{"commit":{"authorName":"Sathya Gunasekaran","shortRevision":"31ec959e9b","authorEmail":"gsathya.ceg@gmail.com","authoredAt":"2023-07-06T11:44:14+05:30","revision":"31ec959e9ba06c4fae70dc5dddfeb2257a4d0e48","subject":"[fuzzer] Initial import of v8's fuzzer"},"body":"Copied from \nhttps:\/\/chromium.googlesource.com\/v8\/v8\/+\/master\/tools\/clusterfuzz\/js_fuzzer\/","files":[{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/.eslintrc.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/.gitignore"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/DIR_METADATA"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/OWNERS"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/README.md"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/build_db.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/corpus.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/db.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/differential_script_mutator.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/exceptions.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/foozzie_launcher.py"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/gen_exceptions.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/gen_exceptions.sh"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/array_mutator.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/common.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/crossover_mutator.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/differential_fuzz_mutator.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/expression_mutator.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/function_call_mutator.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/mutator.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/normalizer.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/number_mutator.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/object_mutator.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/try_catch.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/variable_mutator.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/mutators\/variable_or_object_mutation.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/package.json"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/package.sh"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/random.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_chakra.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_jstest.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_library.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_mjsunit.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_suppressions.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_v8.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/resources\/fuzz_library.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/resources\/jstest_stubs.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/resources\/stubs.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/run.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/script_mutator.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/source_helpers.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/helpers.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_available_variables.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_corpus.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_db.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_differential_fuzz.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_differential_fuzz_library.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_load.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_arrays.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_expressions.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_function_calls.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_numbers.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_objects.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_variable_or_object.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_variables.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_mutation_order.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_normalize.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_random.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_regressions.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test\/test_try_catch.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/fake_stub.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/load.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/load_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/available_variables.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/available_variables_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/dir\/load3.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load1.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load2.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/cross_over_mutator_class_input.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/db\/this\/file.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/combined_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/exceptions.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/exceptions_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/fake_resource.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/input1.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/input2.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/mutations.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/mutations_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/suppressions.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/suppressions_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/v8_fuzz_experiments.json"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/v8_fuzz_flags.json"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/fake_db\/index.json"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/mjsunit.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_0.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_1.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_2.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_3.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_self.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_self_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/object-literal.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/permitted.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/regress\/binaryen-123.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_arrays.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_arrays_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions_current_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions_previous_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_baseline_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_deopt_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_maglev_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_numbers.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_numbers_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_objects.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_objects_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_var_or_obj.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_var_or_obj_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_variables.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_variables_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutation_order\/input.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/mutation_order\/output_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize_expected_0.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize_expected_1.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/db\/index.json"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/input_indices.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/input_negative.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/db\/index.json"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/input.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/shell.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/db\/index.json"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_delete.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_strict.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_with.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/simple_test.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/simple_test_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/load1.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/shell.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load2.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/shell.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_alternate_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_nothing_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_toplevel_expected.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/test_db.js"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/tools\/fuzz_one.py"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/tools\/minimize.py"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/tools\/run_one.py"},{"status":"A","path":"compiler\/forget\/packages\/js-fuzzer\/tools\/workbench.py"}],"patch":"diff --git a\/compiler\/forget\/packages\/js-fuzzer\/.eslintrc.js b\/compiler\/forget\/packages\/js-fuzzer\/.eslintrc.js\nnew file mode 100644\nindex 0000000000..f3ba3c962b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/.eslintrc.js\n@@ -0,0 +1,22 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+module.exports = {\n+ \"env\": {\n+ \"node\": true,\n+ \"commonjs\": true,\n+ \"es6\": true,\n+ \"mocha\": true\n+ },\n+ \"extends\": \"eslint:recommended\",\n+ \"globals\": {\n+ \"Atomics\": \"readonly\",\n+ \"SharedArrayBuffer\": \"readonly\"\n+ },\n+ \"parserOptions\": {\n+ \"ecmaVersion\": 2018\n+ },\n+ \"rules\": {\n+ }\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/.gitignore b\/compiler\/forget\/packages\/js-fuzzer\/.gitignore\nnew file mode 100644\nindex 0000000000..870328c522\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/.gitignore\n@@ -0,0 +1,6 @@\n+\/node_modules\n+\/ochang_js_fuzzer*\n+\/db\/\n+\/output.zip\n+\/output\/\n+\/workdir\/\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/DIR_METADATA b\/compiler\/forget\/packages\/js-fuzzer\/DIR_METADATA\nnew file mode 100644\nindex 0000000000..9fc13203d7\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/DIR_METADATA\n@@ -0,0 +1,11 @@\n+# Metadata information for this directory.