The "name" of a test case is the posix string of that path
used in status files and at the command line.
- All other paths are absolute.
- We use some more wrapping with Path() than absolutely
necessary. Reducing such a wrapping where it's not needed is a
micro-optimization and the potential by introducing a bug by
forgetting one is worse.
- Some modules are not happy with pathlib objects, hence a few
explicit str() conversions are added.

Thoughts on risk:
- The highest risk is that due to the newly introduced logic, some
test cases are silently filtered and not run now.
We'll manually compare runs before and after this change.
- Each test attempted to run will either pass or fail,
failures won't be silent. E.g. a wrong path passed to the cctest
executable is flagged as a failure.
- Wrongly constructed paths to JS test cases lead to failures
(tested several manually).

Other failure types:
- Some string path not turned into pathlib: Will typically fail
when calling any pathlib function.
- Some pathlib object treated as a string: Will typically raise
an exception, e.g. using in-operator.
- Logic bugs in pathlib functions behaving differently than
anticipated, e.g. with_suffix(): Will typically result in wrong
paths, resulting in errors reading a test case. Though worst case
could be silent ignoring.

Cq-Include-Trybots: luci.v8.try:v8_numfuzz_dbg
Cq-Include-Trybots: luci.v8.try:v8_numfuzz_rel
Cq-Include-Trybots: luci.v8.try:v8_numfuzz_tsan_rel
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel
Cq-Include-Trybots: luci.v8.try:v8_android_arm64_n5x_rel
Cq-Include-Trybots: luci.v8.try:v8_linux64_msan_rel
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel
Cq-Include-Trybots: luci.v8.try:v8_android_arm64_n5x_rel
Bug: chromium:1132088
Change-Id: Ifc94feb292174935db969dcf5d174d2eedcf3dfd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4538761
Reviewed-by: Liviu Rau <liviurau@google.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#88502}
2023-06-27 12:56:55 +00:00
Liviu Rau b3477fdd01 [test] Refactor testrunner (4)
- Removed duplication and unnecessary indirection from all suites testcfgs.
 - Introduced a more comprehensive context to cover both command context and other platform specific concerns.
 - Propagated above context to TestLoader to allow for test counting command execution on all platforms.
 - Wrapped original pool with another class to give it a new interface and allow injecting different implementations in the future.
 - Consolidated progress indicators under a single processor in the pipeline.
 - Consolidated result retention requirements calculation outside of pipeline chain.
 - Refactored LoaderProc and got it under tests.
 - Added some more tests for the standard runner.
 - Extracted BuildConfig class.


Bug: v8:12785
Change-Id: I87be040e91f792a983662bb5a10d55b36a14ea7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3701595
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81770}
2022-07-18 09:52:24 +00:00
Samuel Groß 919d1dd770 Fix unhandled promise rejections in REPRL mode
Previously, unhandled promise rejections weren't reset between REPRL
executions, leading to incorrect exit statuses being reported. This CL
fixes the issue and adds further tests to verify the correct behaviour.

Change-Id: Ied47d9359b0fbc05ebb211667687a0a4041ef767
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431205
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Samuel Groß <saelo@google.com>
Cr-Commit-Position: refs/heads/master@{#70227}
2020-09-30 13:34:23 +00:00
Samuel Groß d46723aefd Updated libreprl from Fuzzilli and improved Fuzzilli test
The test now verifies that JavaScript programs can be executed
over the REPRL interface, that runtime exceptions can be detected,
and that the engine's state is properly reset between executions.

Change-Id: Ic8032c07e222307cbb4d332e7eaec61936a10ccd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396082
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Samuel Groß <saelo@google.com>
Cr-Commit-Position: refs/heads/master@{#69883}
2020-09-14 14:52:06 +00:00
Peter Ralbovsky 70eb08982c Integrate fuzzilli into v8
Fuzzilli is open source fuzzer by Samuel Groß (saelo@google.com)
that can be used to find bugs in v8 javascript engine. As we want
to automate fuzzing for current versions of v8, we want to merge
fuzzilli toolkit into v8 code, so that fuzzer can automatically
update to the newest version.
So far Fuzzilli has been maintained at
https://github.com/googleprojectzero/fuzzilli .


Bug tracker Id: https://bugs.chromium.org/p/v8/issues/detail?id=10571

Change-Id: I83ddc7e8bb31664c19e4044395bb9044a1c12031
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2201760
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68132}
2020-06-03 09:53:24 +00:00