Olivier Flückiger
45a6b7b009
In REPRL mode, when d8 receives a script prefixed with // JS_BUNDLE_SCRIPT, it executes it using TryExecuteBundle. If the bundle execution fails (e.g., due to an uncaught exception), SourceGroup::Execute would immediately return false. This prevents the error from bubbling up all the way to the fuzzili repl loop. This CL fixes this by: 1. Introducing a static 'fuzzilli_reprl_failed_' flag in Shell to track execution failures in REPRL mode. 2. Modifying SourceGroup::Execute to set this flag and return 'true' (success) on failure when in REPRL mode, preventing immediate failure propagation. 3. Checking this flag in the main REPRL loop to override the result to 1 (failure) before sending the status (256) back to Fuzzilli. This ensures that the failure is correctly reported to Fuzzilli, but the internal execution flow of d8 is not disrupted by returning false from SourceGroup::Execute. We also add regression test cases for this in v8_fuzzilli_test. TAG=agy CONV=4ee702ec-3d55-45c1-936d-c006eccef65f Change-Id: I9d3cf068898673f486a3368590cd7d8592a06696 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7902595 Auto-Submit: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#107793}
Communication model of fuzzilli with V8
Source code
On a low level, Fuzzilli communicates with v8 through the REPRL protocol, implemented on the fuzzer side by the libreprl C library in Sources/libreprl/. The main way of using the library is through the following three functions:
reprl_create_context() this creates a new, empty REPRL context to be used by the following APIs.
reprl_initialize_context(ctx, argv, envp) this initializes the given context and sets the argv and envp vectors to use for the child processes.
reprl_execute(ctx, code) this executes the given code and returns the exit status. If necessary, a new child process is created for this. This involves creating pipes, forking itself, then setting filedescriptors, and using execve to execute the d8 binary. A child process can be reused for multiple executions, thus increasing fuzzing performance as the overhead of fork and execve are removed.
Coverage
Coverage information are being monitored through shared memory. On the side of v8 it is monitored through SanitizerCoverage module of Clang compiler ( https://clang.llvm.org/docs/SanitizerCoverage.html ) Through shared memory information about edges are shared with fuzzilli which implements counter for error and covered branches of the V8 code in Sources/libcoverage/coverage.c