\n+#\n+# For more information on DIR_METADATA files, see:\n+# https:\/\/source.chromium.org\/chromium\/infra\/infra\/+\/master:go\/src\/infra\/tools\/dirmd\/README.md\n+#\n+# For the schema of this file, see Metadata message:\n+# https:\/\/source.chromium.org\/chromium\/infra\/infra\/+\/master:go\/src\/infra\/tools\/dirmd\/proto\/dir_metadata.proto\n+\n+monorail {\n+ component: \"Infra>Client>V8\"\n+}\n\\ No newline at end of file\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/OWNERS b\/compiler\/forget\/packages\/js-fuzzer\/OWNERS\nnew file mode 100644\nindex 0000000000..bc18f69af5\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/OWNERS\n@@ -0,0 +1,7 @@\n+set noparent\n+\n+file:..\/..\/..\/INFRA_OWNERS\n+\n+msarms@chromium.org\n+mslekova@chromium.org\n+ochang@chromium.org\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/README.md b\/compiler\/forget\/packages\/js-fuzzer\/README.md\nnew file mode 100644\nindex 0000000000..71a1140fe1\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/README.md\n@@ -0,0 +1,122 @@\n+# JS-Fuzzer\n+\n+Javascript fuzzer for stand-alone shells like D8, Chakra, JSC or Spidermonkey.\n+\n+Original author: Oliver Chang\n+\n+# Building\n+\n+This fuzzer may require versions of node that are newer than available on\n+ClusterFuzz, so we use [pkg](https:\/\/github.com\/zeit\/pkg) to create a self\n+contained binary) out of this.\n+\n+## Prereqs\n+You need to intall nodejs and npm. Run `npm install` in this directory.\n+\n+## Fuzzing DB\n+This fuzzer requires a fuzzing DB. To build one, get the latest `web_tests.zip`\n+from [gs:\/\/clusterfuzz-data\/web_tests.zip](\n+https:\/\/storage.cloud.google.com\/clusterfuzz-data\/web_tests.zip) and unzip it\n+(note https:\/\/crbug.com\/v8\/10891 for making this data publicly available).\n+Then run:\n+\n+```bash\n+$ mkdir db\n+$ node build_db.js -i \/path\/to\/web_tests -o db chakra v8 spidermonkey WebKit\/JSTests\n+```\n+\n+This may take a while. Optionally test the fuzzing DB with:\n+\n+```bash\n+$ node test_db.js -i db\n+```\n+\n+## Building fuzzer\n+Then, to build the fuzzer,\n+```bash\n+$ .\/node_modules\/.bin\/pkg -t node10-linux-x64 .\n+```\n+\n+Replace \"linux\" with either \"win\" or \"macos\" for those platforms.\n+\n+This builds a binary named `ochang_js_fuzzer` for Linux \/ macOS OR\n+`ochang_js_fuzzer.exe` for Windows.\n+\n+## Packaging\n+Use `.\/package.sh`, `.\/package.sh win` or `.\/package.sh macos` to build and\n+create the `output.zip` archive or use these raw commands:\n+```bash\n+$ mkdir output\n+$ cd output\n+$ ln -s ..\/db db\n+$ ln -s ..\/ochang_js_fuzzer run\n+$ zip -r \/path\/output.zip *\n+```\n+\n+**NOTE**: Add `.exe` to `ochang_js_fuzzer` and `run` filename above if archiving\n+for Windows platform.\n+\n+# Development\n+\n+Run the tests with:\n+\n+```bash\n+$ npm test\n+```\n+\n+When test expectations change, generate them with:\n+\n+```bash\n+$ GENERATE=1 npm test\n+```\n+\n+# Generating exceptional configurations\n+\n+Tests that fail to parse or show very bad performance can be automatically\n+skipped or soft-skipped with the following script (takes >1h):\n+\n+```bash\n+$ WEB_TESTS=\/path\/to\/web_tests OUTPUT=\/path\/to\/output\/folder .\/gen_exceptions.sh\n+```\n+\n+# Experimenting (limited to differential fuzzing)\n+\n+To locally evaluate the fuzzer, setup a work directory as follows:\n+\n+```bash\n+$ workdir\/\n+$ workdir\/app_dir\n+$ workdir\/fuzzer\n+$ workdir\/input\n+$ workdir\/output\n+```\n+\n+The `app_dir` folder can be a symlink or should contain the bundled\n+version of `d8` with all files required for execution.\n+Copy the packaged `ochang_js_fuzzer` executable and the `db` folder\n+to the `fuzzer` directory or use a symlink.\n+The `input` directory is the root folder of the corpus, i.e. pointing\n+to the unzipped data of `gs:\/\/clusterfuzz-data\/web_tests.zip`.\n+The `output` directory is expected to be empty. It'll contain all\n+output of the fuzzing session. Start the experiments with:\n+\n+```bash\n+$ # Around ~40000 corresponds to 24h of fuzzing on a workstation.\n+$ NUM_RUNS = 40000\n+$ python tools\/workbench.py $NUM_RUNS\n+```\n+\n+You can check current stats with:\n+\n+```bash\n+$ cat workdir\/output\/stats.json | python -m json.tool\n+```\n+\n+When failures are found, you can forge minimization command lines with:\n+\n+```bash\n+$ MINIMIZER_PATH = path\/to\/minimizer\n+$ python tools\/minimize.py $MINIMIZER_PATH\n+```\n+\n+The path should point to a local checkout of the [minimizer](https:\/\/chrome-internal.googlesource.com\/chrome\/tools\/clusterfuzz\/+\/refs\/heads\/master\/src\/python\/bot\/minimizer\/).\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/build_db.js b\/compiler\/forget\/packages\/js-fuzzer\/build_db.js\nnew file mode 100644\nindex 0000000000..c00d286eb1\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/build_db.js\n@@ -0,0 +1,65 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Collect JS nodes.\n+ *\/\n+\n+const program = require('commander');\n+\n+const corpus = require('.\/corpus.js');\n+const db = require('.\/db.js');\n+const path = require('path');\n+\n+const sourceHelpers = require('.\/source_helpers.js');\n+\n+function main() {\n+ Error.stackTraceLimit = Infinity;\n+\n+ program\n+ .version('0.0.1')\n+ .option('-i, --input_dir ', 'Input directory.')\n+ .option('-o, --output_dir ', 'Output directory.')\n+ .parse(process.argv);\n+\n+ if (!program.args.length) {\n+ console.log('Need to specify corpora.');\n+ return;\n+ }\n+\n+ if (!program.output_dir) {\n+ console.log('Need to specify output dir.');\n+ return;\n+ }\n+\n+ const mutateDb = new db.MutateDbWriter(program.output_dir);\n+\n+ const inputDir = path.resolve(program.input_dir);\n+ for (const corpusName of program.args) {\n+ const curCorpus = new corpus.Corpus(inputDir, corpusName);\n+ for (const relPath of curCorpus.relFiles()) {\n+ let source;\n+ try {\n+ source = sourceHelpers.loadSource(inputDir, relPath);\n+ } catch (e) {\n+ console.log(e);\n+ continue;\n+ }\n+\n+ if (!source) {\n+ continue;\n+ }\n+\n+ try{\n+ mutateDb.process(source);\n+ } catch (e) {\n+ console.log(e);\n+ }\n+ }\n+ }\n+\n+ mutateDb.writeIndex();\n+}\n+\n+main();\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/corpus.js b\/compiler\/forget\/packages\/js-fuzzer\/corpus.js\nnew file mode 100644\nindex 0000000000..d186ce8556\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/corpus.js\n@@ -0,0 +1,141 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Corpus\n+ *\/\n+\n+const program = require('commander');\n+const fs = require('fs');\n+const path = require('path');\n+\n+const exceptions = require('.\/exceptions.js');\n+const random = require('.\/random.js');\n+const sourceHelpers = require('.\/source_helpers.js');\n+\n+function* walkDirectory(directory, filter) {\n+ \/\/ Generator for recursively walk a directory.\n+ for (const filePath of fs.readdirSync(directory)) {\n+ const currentPath = path.join(directory, filePath);\n+ const stat = fs.lstatSync(currentPath);\n+ if (stat.isFile()) {\n+ if (!filter || filter(currentPath)) {\n+ yield currentPath;\n+ }\n+ continue;\n+ }\n+\n+ if (stat.isDirectory()) {\n+ for (let childFilePath of walkDirectory(currentPath, filter)) {\n+ yield childFilePath;\n+ }\n+ }\n+ }\n+}\n+\n+class Corpus {\n+ \/\/ Input corpus.\n+ constructor(inputDir, corpusName, extraStrict=false) {\n+ this.inputDir = inputDir;\n+ this.extraStrict = extraStrict;\n+\n+ \/\/ Filter for permitted JS files.\n+ function isPermittedJSFile(absPath) {\n+ return (absPath.endsWith('.js') &&\n+ !exceptions.isTestSkippedAbs(absPath));\n+ }\n+\n+ \/\/ Cache relative paths of all files in corpus.\n+ this.skippedFiles = [];\n+ this.softSkippedFiles = [];\n+ this.permittedFiles = [];\n+ const directory = path.join(inputDir, corpusName);\n+ for (const absPath of walkDirectory(directory, isPermittedJSFile)) {\n+ const relPath = path.relative(this.inputDir, absPath);\n+ if (exceptions.isTestSkippedRel(relPath)) {\n+ this.skippedFiles.push(relPath);\n+ } else if (exceptions.isTestSoftSkippedAbs(absPath) ||\n+ exceptions.isTestSoftSkippedRel(relPath)) {\n+ this.softSkippedFiles.push(relPath);\n+ } else {\n+ this.permittedFiles.push(relPath);\n+ }\n+ }\n+ random.shuffle(this.softSkippedFiles);\n+ random.shuffle(this.permittedFiles);\n+ }\n+\n+ \/\/ Relative paths of all files in corpus.\n+ *relFiles() {\n+ for (const relPath of this.permittedFiles) {\n+ yield relPath;\n+ }\n+ for (const relPath of this.softSkippedFiles) {\n+ yield relPath;\n+ }\n+ }\n+\n+ \/\/ Relative paths of all files in corpus including generated skipped.\n+ *relFilesForGenSkipped() {\n+ for (const relPath of this.relFiles()) {\n+ yield relPath;\n+ }\n+ for (const relPath of this.skippedFiles) {\n+ yield relPath;\n+ }\n+ }\n+\n+ \/**\n+ * Returns \"count\" relative test paths, randomly selected from soft-skipped\n+ * and permitted files. Permitted files have a 4 times higher chance to\n+ * be chosen.\n+ *\/\n+ getRandomTestcasePaths(count) {\n+ return random.twoBucketSample(\n+ this.softSkippedFiles, this.permittedFiles, 4, count);\n+ }\n+\n+ loadTestcase(relPath, strict, label) {\n+ const start = Date.now();\n+ try {\n+ const source = sourceHelpers.loadSource(this.inputDir, relPath, strict);\n+ if (program.verbose) {\n+ const duration = Date.now() - start;\n+ console.log(`Parsing ${relPath} ${label} took ${duration} ms.`);\n+ }\n+ return source;\n+ } catch (e) {\n+ console.log(`WARNING: failed to ${label} parse ${relPath}`);\n+ console.log(e);\n+ }\n+ return undefined;\n+ }\n+\n+ *loadTestcases(relPaths) {\n+ for (const relPath of relPaths) {\n+ if (this.extraStrict) {\n+ \/\/ When re-generating the files marked sloppy, we additionally test if\n+ \/\/ the file parses in strict mode.\n+ this.loadTestcase(relPath, true, 'strict');\n+ }\n+ const source = this.loadTestcase(relPath, false, 'sloppy');\n+ if (source) {\n+ yield source;\n+ }\n+ }\n+ }\n+\n+ getRandomTestcases(count) {\n+ return Array.from(this.loadTestcases(this.getRandomTestcasePaths(count)));\n+ }\n+\n+ getAllTestcases() {\n+ return this.loadTestcases(this.relFilesForGenSkipped());\n+ }\n+}\n+\n+module.exports = {\n+ Corpus: Corpus,\n+ walkDirectory: walkDirectory,\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/db.js b\/compiler\/forget\/packages\/js-fuzzer\/db.js\nnew file mode 100644\nindex 0000000000..3fbe438023\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/db.js\n@@ -0,0 +1,485 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Mutation Db.\n+ *\/\n+\n+const crypto = require('crypto');\n+const fs = require('fs');\n+const fsPath = require('path');\n+\n+const babelGenerator = require('@babel\/generator').default;\n+const babelTemplate = require('@babel\/template').default;\n+const babelTraverse = require('@babel\/traverse').default;\n+const babelTypes = require('@babel\/types');\n+const globals = require('globals');\n+\n+const random = require('.\/random.js');\n+const sourceHelpers = require('.\/source_helpers.js');\n+\n+const globalIdentifiers = new Set(Object.keys(globals.builtin));\n+const propertyNames = new Set([\n+ \/\/ Parsed from https:\/\/github.com\/tc39\/ecma262\/blob\/master\/spec.html\n+ 'add',\n+ 'anchor',\n+ 'apply',\n+ 'big',\n+ 'bind',\n+ 'blink',\n+ 'bold',\n+ 'buffer',\n+ 'byteLength',\n+ 'byteOffset',\n+ 'BYTES_PER_ELEMENT',\n+ 'call',\n+ 'catch',\n+ 'charAt',\n+ 'charCodeAt',\n+ 'clear',\n+ 'codePointAt',\n+ 'compile',\n+ 'concat',\n+ 'constructor',\n+ 'copyWithin',\n+ '__defineGetter__',\n+ '__defineSetter__',\n+ 'delete',\n+ 'endsWith',\n+ 'entries',\n+ 'every',\n+ 'exec',\n+ 'fill',\n+ 'filter',\n+ 'find',\n+ 'findIndex',\n+ 'fixed',\n+ 'flags',\n+ 'fontcolor',\n+ 'fontsize',\n+ 'forEach',\n+ 'get',\n+ 'getDate',\n+ 'getDay',\n+ 'getFloat32',\n+ 'getFloat64',\n+ 'getFullYear',\n+ 'getHours',\n+ 'getInt16',\n+ 'getInt32',\n+ 'getInt8',\n+ 'getMilliseconds',\n+ 'getMinutes',\n+ 'getMonth',\n+ 'getSeconds',\n+ 'getTime',\n+ 'getTimezoneOffset',\n+ 'getUint16',\n+ 'getUint32',\n+ 'getUint8',\n+ 'getUTCDate',\n+ 'getUTCDay',\n+ 'getUTCFullYear',\n+ 'getUTCHours',\n+ 'getUTCMilliseconds',\n+ 'getUTCMinutes',\n+ 'getUTCMonth',\n+ 'getUTCSeconds',\n+ 'getYear',\n+ 'global',\n+ 'has',\n+ 'hasInstance',\n+ 'hasOwnProperty',\n+ 'ignoreCase',\n+ 'includes',\n+ 'indexOf',\n+ 'isConcatSpreadable',\n+ 'isPrototypeOf',\n+ 'italics',\n+ 'iterator',\n+ 'join',\n+ 'keys',\n+ 'lastIndexOf',\n+ 'length',\n+ 'link',\n+ 'localeCompare',\n+ '__lookupGetter__',\n+ '__lookupSetter__',\n+ 'map',\n+ 'match',\n+ 'match',\n+ 'message',\n+ 'multiline',\n+ 'name',\n+ 'next',\n+ 'normalize',\n+ 'padEnd',\n+ 'padStart',\n+ 'pop',\n+ 'propertyIsEnumerable',\n+ '__proto__',\n+ 'prototype',\n+ 'push',\n+ 'reduce',\n+ 'reduceRight',\n+ 'repeat',\n+ 'replace',\n+ 'replace',\n+ 'return',\n+ 'reverse',\n+ 'search',\n+ 'search',\n+ 'set',\n+ 'set',\n+ 'setDate',\n+ 'setFloat32',\n+ 'setFloat64',\n+ 'setFullYear',\n+ 'setHours',\n+ 'setInt16',\n+ 'setInt32',\n+ 'setInt8',\n+ 'setMilliseconds',\n+ 'setMinutes',\n+ 'setMonth',\n+ 'setSeconds',\n+ 'setTime',\n+ 'setUint16',\n+ 'setUint32',\n+ 'setUint8',\n+ 'setUTCDate',\n+ 'setUTCFullYear',\n+ 'setUTCHours',\n+ 'setUTCMilliseconds',\n+ 'setUTCMinutes',\n+ 'setUTCMonth',\n+ 'setUTCSeconds',\n+ 'setYear',\n+ 'shift',\n+ 'size',\n+ 'slice',\n+ 'slice',\n+ 'small',\n+ 'some',\n+ 'sort',\n+ 'source',\n+ 'species',\n+ 'splice',\n+ 'split',\n+ 'split',\n+ 'startsWith',\n+ 'sticky',\n+ 'strike',\n+ 'sub',\n+ 'subarray',\n+ 'substr',\n+ 'substring',\n+ 'sup',\n+ 'test',\n+ 'then',\n+ 'throw',\n+ 'toDateString',\n+ 'toExponential',\n+ 'toFixed',\n+ 'toGMTString',\n+ 'toISOString',\n+ 'toJSON',\n+ 'toLocaleDateString',\n+ 'toLocaleLowerCase',\n+ 'toLocaleString',\n+ 'toLocaleTimeString',\n+ 'toLocaleUpperCase',\n+ 'toLowerCase',\n+ 'toPrecision',\n+ 'toPrimitive',\n+ 'toString',\n+ 'toStringTag',\n+ 'toTimeString',\n+ 'toUpperCase',\n+ 'toUTCString',\n+ 'trim',\n+ 'unicode',\n+ 'unscopables',\n+ 'unshift',\n+ 'valueOf',\n+ 'values',\n+]);\n+\n+const MAX_DEPENDENCIES = 2;\n+\n+class Expression {\n+ constructor(type, source, isStatement, originalPath,\n+ dependencies, needsSuper) {\n+ this.type = type;\n+ this.source = source;\n+ this.isStatement = isStatement;\n+ this.originalPath = originalPath;\n+ this.dependencies = dependencies;\n+ this.needsSuper = needsSuper;\n+ }\n+}\n+\n+function dedupKey(expression) {\n+ if (!expression.dependencies) {\n+ return expression.source;\n+ }\n+\n+ let result = expression.source;\n+ for (let dependency of expression.dependencies) {\n+ result = result.replace(new RegExp(dependency, 'g'), 'ID');\n+ }\n+\n+ return result;\n+}\n+\n+function _markSkipped(path) {\n+ while (path) {\n+ path.node.__skipped = true;\n+ path = path.parentPath;\n+ }\n+}\n+\n+\/**\n+ * Returns true if an expression can be applied or false otherwise.\n+ *\/\n+function isValid(expression) {\n+ const expressionTemplate = babelTemplate(\n+ expression.source,\n+ sourceHelpers.BABYLON_REPLACE_VAR_OPTIONS);\n+\n+ const dependencies = {};\n+ if (expression.dependencies) {\n+ for (const dependency of expression.dependencies) {\n+ dependencies[dependency] = babelTypes.identifier('__v_0');\n+ }\n+ }\n+\n+ try {\n+ expressionTemplate(dependencies);\n+ } catch (e) {\n+ return false;\n+ }\n+ return true;\n+}\n+\n+class MutateDbWriter {\n+ constructor(outputDir) {\n+ this.seen = new Set();\n+ this.outputDir = fsPath.resolve(outputDir);\n+ this.index = {\n+ statements: [],\n+ superStatements: [],\n+ all: [],\n+ };\n+ }\n+\n+ process(source) {\n+ let self = this;\n+\n+ let varIndex = 0;\n+\n+ \/\/ First pass to collect dependency information.\n+ babelTraverse(source.ast, {\n+ Super(path) {\n+ while (path) {\n+ path.node.__needsSuper = true;\n+ path = path.parentPath;\n+ }\n+ },\n+\n+ YieldExpression(path) {\n+ \/\/ Don't include yield expressions in DB.\n+ _markSkipped(path);\n+ },\n+\n+ Identifier(path) {\n+ if (globalIdentifiers.has(path.node.name) &&\n+ path.node.name != 'eval') {\n+ \/\/ Global name.\n+ return;\n+ }\n+\n+ if (propertyNames.has(path.node.name) &&\n+ path.parentPath.isMemberExpression() &&\n+ path.parentKey !== 'object') {\n+ \/\/ Builtin property name.\n+ return;\n+ }\n+\n+ let binding = path.scope.getBinding(path.node.name);\n+ if (!binding) {\n+ \/\/ Unknown dependency. Don't handle this.\n+ _markSkipped(path);\n+ return;\n+ }\n+\n+ let newName;\n+ if (path.node.name.startsWith('VAR_')) {\n+ newName = path.node.name;\n+ } else if (babelTypes.isFunctionDeclaration(binding.path.node) ||\n+ babelTypes.isFunctionExpression(binding.path.node) ||\n+ babelTypes.isDeclaration(binding.path.node) ||\n+ babelTypes.isFunctionExpression(binding.path.node)) {\n+ \/\/ Unknown dependency. Don't handle this.\n+ _markSkipped(path);\n+ return;\n+ } else {\n+ newName = 'VAR_' + varIndex++;\n+ path.scope.rename(path.node.name, newName);\n+ }\n+\n+ \/\/ Mark all parents as having a dependency.\n+ while (path) {\n+ path.node.__idDependencies = path.node.__idDependencies || [];\n+ if (path.node.__idDependencies.length <= MAX_DEPENDENCIES) {\n+ path.node.__idDependencies.push(newName);\n+ }\n+ path = path.parentPath;\n+ }\n+ }\n+ });\n+\n+ babelTraverse(source.ast, {\n+ Expression(path) {\n+ if (!path.parentPath.isExpressionStatement()) {\n+ return;\n+ }\n+\n+ if (path.node.__skipped ||\n+ (path.node.__idDependencies &&\n+ path.node.__idDependencies.length > MAX_DEPENDENCIES)) {\n+ return;\n+ }\n+\n+ if (path.isIdentifier() || path.isMemberExpression() ||\n+ path.isConditionalExpression() ||\n+ path.isBinaryExpression() || path.isDoExpression() ||\n+ path.isLiteral() ||\n+ path.isObjectExpression() || path.isArrayExpression()) {\n+ \/\/ Skip:\n+ \/\/ - Identifiers.\n+ \/\/ - Member expressions (too many and too context dependent).\n+ \/\/ - Conditional expressions (too many and too context dependent).\n+ \/\/ - Binary expressions (too many).\n+ \/\/ - Literals (too many).\n+ \/\/ - Object\/array expressions (too many).\n+ return;\n+ }\n+\n+ if (path.isAssignmentExpression()) {\n+ if (!babelTypes.isMemberExpression(path.node.left)) {\n+ \/\/ Skip assignments that aren't to properties.\n+ return;\n+ }\n+\n+ if (babelTypes.isIdentifier(path.node.left.object)) {\n+ if (babelTypes.isNumericLiteral(path.node.left.property)) {\n+ \/\/ Skip VAR[\\d+] = ...;\n+ \/\/ There are too many and they generally aren't very useful.\n+ return;\n+ }\n+\n+ if (babelTypes.isStringLiteral(path.node.left.property) &&\n+ !propertyNames.has(path.node.left.property.value)) {\n+ \/\/ Skip custom properties. e.g.\n+ \/\/ VAR[\"abc\"] = ...;\n+ \/\/ There are too many and they generally aren't very useful.\n+ return;\n+ }\n+ }\n+ }\n+\n+ if (path.isCallExpression() &&\n+ babelTypes.isIdentifier(path.node.callee) &&\n+ !globalIdentifiers.has(path.node.callee.name)) {\n+ \/\/ Skip VAR(...) calls since there's too much context we're missing.\n+ return;\n+ }\n+\n+ if (path.isUnaryExpression() && path.node.operator == '-') {\n+ \/\/ Skip -... since there are too many.\n+ return;\n+ }\n+\n+ \/\/ Make the template.\n+ let generated = babelGenerator(path.node, { concise: true }).code;\n+ let expression = new Expression(\n+ path.node.type,\n+ generated,\n+ path.parentPath.isExpressionStatement(),\n+ source.relPath,\n+ path.node.__idDependencies,\n+ Boolean(path.node.__needsSuper));\n+\n+ \/\/ Try to de-dupe similar expressions.\n+ let key = dedupKey(expression);\n+ if (self.seen.has(key)) {\n+ return;\n+ }\n+\n+ \/\/ Test results.\n+ if (!isValid(expression)) {\n+ return;\n+ }\n+\n+ \/\/ Write results.\n+ let dirPath = fsPath.join(self.outputDir, expression.type);\n+ if (!fs.existsSync(dirPath)) {\n+ fs.mkdirSync(dirPath);\n+ }\n+\n+ let sha1sum = crypto.createHash('sha1');\n+ sha1sum.update(key);\n+\n+ let filePath = fsPath.join(dirPath, sha1sum.digest('hex') + '.json');\n+ fs.writeFileSync(filePath, JSON.stringify(expression));\n+\n+ let relPath = fsPath.relative(self.outputDir, filePath);\n+\n+ \/\/ Update index.\n+ self.seen.add(key);\n+ self.index.all.push(relPath);\n+\n+ if (expression.needsSuper) {\n+ self.index.superStatements.push(relPath);\n+ } else {\n+ self.index.statements.push(relPath);\n+ }\n+ }\n+ });\n+ }\n+\n+ writeIndex() {\n+ fs.writeFileSync(\n+ fsPath.join(this.outputDir, 'index.json'),\n+ JSON.stringify(this.index));\n+ }\n+}\n+\n+class MutateDb {\n+ constructor(outputDir) {\n+ this.outputDir = fsPath.resolve(outputDir);\n+ this.index = JSON.parse(\n+ fs.readFileSync(fsPath.join(outputDir, 'index.json'), 'utf-8'));\n+ }\n+\n+ getRandomStatement({canHaveSuper=false} = {}) {\n+ let choices;\n+ if (canHaveSuper) {\n+ choices = random.randInt(0, 1) ?\n+ this.index.all : this.index.superStatements;\n+ } else {\n+ choices = this.index.statements;\n+ }\n+\n+ let path = fsPath.join(\n+ this.outputDir, choices[random.randInt(0, choices.length - 1)]);\n+ return JSON.parse(fs.readFileSync(path), 'utf-8');\n+ }\n+}\n+\n+module.exports = {\n+ MutateDb: MutateDb,\n+ MutateDbWriter: MutateDbWriter,\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/differential_script_mutator.js b\/compiler\/forget\/packages\/js-fuzzer\/differential_script_mutator.js\nnew file mode 100644\nindex 0000000000..6c43f645af\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/differential_script_mutator.js\n@@ -0,0 +1,168 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Script mutator for differential fuzzing.\n+ *\/\n+\n+'use strict';\n+\n+const assert = require('assert');\n+const fs = require('fs');\n+const path = require('path');\n+\n+const common = require('.\/mutators\/common.js');\n+const random = require('.\/random.js');\n+const sourceHelpers = require('.\/source_helpers.js');\n+\n+const { filterDifferentialFuzzFlags } = require('.\/exceptions.js');\n+const { DifferentialFuzzMutator, DifferentialFuzzSuppressions } = require(\n+ '.\/mutators\/differential_fuzz_mutator.js');\n+const { ScriptMutator } = require('.\/script_mutator.js');\n+\n+\n+const USE_ORIGINAL_FLAGS_PROB = 0.2;\n+\n+\/**\n+ * Randomly chooses a configuration from experiments. The configuration\n+ * parameters are expected to be passed from a bundled V8 build. Constraints\n+ * mentioned below are enforced by PRESUBMIT checks on the V8 side.\n+ *\n+ * @param {Object[]} experiments List of tuples (probability, first config name,\n+ * second config name, second d8 name). The probabilities are integers in\n+ * [0,100]. We assume the sum of all probabilities is 100.\n+ * @param {Object[]} additionalFlags List of tuples (probability, flag strings).\n+ * Probability is in [0,1).\n+ * @return {string[]} List of flags for v8_foozzie.py.\n+ *\/\n+function chooseRandomFlags(experiments, additionalFlags) {\n+ \/\/ Add additional flags to second config based on experiment percentages.\n+ const extra_flags = [];\n+ for (const [p, flags] of additionalFlags) {\n+ if (random.choose(p)) {\n+ for (const flag of flags.split(' ')) {\n+ extra_flags.push('--second-config-extra-flags=' + flag);\n+ }\n+ }\n+ }\n+\n+ \/\/ Calculate flags determining the experiment.\n+ let acc = 0;\n+ const threshold = random.random() * 100;\n+ for (let [prob, first_config, second_config, second_d8] of experiments) {\n+ acc += prob;\n+ if (acc > threshold) {\n+ return [\n+ '--first-config=' + first_config,\n+ '--second-config=' + second_config,\n+ '--second-d8=' + second_d8,\n+ ].concat(extra_flags);\n+ }\n+ }\n+ \/\/ Unreachable.\n+ assert(false);\n+}\n+\n+function loadJSONFromBuild(name) {\n+ assert(process.env.APP_DIR);\n+ const fullPath = path.join(path.resolve(process.env.APP_DIR), name);\n+ return JSON.parse(fs.readFileSync(fullPath, 'utf-8'));\n+}\n+\n+function hasMjsunit(dependencies) {\n+ return dependencies.some(dep => dep.relPath.endsWith('mjsunit.js'));\n+}\n+\n+function hasJSTests(dependencies) {\n+ return dependencies.some(dep => dep.relPath.endsWith('jstest_stubs.js'));\n+}\n+\n+class DifferentialScriptMutator extends ScriptMutator {\n+ constructor(settings, db_path) {\n+ super(settings, db_path);\n+\n+ \/\/ Mutators for differential fuzzing.\n+ this.differential = [\n+ new DifferentialFuzzSuppressions(settings),\n+ new DifferentialFuzzMutator(settings),\n+ ];\n+\n+ \/\/ Flag configurations from the V8 build directory.\n+ this.experiments = loadJSONFromBuild('v8_fuzz_experiments.json');\n+ this.additionalFlags = loadJSONFromBuild('v8_fuzz_flags.json');\n+ }\n+\n+ \/**\n+ * Performes the high-level mutation and afterwards adds flags for the\n+ * v8_foozzie.py harness.\n+ *\/\n+ mutateMultiple(inputs) {\n+ const result = super.mutateMultiple(inputs);\n+ const originalFlags = [];\n+\n+ \/\/ Keep original JS flags in some cases. Let the harness pass them to\n+ \/\/ baseline _and_ comparison run.\n+ if (random.choose(USE_ORIGINAL_FLAGS_PROB)) {\n+ for (const flag of filterDifferentialFuzzFlags(result.flags)) {\n+ originalFlags.push('--first-config-extra-flags=' + flag);\n+ originalFlags.push('--second-config-extra-flags=' + flag);\n+ }\n+ }\n+\n+ \/\/ Add flags for the differnetial-fuzzing settings.\n+ const fuzzFlags = chooseRandomFlags(this.experiments, this.additionalFlags);\n+ result.flags = fuzzFlags.concat(originalFlags);\n+ return result;\n+ }\n+\n+ \/**\n+ * Mutatates a set of inputs.\n+ *\n+ * Additionally we prepare inputs by tagging each with the original source\n+ * path for later printing. The mutated sources are post-processed by the\n+ * differential-fuzz mutators, adding extra printing and other substitutions.\n+ *\/\n+ mutateInputs(inputs) {\n+ inputs.forEach(input => common.setOriginalPath(input, input.relPath));\n+\n+ const result = super.mutateInputs(inputs);\n+ this.differential.forEach(mutator => mutator.mutate(result));\n+ return result;\n+ }\n+\n+ \/**\n+ * Adds extra dependencies for differential fuzzing.\n+ *\/\n+ resolveDependencies(inputs) {\n+ const dependencies = super.resolveDependencies(inputs);\n+ \/\/ The suppression file neuters functions not working with differential\n+ \/\/ fuzzing. It can also be used to temporarily silence some functionality\n+ \/\/ leading to dupes of an active bug.\n+ dependencies.push(\n+ sourceHelpers.loadResource('differential_fuzz_suppressions.js'));\n+ \/\/ Extra printing and tracking functionality.\n+ dependencies.push(\n+ sourceHelpers.loadResource('differential_fuzz_library.js'));\n+ \/\/ Make Chakra tests print more.\n+ dependencies.push(\n+ sourceHelpers.loadResource('differential_fuzz_chakra.js'));\n+\n+ if (hasMjsunit(dependencies)) {\n+ \/\/ Make V8 tests print more. We guard this as the functionality\n+ \/\/ relies on mjsunit.js.\n+ dependencies.push(sourceHelpers.loadResource('differential_fuzz_v8.js'));\n+ }\n+\n+ if (hasJSTests(dependencies)) {\n+ dependencies.push(\n+ sourceHelpers.loadResource('differential_fuzz_jstest.js'));\n+ }\n+\n+ return dependencies;\n+ }\n+}\n+\n+module.exports = {\n+ DifferentialScriptMutator: DifferentialScriptMutator,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/exceptions.js b\/compiler\/forget\/packages\/js-fuzzer\/exceptions.js\nnew file mode 100644\nindex 0000000000..4269a383d1\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/exceptions.js\n@@ -0,0 +1,256 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Blacklists for fuzzer.\n+ *\/\n+\n+'use strict';\n+\n+const fs = require('fs');\n+const path = require('path');\n+\n+const random = require('.\/random.js');\n+\n+const {generatedSloppy, generatedSoftSkipped, generatedSkipped} = require(\n+ '.\/generated\/exceptions.js');\n+\n+const SKIPPED_FILES = [\n+ \/\/ Disabled for unexpected test behavior, specific to d8 shell.\n+ 'd8-os.js',\n+ 'd8-readbuffer.js',\n+\n+ \/\/ Passes JS flags.\n+ 'd8-arguments.js',\n+\n+ \/\/ Slow tests or tests that are too large to be used as input.\n+ \/numops-fuzz-part.*.js\/,\n+ 'regexp-pcre.js',\n+ 'unicode-test.js',\n+ 'unicodelctest.js',\n+ 'unicodelctest-no-optimization.js',\n+\n+ \/\/ Unsupported modules.\n+ \/^modules.*\\.js\/,\n+\n+ \/\/ Unsupported property escapes.\n+ \/^regexp-property-.*\\.js\/,\n+\n+ \/\/ Bad testcases that just loads a script that always throws errors.\n+ 'regress-444805.js',\n+ 'regress-crbug-489597.js',\n+ 'regress-crbug-620253.js',\n+\n+ \/\/ Just recursively loads itself.\n+ 'regress-8510.js',\n+];\n+\n+const SKIPPED_DIRECTORIES = [\n+ \/\/ Slow tests or tests that are too large to be used as input.\n+ 'embenchen',\n+ 'poppler',\n+ 'sqlite',\n+\n+ \/\/ Causes lots of failures.\n+ 'test262',\n+\n+ \/\/ Unavailable debug.Debug.\n+ 'v8\/test\/debugger',\n+ 'v8\/test\/inspector',\n+\n+ \/\/ Unsupported modules.\n+ 'v8\/test\/js-perf-test\/Modules',\n+\n+ \/\/ Contains tests expected to error out on parsing.\n+ 'v8\/test\/message',\n+\n+ \/\/ Needs specific dependencies for load of various tests.\n+ 'v8\/test\/mjsunit\/tools',\n+\n+ \/\/ Unsupported e4x standard.\n+ 'mozilla\/data\/e4x',\n+\n+ \/\/ Bails out fast without ReadableStream support.\n+ 'spidermonkey\/non262\/ReadableStream',\n+];\n+\n+\/\/ Files used with a lower probability.\n+const SOFT_SKIPPED_FILES = [\n+ \/\/ Tests with large binary content.\n+ \/^binaryen.*\\.js\/,\n+\n+ \/\/ Tests slow to parse.\n+ \/\/ CrashTests:\n+ \/^jquery.*\\.js\/,\n+ \/\/ Spidermonkey:\n+ 'regress-308085.js',\n+ 'regress-74474-002.js',\n+ 'regress-74474-003.js',\n+ \/\/ V8:\n+ 'object-literal.js',\n+];\n+\n+\/\/ Flags that lead to false positives or that are already passed by default.\n+const DISALLOWED_FLAGS = [\n+ \/\/ Disallowed because features prefixed with \"experimental\" are not\n+ \/\/ stabilized yet and would cause too much noise when enabled.\n+ \/^--experimental-.*\/,\n+\n+ \/\/ Disallowed due to noise. We explicitly add --harmony to job\n+ \/\/ definitions, and all of these features are staged before launch.\n+ \/^--harmony-.*\/,\n+\n+ \/\/ Disallowed because they are passed explicitly on the command line.\n+ '--allow-natives-syntax',\n+ '--debug-code',\n+ '--harmony',\n+ '--wasm-staging',\n+ '--expose-gc',\n+ '--expose_gc',\n+ '--icu-data-file',\n+ '--random-seed',\n+\n+ \/\/ Disallowed due to false positives.\n+ '--check-handle-count',\n+ '--correctness-fuzzer-suppressions',\n+ '--expose-debug-as',\n+ '--expose-natives-as',\n+ '--expose-trigger-failure',\n+ '--mock-arraybuffer-allocator',\n+ 'natives', \/\/ Used in conjuction with --expose-natives-as.\n+ \/^--trace-path.*\/,\n+];\n+\n+\/\/ Flags only used with 25% probability.\n+const LOW_PROB_FLAGS_PROB = 0.25;\n+const LOW_PROB_FLAGS = [\n+ \/\/ Flags that lead to slow test performance.\n+ \/^--gc-interval.*\/,\n+ \/^--deopt-every-n-times.*\/,\n+];\n+\n+\n+\/\/ Flags printing data, leading to false positives in differential fuzzing.\n+const DISALLOWED_DIFFERENTIAL_FUZZ_FLAGS = [\n+ \/^--gc-interval.*\/,\n+ \/^--perf.*\/,\n+ \/^--print.*\/,\n+ \/^--stress-runs.*\/,\n+ \/^--trace.*\/,\n+ '--expose-externalize-string',\n+ '--interpreted-frames-native-stack',\n+ '--validate-asm',\n+];\n+\n+const MAX_FILE_SIZE_BYTES = 128 * 1024; \/\/ 128KB\n+const MEDIUM_FILE_SIZE_BYTES = 32 * 1024; \/\/ 32KB\n+\n+function _findMatch(iterable, candidate) {\n+ for (const entry of iterable) {\n+ if (typeof entry === 'string') {\n+ if (entry === candidate) {\n+ return true;\n+ }\n+ } else {\n+ if (entry.test(candidate)) {\n+ return true;\n+ }\n+ }\n+ }\n+\n+ return false;\n+}\n+\n+function _doesntMatch(iterable, candidate) {\n+ return !_findMatch(iterable, candidate);\n+}\n+\n+\/\/ Convert Windows path separators.\n+function normalize(testPath) {\n+ return path.normalize(testPath).replace(\/\\\\\/g, '\/');\n+}\n+\n+function isTestSkippedAbs(absPath) {\n+ const basename = path.basename(absPath);\n+ if (_findMatch(SKIPPED_FILES, basename)) {\n+ return true;\n+ }\n+\n+ const normalizedTestPath = normalize(absPath);\n+ for (const entry of SKIPPED_DIRECTORIES) {\n+ if (normalizedTestPath.includes(entry)) {\n+ return true;\n+ }\n+ }\n+\n+ \/\/ Avoid OOM\/hangs through huge inputs.\n+ const stat = fs.statSync(absPath);\n+ return (stat && stat.size >= MAX_FILE_SIZE_BYTES);\n+}\n+\n+function isTestSkippedRel(relPath) {\n+ return generatedSkipped.has(normalize(relPath));\n+}\n+\n+\/\/ For testing.\n+function getSoftSkipped() {\n+ return SOFT_SKIPPED_FILES;\n+}\n+\n+\/\/ For testing.\n+function getGeneratedSoftSkipped() {\n+ return generatedSoftSkipped;\n+}\n+\n+\/\/ For testing.\n+function getGeneratedSloppy() {\n+ return generatedSloppy;\n+}\n+\n+function isTestSoftSkippedAbs(absPath) {\n+ const basename = path.basename(absPath);\n+ if (_findMatch(this.getSoftSkipped(), basename)) {\n+ return true;\n+ }\n+\n+ \/\/ Graylist medium size files.\n+ const stat = fs.statSync(absPath);\n+ return (stat && stat.size >= MEDIUM_FILE_SIZE_BYTES);\n+}\n+\n+function isTestSoftSkippedRel(relPath) {\n+ return this.getGeneratedSoftSkipped().has(normalize(relPath));\n+}\n+\n+function isTestSloppyRel(relPath) {\n+ return this.getGeneratedSloppy().has(normalize(relPath));\n+}\n+\n+function filterFlags(flags) {\n+ return flags.filter(flag => {\n+ return (\n+ _doesntMatch(DISALLOWED_FLAGS, flag) &&\n+ (_doesntMatch(LOW_PROB_FLAGS, flag) ||\n+ random.choose(LOW_PROB_FLAGS_PROB)));\n+ });\n+}\n+\n+function filterDifferentialFuzzFlags(flags) {\n+ return flags.filter(\n+ flag => _doesntMatch(DISALLOWED_DIFFERENTIAL_FUZZ_FLAGS, flag));\n+}\n+\n+\n+module.exports = {\n+ filterDifferentialFuzzFlags: filterDifferentialFuzzFlags,\n+ filterFlags: filterFlags,\n+ getGeneratedSoftSkipped: getGeneratedSoftSkipped,\n+ getGeneratedSloppy: getGeneratedSloppy,\n+ getSoftSkipped: getSoftSkipped,\n+ isTestSkippedAbs: isTestSkippedAbs,\n+ isTestSkippedRel: isTestSkippedRel,\n+ isTestSoftSkippedAbs: isTestSoftSkippedAbs,\n+ isTestSoftSkippedRel: isTestSoftSkippedRel,\n+ isTestSloppyRel: isTestSloppyRel,\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/foozzie_launcher.py b\/compiler\/forget\/packages\/js-fuzzer\/foozzie_launcher.py\nnew file mode 100644\nindex 0000000000..88d2afd1c1\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/foozzie_launcher.py\n@@ -0,0 +1,49 @@\n+#!\/usr\/bin\/env python3\n+# Copyright 2020 the V8 project authors. All rights reserved.\n+# Use of this source code is governed by a BSD-style license that can be\n+# found in the LICENSE file.\n+\n+\n+\"\"\"\n+Launcher for the foozzie differential-fuzzing harness. Wraps foozzie\n+with Python2 for backwards-compatibility when bisecting.\n+\n+Obsolete now after switching to Python3 entirely. We keep the launcher\n+for a transition period.\n+\"\"\"\n+\n+import os\n+import re\n+import shutil\n+import subprocess\n+import sys\n+\n+def find_harness_code(args):\n+ for arg in args:\n+ if arg.endswith('v8_foozzie.py'):\n+ with open(arg) as f:\n+ return f.read()\n+ assert False, 'Foozzie harness not found'\n+\n+if __name__ == '__main__':\n+ # In some cases or older versions, the python executable is passed as\n+ # first argument. Let's be robust either way, with or without full\n+ # path or version.\n+ if re.match(r'.*python.*', sys.argv[1]):\n+ args = sys.argv[2:]\n+ else:\n+ args = sys.argv[1:]\n+\n+ python_exe = 'python3'\n+\n+ # To ease bisection of really old bugs, attempt to use Python2 as long\n+ # as it is supported. This enables bisection before the point where the\n+ # harness switched to Python3.\n+ script = find_harness_code(args)\n+ use_python3 = script.startswith('#!\/usr\/bin\/env python3')\n+ if not use_python3 and shutil.which('python2'):\n+ python_exe = 'python2'\n+\n+ process = subprocess.Popen([python_exe] + args)\n+ process.communicate()\n+ sys.exit(process.returncode)\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/gen_exceptions.js b\/compiler\/forget\/packages\/js-fuzzer\/gen_exceptions.js\nnew file mode 100644\nindex 0000000000..19e40ed970\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/gen_exceptions.js\n@@ -0,0 +1,196 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Generate exceptions from full corpus test report.\n+ *\/\n+\n+const program = require('commander');\n+\n+const assert = require('assert');\n+const babelGenerator = require('@babel\/generator').default;\n+const babelTemplate = require('@babel\/template').default;\n+const babelTypes = require('@babel\/types');\n+const fs = require('fs');\n+const p = require('path');\n+const prettier = require(\"prettier\");\n+\n+const SPLIT_LINES_RE = \/^.*([\\n\\r]+|$)\/gm;\n+const PARSE_RE = \/^Parsing (.*) sloppy took (\\d+) ms\\.\\n$\/;\n+const MUTATE_RE = \/^Mutating (.*) took (\\d+) ms\\.\\n$\/;\n+const PARSE_FAILED_RE = \/^WARNING: failed to sloppy parse (.*)\\n$\/;\n+const PARSE_STRICT_FAILED_RE = \/^WARNING: failed to strict parse (.*)\\n$\/;\n+const MUTATE_FAILED_RE = \/^ERROR: Exception during mutate: (.*)\\n$\/;\n+\n+\/\/ Add tests matching error regexp to result array.\n+function matchError(regexp, line, resultArray){\n+ const match = line.match(regexp);\n+ if (!match) return false;\n+ const relPath = match[1];\n+ assert(relPath);\n+ resultArray.push(relPath);\n+ return true;\n+}\n+\n+\/\/ Sum up total duration of tests matching the duration regexp and\n+\/\/ map test -> duration in result map.\n+function matchDuration(regexp, line, resultMap){\n+ const match = line.match(regexp);\n+ if (!match) return false;\n+ const relPath = match[1];\n+ assert(relPath);\n+ resultMap[relPath] = (resultMap[relPath] || 0) + parseInt(match[2]);\n+ return true;\n+}\n+\n+\/\/ Create lists of failed and slow tests from stdout of a fuzzer run.\n+function processFuzzOutput(outputFile){\n+ const text = fs.readFileSync(outputFile, 'utf-8');\n+ const lines = text.match(SPLIT_LINES_RE);\n+\n+ const failedParse = [];\n+ const failedParseStrict = [];\n+ const failedMutate = [];\n+ const durationsMap = {};\n+\n+ for (const line of lines) {\n+ if (matchError(PARSE_FAILED_RE, line, failedParse))\n+ continue;\n+ if (matchError(PARSE_STRICT_FAILED_RE, line, failedParseStrict))\n+ continue;\n+ if (matchError(MUTATE_FAILED_RE, line, failedMutate))\n+ continue;\n+ if (matchDuration(PARSE_RE, line, durationsMap))\n+ continue;\n+ if (matchDuration(MUTATE_RE, line, durationsMap))\n+ continue;\n+ }\n+\n+ \/\/ Tuples (absPath, duration).\n+ const total = Object.entries(durationsMap);\n+ \/\/ Tuples (absPath, duration) with 2s < duration <= 10s.\n+ const slow = total.filter(t => t[1] > 2000 && t[1] <= 10000);\n+ \/\/ Tuples (absPath, duration) with 10s < duration.\n+ const verySlow = total.filter(t => t[1] > 10000);\n+\n+ \/\/ Assert there's nothing horribly wrong with the results.\n+ \/\/ We have at least 2500 tests in the output.\n+ assert(total.length > 2500);\n+ \/\/ No more than 5% parse\/mutation errors.\n+ assert(failedParse.length + failedMutate.length < total.length \/ 20);\n+ \/\/ No more than 10% slow tests\n+ assert(slow.length < total.length \/ 10);\n+ \/\/ No more than 2% very slow tests.\n+ assert(verySlow.length < total.length \/ 50);\n+\n+ \/\/ Sort everything.\n+ failedParse.sort();\n+ failedParseStrict.sort();\n+ failedMutate.sort();\n+\n+ function slowestFirst(a, b) {\n+ return b[1] - a[1];\n+ }\n+\n+ slow.sort(slowestFirst);\n+ verySlow.sort(slowestFirst);\n+\n+ return [failedParse, failedParseStrict, failedMutate, slow, verySlow];\n+}\n+\n+\/\/ List of string literals of failed tests.\n+function getLiteralsForFailed(leadingComment, failedList) {\n+ const result = failedList.map(path => babelTypes.stringLiteral(path));\n+ if (result.length) {\n+ babelTypes.addComment(result[0], 'leading', leadingComment);\n+ }\n+ return result;\n+}\n+\n+\/\/ List of string literals of slow tests with duration comments.\n+function getLiteralsForSlow(leadingComment, slowList) {\n+ const result = slowList.map(([path, duration]) => {\n+ const literal = babelTypes.stringLiteral(path);\n+ babelTypes.addComment(\n+ literal, 'trailing', ` ${duration \/ 1000}s`, true);\n+ return literal;\n+ });\n+ if (result.length) {\n+ babelTypes.addComment(result[0], 'leading', leadingComment);\n+ }\n+ return result;\n+}\n+\n+function main() {\n+ program\n+ .version('0.0.1')\n+ .parse(process.argv);\n+\n+ if (!program.args.length) {\n+ console.log('Need to specify stdout reports of fuzz runs.');\n+ return;\n+ }\n+\n+ let skipped = [];\n+ let softSkipped = [];\n+ let sloppy = [];\n+ for (const outputFile of program.args) {\n+ const [failedParse, failedParseStrict, failedMutate, slow, verySlow] = (\n+ processFuzzOutput(outputFile));\n+ const name = p.basename(outputFile, p.extname(outputFile));\n+\n+ \/\/ Skip tests that fail to parse\/mutate or are very slow.\n+ skipped = skipped.concat(getLiteralsForFailed(\n+ ` Tests with parse errors from ${name} `, failedParse));\n+ skipped = skipped.concat(getLiteralsForFailed(\n+ ` Tests with mutation errors from ${name} `, failedMutate));\n+ skipped = skipped.concat(getLiteralsForSlow(\n+ ` Very slow tests from ${name} `, verySlow));\n+\n+ \/\/ Soft-skip slow but not very slow tests.\n+ softSkipped = softSkipped.concat(getLiteralsForSlow(\n+ ` Slow tests from ${name} `, slow));\n+\n+ \/\/ Mark sloppy tests.\n+ sloppy = sloppy.concat(getLiteralsForFailed(\n+ ` Tests requiring sloppy mode from ${name} `, failedParseStrict));\n+ }\n+\n+ const fileTemplate = babelTemplate(`\n+ \/**\n+ * @fileoverview Autogenerated exceptions. Created with gen_exceptions.js.\n+ *\/\n+\n+ 'use strict';\n+\n+ const skipped = SKIPPED;\n+\n+ const softSkipped = SOFTSKIPPED;\n+\n+ const sloppy = SLOPPY;\n+\n+ module.exports = {\n+ generatedSkipped: new Set(skipped),\n+ generatedSoftSkipped: new Set(softSkipped),\n+ generatedSloppy: new Set(sloppy),\n+ }\n+ `, {preserveComments: true});\n+\n+ const skippedArray = babelTypes.arrayExpression(skipped);\n+ const softSkippedArray = babelTypes.arrayExpression(softSkipped);\n+ const sloppyArray = babelTypes.arrayExpression(sloppy);\n+\n+ const statements = fileTemplate({\n+ SKIPPED: skippedArray,\n+ SOFTSKIPPED: softSkippedArray,\n+ SLOPPY: sloppyArray,\n+ });\n+\n+ const resultProgram = babelTypes.program(statements);\n+ const code = babelGenerator(resultProgram, { comments: true }).code;\n+ const prettyCode = prettier.format(code, { parser: \"babel\" });\n+ fs.writeFileSync('generated\/exceptions.js', prettyCode);\n+}\n+\n+main();\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/gen_exceptions.sh b\/compiler\/forget\/packages\/js-fuzzer\/gen_exceptions.sh\nnew file mode 100755\nindex 0000000000..b2a90b8bd2\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/gen_exceptions.sh\n@@ -0,0 +1,12 @@\n+#!\/bin\/bash\n+# Copyright 2020 the V8 project authors. All rights reserved.\n+# Use of this source code is governed by a BSD-style license that can be\n+# found in the LICENSE file.\n+\n+APP_NAME=d8 node run.js -i $WEB_TESTS -o $OUTPUT -z -v -e -c chakra > chakra.log\n+APP_NAME=d8 node run.js -i $WEB_TESTS -o $OUTPUT -z -v -e -c v8 > v8.log\n+APP_NAME=d8 node run.js -i $WEB_TESTS -o $OUTPUT -z -v -e -c spidermonkey > spidermonkey.log\n+APP_NAME=d8 node run.js -i $WEB_TESTS -o $OUTPUT -z -v -e -c WebKit\/JSTests > jstests.log\n+APP_NAME=d8 node run.js -i $WEB_TESTS -o $OUTPUT -z -v -e -c CrashTests > crashtests.log\n+\n+node gen_exceptions.js v8.log spidermonkey.log chakra.log jstests.log crashtests.log\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/array_mutator.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/array_mutator.js\nnew file mode 100644\nindex 0000000000..bcfb601436\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/array_mutator.js\n@@ -0,0 +1,115 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Mutator for array expressions.\n+ *\/\n+\n+'use strict';\n+\n+const babelTypes = require('@babel\/types');\n+\n+const common = require('.\/common.js');\n+const mutator = require('.\/mutator.js');\n+const random = require('..\/random.js');\n+\n+\/\/ Blueprint for choosing the maximum number of mutations. Bias towards\n+\/\/ performing only one mutation.\n+const MUTATION_CHOICES = [1, 1, 1, 1, 1, 2, 2, 2, 3];\n+\n+const MAX_ARRAY_LENGTH = 50;\n+\n+class ArrayMutator extends mutator.Mutator {\n+ constructor(settings) {\n+ super();\n+ this.settings = settings;\n+ }\n+\n+ get visitor() {\n+ const thisMutator = this;\n+\n+ return {\n+ ArrayExpression(path) {\n+ const elements = path.node.elements;\n+ if (!random.choose(thisMutator.settings.MUTATE_ARRAYS) ||\n+ elements.length > MAX_ARRAY_LENGTH) {\n+ return;\n+ }\n+\n+ \/\/ Annotate array expression with the action taken, indicating\n+ \/\/ if we also replaced elements.\n+ function annotate(message, replace) {\n+ if (replace) message += ' (replaced)';\n+ thisMutator.annotate(path.node, message);\n+ }\n+\n+ \/\/ Add or replace elements at a random index.\n+ function randomSplice(replace, ...args) {\n+ \/\/ Choose an index that's small enough to replace all desired items.\n+ const index = random.randInt(0, elements.length - replace);\n+ elements.splice(index, replace, ...args);\n+ }\n+\n+ function duplicateElement(replace) {\n+ const element = random.single(elements);\n+ if (!element || common.isLargeNode(element)) {\n+ return;\n+ }\n+ annotate('Duplicate an element', replace);\n+ randomSplice(replace, babelTypes.cloneDeep(element));\n+ }\n+\n+ function insertRandomValue(replace) {\n+ annotate('Insert a random value', replace);\n+ randomSplice(replace, common.randomValue(path));\n+ }\n+\n+ function insertHole(replace) {\n+ annotate('Insert a hole', replace);\n+ randomSplice(replace, null);\n+ }\n+\n+ function removeElements(count) {\n+ annotate('Remove elements');\n+ randomSplice(random.randInt(1, count));\n+ }\n+\n+ function shuffle() {\n+ annotate('Shuffle array');\n+ random.shuffle(elements);\n+ }\n+\n+ \/\/ Mutation options. Repeated mutations have a higher probability.\n+ const mutations = [\n+ () => duplicateElement(1),\n+ () => duplicateElement(1),\n+ () => duplicateElement(1),\n+ () => duplicateElement(0),\n+ () => duplicateElement(0),\n+ () => insertRandomValue(1),\n+ () => insertRandomValue(1),\n+ () => insertRandomValue(0),\n+ () => insertHole(1),\n+ () => insertHole(0),\n+ () => removeElements(1),\n+ () => removeElements(elements.length),\n+ shuffle,\n+ ];\n+\n+ \/\/ Perform several mutations.\n+ const count = random.single(MUTATION_CHOICES);\n+ for (let i = 0; i < count; i++) {\n+ random.single(mutations)();\n+ }\n+\n+ \/\/ Don't recurse on nested arrays.\n+ path.skip();\n+ },\n+ }\n+ }\n+}\n+\n+module.exports = {\n+ ArrayMutator: ArrayMutator,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/common.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/common.js\nnew file mode 100644\nindex 0000000000..64a164583e\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/common.js\n@@ -0,0 +1,376 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Common mutator utilities.\n+ *\/\n+\n+const babelTemplate = require('@babel\/template').default;\n+const babelTypes = require('@babel\/types');\n+const babylon = require('@babel\/parser');\n+\n+const sourceHelpers = require('..\/source_helpers.js');\n+const random = require('..\/random.js');\n+\n+const INTERESTING_NUMBER_VALUES = [\n+ -1, -0.0, 0, 1,\n+\n+ \/\/ Float values.\n+ -0.000000000000001, 0.000000000000001,\n+\n+ \/\/ Special values.\n+ NaN, +Infinity, -Infinity,\n+\n+ \/\/ Boundaries of int, signed, unsigned, SMI (near +\/- 2^(30, 31, 32).\n+ 0x03fffffff, 0x040000000, 0x040000001,\n+ -0x03fffffff, -0x040000000, -0x040000001,\n+ 0x07fffffff, 0x080000000, 0x080000001,\n+ -0x07fffffff, -0x080000000, -0x080000001,\n+ 0x0ffffffff, 0x100000000, 0x100000001,\n+ -0x0ffffffff, -0x100000000, -0x100000001,\n+\n+ \/\/ Boundaries of maximum safe integer (near +\/- 2^53).\n+ 9007199254740990, 9007199254740991, 9007199254740992,\n+ -9007199254740990, -9007199254740991, -9007199254740992,\n+\n+ \/\/ Boundaries of double.\n+ 5e-324, 1.7976931348623157e+308,\n+ -5e-324,-1.7976931348623157e+308,\n+]\n+\n+const INTERESTING_NON_NUMBER_VALUES = [\n+ \/\/ Simple arrays.\n+ '[]',\n+ 'Array(0x8000).fill(\"a\")',\n+\n+ \/\/ Simple object.\n+ '{}',\n+ '{a: \"foo\", b: 10, c: {}}',\n+\n+ \/\/ Simple strings.\n+ '\"foo\"',\n+ '\"\"',\n+\n+ \/\/ Simple regex.\n+ '\/0\/',\n+ '\"\/0\/\"',\n+\n+ \/\/ Simple symbol.\n+ 'Symbol(\"foo\")',\n+\n+ \/\/ Long string.\n+ 'Array(0x8000).join(\"a\")',\n+\n+ \/\/ Math.PI\n+ 'Math.PI',\n+\n+ \/\/ Others.\n+ 'false',\n+ 'true',\n+ 'undefined',\n+ 'null',\n+ 'this',\n+ 'this[0]',\n+ 'this[1]',\n+\n+ \/\/ Empty function.\n+ '(function() {return 0;})',\n+\n+ \/\/ Objects with functions.\n+ '({toString:function(){return \"0\";}})',\n+ '({valueOf:function(){return 0;}})',\n+ '({valueOf:function(){return \"0\";}})',\n+\n+ \/\/ Objects for primitive types created using new.\n+ '(new Boolean(false))',\n+ '(new Boolean(true))',\n+ '(new String(\"\"))',\n+ '(new Number(0))',\n+ '(new Number(-0))',\n+]\n+\n+const LARGE_NODE_SIZE = 100;\n+const MAX_ARGUMENT_COUNT = 10;\n+\n+function _identifier(identifier) {\n+ return babelTypes.identifier(identifier);\n+}\n+\n+function _numericLiteral(number) {\n+ return babelTypes.numericLiteral(number);\n+}\n+\n+function _unwrapExpressionStatement(value) {\n+ if (babelTypes.isExpressionStatement(value)) {\n+ return value.expression;\n+ }\n+\n+ return value;\n+}\n+\n+function isVariableIdentifier(name) {\n+ return \/__v_[0-9]+\/.test(name);\n+}\n+\n+function isFunctionIdentifier(name) {\n+ return \/__f_[0-9]+\/.test(name);\n+}\n+\n+function isInForLoopCondition(path) {\n+ \/\/ Return whether if we're in the init\/test\/update parts of a for loop (but\n+ \/\/ not the body). Mutating variables in the init\/test\/update will likely\n+ \/\/ modify loop variables and cause infinite loops.\n+ const forStatementChild = path.find(\n+ p => p.parent && babelTypes.isForStatement(p.parent));\n+\n+ return (forStatementChild && forStatementChild.parentKey !== 'body');\n+}\n+\n+function isInWhileLoop(path) {\n+ \/\/ Return whether if we're in a while loop.\n+ const whileStatement = path.find(p => babelTypes.isWhileStatement(p));\n+ return Boolean(whileStatement);\n+}\n+\n+function _availableIdentifiers(path, filter) {\n+ \/\/ TODO(ochang): Consider globals that aren't declared with let\/var etc.\n+ const available = new Array();\n+ const allBindings = path.scope.getAllBindings();\n+ for (const key of Object.keys(allBindings)) {\n+ if (!filter(key)) {\n+ continue;\n+ }\n+\n+ if (filter === isVariableIdentifier &&\n+ path.willIMaybeExecuteBefore(allBindings[key].path)) {\n+ continue;\n+ }\n+\n+ available.push(_identifier(key));\n+ }\n+\n+ return available;\n+}\n+\n+function availableVariables(path) {\n+ return _availableIdentifiers(path, isVariableIdentifier);\n+}\n+\n+function availableFunctions(path) {\n+ return _availableIdentifiers(path, isFunctionIdentifier);\n+}\n+\n+function randomVariable(path) {\n+ return random.single(availableVariables(path));\n+}\n+\n+function randomFunction(path) {\n+ return random.single(availableFunctions(path));\n+}\n+\n+function randomSeed() {\n+ return random.randInt(0, 2**20);\n+}\n+\n+function randomObject(seed) {\n+ if (seed === undefined) {\n+ seed = randomSeed();\n+ }\n+\n+ const template = babelTemplate('__getRandomObject(SEED)');\n+ return template({\n+ SEED: _numericLiteral(seed),\n+ }).expression;\n+}\n+\n+function randomProperty(identifier, seed) {\n+ if (seed === undefined) {\n+ seed = randomSeed();\n+ }\n+\n+ const template = babelTemplate('__getRandomProperty(IDENTIFIER, SEED)');\n+ return template({\n+ IDENTIFIER: identifier,\n+ SEED: _numericLiteral(seed),\n+ }).expression;\n+}\n+\n+function randomArguments(path) {\n+ const numArgs = random.randInt(0, MAX_ARGUMENT_COUNT);\n+ const args = [];\n+\n+ for (let i = 0; i < numArgs; i++) {\n+ args.push(randomValue(path));\n+ }\n+\n+ return args.map(_unwrapExpressionStatement);\n+}\n+\n+function randomValue(path) {\n+ const probability = random.random();\n+\n+ if (probability < 0.01) {\n+ const randomFunc = randomFunction(path);\n+ if (randomFunc) {\n+ return randomFunc;\n+ }\n+ }\n+\n+ if (probability < 0.25) {\n+ const randomVar = randomVariable(path);\n+ if (randomVar) {\n+ return randomVar;\n+ }\n+ }\n+\n+ if (probability < 0.5) {\n+ return randomInterestingNumber();\n+ }\n+\n+ if (probability < 0.75) {\n+ return randomInterestingNonNumber();\n+ }\n+\n+ return randomObject();\n+}\n+\n+function callRandomFunction(path, identifier, seed) {\n+ if (seed === undefined) {\n+ seed = randomSeed();\n+ }\n+\n+ let args = [\n+ identifier,\n+ _numericLiteral(seed)\n+ ];\n+\n+ args = args.map(_unwrapExpressionStatement);\n+ args = args.concat(randomArguments(path));\n+\n+ return babelTypes.callExpression(\n+ babelTypes.identifier('__callRandomFunction'),\n+ args);\n+}\n+\n+function nearbyRandomNumber(value) {\n+ const probability = random.random();\n+\n+ if (probability < 0.9) {\n+ return _numericLiteral(value + random.randInt(-0x10, 0x10));\n+ } else if (probability < 0.95) {\n+ return _numericLiteral(value + random.randInt(-0x100, 0x100));\n+ } else if (probability < 0.99) {\n+ return _numericLiteral(value + random.randInt(-0x1000, 0x1000));\n+ }\n+\n+ return _numericLiteral(value + random.randInt(-0x10000, 0x10000));\n+}\n+\n+function randomInterestingNumber() {\n+ const value = random.single(INTERESTING_NUMBER_VALUES);\n+ if (random.choose(0.05)) {\n+ return nearbyRandomNumber(value);\n+ }\n+ return _numericLiteral(value);\n+}\n+\n+function randomInterestingNonNumber() {\n+ return babylon.parseExpression(random.single(INTERESTING_NON_NUMBER_VALUES));\n+}\n+\n+function concatFlags(inputs) {\n+ const flags = new Set();\n+ for (const input of inputs) {\n+ for (const flag of input.flags || []) {\n+ flags.add(flag);\n+ }\n+ }\n+ return Array.from(flags.values());\n+}\n+\n+function concatPrograms(inputs) {\n+ \/\/ Concatentate programs.\n+ const resultProgram = babelTypes.program([]);\n+ const result = babelTypes.file(resultProgram, [], null);\n+\n+ for (const input of inputs) {\n+ const ast = input.ast.program;\n+ resultProgram.body = resultProgram.body.concat(ast.body);\n+ resultProgram.directives = resultProgram.directives.concat(ast.directives);\n+ }\n+\n+ \/\/ TODO(machenbach): Concat dependencies here as soon as they are cached.\n+ const combined = new sourceHelpers.ParsedSource(\n+ result, '', '', concatFlags(inputs));\n+ \/\/ If any input file is sloppy, the combined result is sloppy.\n+ combined.sloppy = inputs.some(input => input.isSloppy());\n+ return combined;\n+}\n+\n+function setSourceLoc(source, index, total) {\n+ const noop = babelTypes.noop();\n+ noop.__loc = index \/ total;\n+ noop.__self = noop;\n+ source.ast.program.body.unshift(noop);\n+}\n+\n+function getSourceLoc(node) {\n+ \/\/ Source location is invalid in cloned nodes.\n+ if (node !== node.__self) {\n+ return undefined;\n+ }\n+ return node.__loc;\n+}\n+\n+function setOriginalPath(source, originalPath) {\n+ const noop = babelTypes.noop();\n+ noop.__path = originalPath;\n+ noop.__self = noop;\n+ source.ast.program.body.unshift(noop);\n+}\n+\n+function getOriginalPath(node) {\n+ \/\/ Original path is invalid in cloned nodes.\n+ if (node !== node.__self) {\n+ return undefined;\n+ }\n+ return node.__path;\n+}\n+\n+\/\/ Estimate the size of a node in raw source characters.\n+function isLargeNode(node) {\n+ \/\/ Ignore array holes inserted by us (null) or previously cloned nodes\n+ \/\/ (they have no start\/end).\n+ if (!node || node.start === undefined || node.end === undefined ) {\n+ return false;\n+ }\n+ return node.end - node.start > LARGE_NODE_SIZE;\n+}\n+\n+module.exports = {\n+ callRandomFunction: callRandomFunction,\n+ concatFlags: concatFlags,\n+ concatPrograms: concatPrograms,\n+ availableVariables: availableVariables,\n+ availableFunctions: availableFunctions,\n+ randomFunction: randomFunction,\n+ randomVariable: randomVariable,\n+ isInForLoopCondition: isInForLoopCondition,\n+ isInWhileLoop: isInWhileLoop,\n+ isLargeNode: isLargeNode,\n+ isVariableIdentifier: isVariableIdentifier,\n+ isFunctionIdentifier: isFunctionIdentifier,\n+ nearbyRandomNumber: nearbyRandomNumber,\n+ randomArguments: randomArguments,\n+ randomInterestingNonNumber: randomInterestingNonNumber,\n+ randomInterestingNumber: randomInterestingNumber,\n+ randomObject: randomObject,\n+ randomProperty: randomProperty,\n+ randomSeed: randomSeed,\n+ randomValue: randomValue,\n+ getOriginalPath: getOriginalPath,\n+ setOriginalPath: setOriginalPath,\n+ getSourceLoc: getSourceLoc,\n+ setSourceLoc: setSourceLoc,\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/crossover_mutator.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/crossover_mutator.js\nnew file mode 100644\nindex 0000000000..491501dc5c\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/crossover_mutator.js\n@@ -0,0 +1,85 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Expression mutator.\n+ *\/\n+\n+'use strict';\n+\n+const babelTemplate = require('@babel\/template').default;\n+\n+const common = require('.\/common.js');\n+const random = require('..\/random.js');\n+const mutator = require('.\/mutator.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+\n+class CrossOverMutator extends mutator.Mutator {\n+ constructor(settings, db) {\n+ super();\n+ this.settings = settings;\n+ this.db = db;\n+ }\n+\n+ get visitor() {\n+ const thisMutator = this;\n+\n+ return [{\n+ ExpressionStatement(path) {\n+ if (!random.choose(thisMutator.settings.MUTATE_CROSSOVER_INSERT)) {\n+ return;\n+ }\n+\n+ const canHaveSuper = Boolean(path.findParent(x => x.isClassMethod()));\n+ const randomExpression = thisMutator.db.getRandomStatement(\n+ {canHaveSuper: canHaveSuper});\n+\n+ \/\/ Insert the statement.\n+ let toInsert = babelTemplate(\n+ randomExpression.source,\n+ sourceHelpers.BABYLON_REPLACE_VAR_OPTIONS);\n+ const dependencies = {};\n+\n+ if (randomExpression.dependencies) {\n+ const variables = common.availableVariables(path);\n+ if (!variables.length) {\n+ return;\n+ }\n+ for (const dependency of randomExpression.dependencies) {\n+ dependencies[dependency] = random.single(variables);\n+ }\n+ }\n+\n+ try {\n+ toInsert = toInsert(dependencies);\n+ } catch (e) {\n+ if (thisMutator.settings.testing) {\n+ \/\/ Fail early in tests.\n+ throw e;\n+ }\n+ console.log('ERROR: Failed to parse:', randomExpression.source);\n+ console.log(e);\n+ return;\n+ }\n+\n+ thisMutator.annotate(\n+ toInsert,\n+ 'Crossover from ' + randomExpression.originalPath);\n+\n+ if (random.choose(0.5)) {\n+ thisMutator.insertBeforeSkip(path, toInsert);\n+ } else {\n+ thisMutator.insertAfterSkip(path, toInsert);\n+ }\n+\n+ path.skip();\n+ },\n+ }, {\n+ }];\n+ }\n+}\n+\n+module.exports = {\n+ CrossOverMutator: CrossOverMutator,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/differential_fuzz_mutator.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/differential_fuzz_mutator.js\nnew file mode 100644\nindex 0000000000..92c8df689c\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/differential_fuzz_mutator.js\n@@ -0,0 +1,225 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Mutator for differential fuzzing.\n+ *\/\n+\n+'use strict';\n+\n+const babelTemplate = require('@babel\/template').default;\n+const babelTypes = require('@babel\/types');\n+\n+const common = require('.\/common.js');\n+const mutator = require('.\/mutator.js');\n+const random = require('..\/random.js');\n+\n+\/\/ Templates for various statements.\n+const incCaught = babelTemplate('__caught++;');\n+const printValue = babelTemplate('print(VALUE);');\n+const printCaught = babelTemplate('print(\"Caught: \" + __caught);');\n+const printHash = babelTemplate('print(\"Hash: \" + __hash);');\n+const prettyPrint = babelTemplate('__prettyPrint(ID);');\n+const prettyPrintExtra = babelTemplate('__prettyPrintExtra(ID);');\n+\n+\/\/ This section prefix is expected by v8_foozzie.py. Existing prefixes\n+\/\/ (e.g. from CrashTests) are cleaned up with CLEANED_PREFIX.\n+const SECTION_PREFIX = 'v8-foozzie source: ';\n+const CLEANED_PREFIX = 'v***************e: ';\n+\n+\/**\n+ * Babel statement for calling deep printing from the fuzz library.\n+ *\/\n+function prettyPrintStatement(variable) {\n+ return prettyPrint({ ID: babelTypes.cloneDeep(variable) });\n+}\n+\n+\/**\n+ * As above, but using the \"extra\" variant, which will reduce printing\n+ * after too many calls to prevent I\/O flooding.\n+ *\/\n+function prettyPrintExtraStatement(variable) {\n+ return prettyPrintExtra({ ID: babelTypes.cloneDeep(variable) });\n+}\n+\n+\/**\n+ * Mutator for suppressing known and\/or unfixable issues.\n+ *\/\n+class DifferentialFuzzSuppressions extends mutator.Mutator {\n+ get visitor() {\n+ let thisMutator = this;\n+\n+ return {\n+ \/\/ Clean up strings containing the magic section prefix. Those can come\n+ \/\/ e.g. from CrashTests and would confuse the deduplication in\n+ \/\/ v8_foozzie.py.\n+ StringLiteral(path) {\n+ if (path.node.value.startsWith(SECTION_PREFIX)) {\n+ const postfix = path.node.value.substring(SECTION_PREFIX.length);\n+ path.node.value = CLEANED_PREFIX + postfix;\n+ thisMutator.annotate(path.node, 'Replaced magic string');\n+ }\n+ },\n+ \/\/ Known precision differences: https:\/\/crbug.com\/1063568\n+ BinaryExpression(path) {\n+ if (path.node.operator == '**') {\n+ path.node.operator = '+';\n+ thisMutator.annotate(path.node, 'Replaced **');\n+ }\n+ },\n+ \/\/ Unsupported language feature: https:\/\/crbug.com\/1020573\n+ MemberExpression(path) {\n+ if (path.node.property.name == \"arguments\") {\n+ let replacement = common.randomVariable(path);\n+ if (!replacement) {\n+ replacement = babelTypes.thisExpression();\n+ }\n+ thisMutator.annotate(replacement, 'Replaced .arguments');\n+ thisMutator.replaceWithSkip(path, replacement);\n+ }\n+ },\n+ };\n+ }\n+}\n+\n+\/**\n+ * Mutator for tracking original input files and for extra printing.\n+ *\/\n+class DifferentialFuzzMutator extends mutator.Mutator {\n+ constructor(settings) {\n+ super();\n+ this.settings = settings;\n+ }\n+\n+ \/**\n+ * Looks for the dummy node that marks the beginning of an input file\n+ * from the corpus.\n+ *\/\n+ isSectionStart(path) {\n+ return !!common.getOriginalPath(path.node);\n+ }\n+\n+ \/**\n+ * Create print statements for printing the magic section prefix that's\n+ * expected by v8_foozzie.py to differentiate different source files.\n+ *\/\n+ getSectionHeader(path) {\n+ const orig = common.getOriginalPath(path.node);\n+ return printValue({\n+ VALUE: babelTypes.stringLiteral(SECTION_PREFIX + orig),\n+ });\n+ }\n+\n+ \/**\n+ * Create statements for extra printing at the end of a section. We print\n+ * the number of caught exceptions, a generic hash of all observed values\n+ * and the contents of all variables in scope.\n+ *\/\n+ getSectionFooter(path) {\n+ const variables = common.availableVariables(path);\n+ const statements = variables.map(prettyPrintStatement);\n+ statements.unshift(printCaught());\n+ statements.unshift(printHash());\n+ const statement = babelTypes.tryStatement(\n+ babelTypes.blockStatement(statements),\n+ babelTypes.catchClause(\n+ babelTypes.identifier('e'),\n+ babelTypes.blockStatement([])));\n+ this.annotate(statement, 'Print variables and exceptions from section');\n+ return statement;\n+ }\n+\n+ \/**\n+ * Helper for printing the contents of several variables.\n+ *\/\n+ printVariables(path, nodes) {\n+ const statements = [];\n+ for (const node of nodes) {\n+ if (!babelTypes.isIdentifier(node) ||\n+ !common.isVariableIdentifier(node.name))\n+ continue;\n+ statements.push(prettyPrintExtraStatement(node));\n+ }\n+ if (statements.length) {\n+ this.annotate(statements[0], 'Extra variable printing');\n+ this.insertAfterSkip(path, statements);\n+ }\n+ }\n+\n+ get visitor() {\n+ const thisMutator = this;\n+ const settings = this.settings;\n+\n+ return {\n+ \/\/ Replace existing normal print statements with deep printing.\n+ CallExpression(path) {\n+ if (babelTypes.isIdentifier(path.node.callee) &&\n+ path.node.callee.name == 'print') {\n+ path.node.callee = babelTypes.identifier('__prettyPrintExtra');\n+ thisMutator.annotate(path.node, 'Pretty printing');\n+ }\n+ },\n+ \/\/ Either print or track caught exceptions, guarded by a probability.\n+ CatchClause(path) {\n+ const probability = random.random();\n+ if (probability < settings.DIFF_FUZZ_EXTRA_PRINT &&\n+ path.node.param &&\n+ babelTypes.isIdentifier(path.node.param)) {\n+ const statement = prettyPrintExtraStatement(path.node.param);\n+ path.node.body.body.unshift(statement);\n+ } else if (probability < settings.DIFF_FUZZ_TRACK_CAUGHT) {\n+ path.node.body.body.unshift(incCaught());\n+ }\n+ },\n+ \/\/ Insert section headers and footers between the contents of two\n+ \/\/ original source files. We detect the dummy no-op nodes that were\n+ \/\/ previously tagged with the original path of the file.\n+ Noop(path) {\n+ if (!thisMutator.isSectionStart(path)) {\n+ return;\n+ }\n+ const header = thisMutator.getSectionHeader(path);\n+ const footer = thisMutator.getSectionFooter(path);\n+ thisMutator.insertBeforeSkip(path, footer);\n+ thisMutator.insertBeforeSkip(path, header);\n+ },\n+ \/\/ Additionally we print one footer in the end.\n+ Program: {\n+ exit(path) {\n+ const footer = thisMutator.getSectionFooter(path);\n+ path.node.body.push(footer);\n+ },\n+ },\n+ \/\/ Print contents of variables after assignments, guarded by a\n+ \/\/ probability.\n+ ExpressionStatement(path) {\n+ if (!babelTypes.isAssignmentExpression(path.node.expression) ||\n+ !random.choose(settings.DIFF_FUZZ_EXTRA_PRINT)) {\n+ return;\n+ }\n+ const left = path.node.expression.left;\n+ if (babelTypes.isMemberExpression(left)) {\n+ thisMutator.printVariables(path, [left.object]);\n+ } else {\n+ thisMutator.printVariables(path, [left]);\n+ }\n+ },\n+ \/\/ Print contents of variables after declaration, guarded by a\n+ \/\/ probability.\n+ VariableDeclaration(path) {\n+ if (babelTypes.isLoop(path.parent) ||\n+ !random.choose(settings.DIFF_FUZZ_EXTRA_PRINT)) {\n+ return;\n+ }\n+ const identifiers = path.node.declarations.map(decl => decl.id);\n+ thisMutator.printVariables(path, identifiers);\n+ },\n+ };\n+ }\n+}\n+\n+module.exports = {\n+ DifferentialFuzzMutator: DifferentialFuzzMutator,\n+ DifferentialFuzzSuppressions: DifferentialFuzzSuppressions,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/expression_mutator.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/expression_mutator.js\nnew file mode 100644\nindex 0000000000..516d65ae3b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/expression_mutator.js\n@@ -0,0 +1,63 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Expression mutator.\n+ *\/\n+\n+'use strict';\n+\n+const babelTypes = require('@babel\/types');\n+\n+const random = require('..\/random.js');\n+const mutator = require('.\/mutator.js');\n+\n+class ExpressionMutator extends mutator.Mutator {\n+ constructor(settings) {\n+ super();\n+ this.settings = settings;\n+ }\n+\n+ get visitor() {\n+ const thisMutator = this;\n+\n+ return {\n+ ExpressionStatement(path) {\n+ if (!random.choose(thisMutator.settings.MUTATE_EXPRESSIONS)) {\n+ return;\n+ }\n+\n+ const probability = random.random();\n+\n+ if (probability < 0.7) {\n+ const repeated = babelTypes.cloneDeep(path.node);\n+ thisMutator.annotate(repeated, 'Repeated');\n+ thisMutator.insertBeforeSkip(path, repeated);\n+ } else if (path.key > 0) {\n+ \/\/ Get a random previous sibling.\n+ const prev = path.getSibling(random.randInt(0, path.key - 1));\n+ if (!prev || !prev.node) {\n+ return;\n+ }\n+ \/\/ Either select a previous or the current node to clone.\n+ const [selected, destination] = random.shuffle([prev, path]);\n+ if (selected.isDeclaration()) {\n+ return;\n+ }\n+ const cloned = babelTypes.cloneDeep(selected.node);\n+ thisMutator.annotate(cloned, 'Cloned sibling');\n+ if (random.choose(0.5)) {\n+ thisMutator.insertBeforeSkip(destination, cloned);\n+ } else {\n+ thisMutator.insertAfterSkip(destination, cloned);\n+ }\n+ }\n+ },\n+ };\n+ }\n+}\n+\n+module.exports = {\n+ ExpressionMutator: ExpressionMutator,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/function_call_mutator.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/function_call_mutator.js\nnew file mode 100644\nindex 0000000000..665550f92b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/function_call_mutator.js\n@@ -0,0 +1,149 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Function calls mutator.\n+ *\/\n+\n+'use strict';\n+\n+const babelTemplate = require('@babel\/template').default;\n+const babelTypes = require('@babel\/types');\n+\n+const common = require('.\/common.js');\n+const random = require('..\/random.js');\n+const mutator = require('.\/mutator.js');\n+\n+function _liftExpressionsToStatements(path, nodes) {\n+ \/\/ If the node we're replacing is an expression in an expression statement,\n+ \/\/ lift the replacement nodes into statements too.\n+ if (!babelTypes.isExpressionStatement(path.parent)) {\n+ return nodes;\n+ }\n+\n+ return nodes.map(n => babelTypes.expressionStatement(n));\n+}\n+\n+class FunctionCallMutator extends mutator.Mutator {\n+ constructor(settings) {\n+ super();\n+ this.settings = settings;\n+ }\n+\n+ get visitor() {\n+ const thisMutator = this;\n+\n+ return {\n+ CallExpression(path) {\n+ if (!babelTypes.isIdentifier(path.node.callee)) {\n+ return;\n+ }\n+\n+ if (!common.isFunctionIdentifier(path.node.callee.name)) {\n+ return;\n+ }\n+\n+ if (!random.choose(thisMutator.settings.MUTATE_FUNCTION_CALLS)) {\n+ return;\n+ }\n+\n+ const probability = random.random();\n+ if (probability < 0.3) {\n+ const randFunc = common.randomFunction(path);\n+ if (randFunc) {\n+ thisMutator.annotate(\n+ path.node,\n+ `Replaced ${path.node.callee.name} with ${randFunc.name}`);\n+\n+ path.node.callee = randFunc;\n+ }\n+ } else if (probability < 0.7 && thisMutator.settings.engine == 'V8') {\n+ const prepareTemplate = babelTemplate(\n+ '__V8BuiltinPrepareFunctionForOptimization(ID)');\n+ const optimizationMode = random.choose(0.7) ? 'Function' : 'Maglev';\n+ const optimizeTemplate = babelTemplate(\n+ `__V8BuiltinOptimize${optimizationMode}OnNextCall(ID)`);\n+\n+ const nodes = [\n+ prepareTemplate({\n+ ID: babelTypes.cloneDeep(path.node.callee),\n+ }).expression,\n+ babelTypes.cloneDeep(path.node),\n+ babelTypes.cloneDeep(path.node),\n+ optimizeTemplate({\n+ ID: babelTypes.cloneDeep(path.node.callee),\n+ }).expression,\n+ ];\n+\n+ thisMutator.annotate(\n+ path.node,\n+ `Optimizing ${path.node.callee.name}`);\n+ if (!babelTypes.isExpressionStatement(path.parent)) {\n+ nodes.push(path.node);\n+ thisMutator.replaceWithSkip(\n+ path, babelTypes.sequenceExpression(nodes));\n+ } else {\n+ thisMutator.insertBeforeSkip(\n+ path, _liftExpressionsToStatements(path, nodes));\n+ }\n+ } else if (probability < 0.8 && thisMutator.settings.engine == 'V8') {\n+ const template = babelTemplate(\n+ '__V8BuiltinCompileBaseline(ID)');\n+\n+ const nodes = [\n+ template({\n+ ID: babelTypes.cloneDeep(path.node.callee),\n+ }).expression,\n+ ];\n+\n+ thisMutator.annotate(\n+ nodes[0],\n+ `Compiling baseline ${path.node.callee.name}`);\n+\n+ if (!babelTypes.isExpressionStatement(path.parent)) {\n+ nodes.push(path.node);\n+ thisMutator.replaceWithSkip(\n+ path, babelTypes.sequenceExpression(nodes));\n+ } else {\n+ thisMutator.insertBeforeSkip(\n+ path, _liftExpressionsToStatements(path, nodes));\n+ }\n+ } else if (probability < 0.9 &&\n+ thisMutator.settings.engine == 'V8') {\n+ const template = babelTemplate(\n+ '__V8BuiltinDeoptimizeFunction(ID)');\n+ const insert = _liftExpressionsToStatements(path, [\n+ template({\n+ ID: babelTypes.cloneDeep(path.node.callee),\n+ }).expression,\n+ ]);\n+\n+ thisMutator.annotate(\n+ path.node,\n+ `Deoptimizing ${path.node.callee.name}`);\n+\n+ thisMutator.insertAfterSkip(path, insert);\n+ } else {\n+ const template = babelTemplate(\n+ 'runNearStackLimit(() => { return CALL });');\n+ thisMutator.annotate(\n+ path.node,\n+ `Run to stack limit ${path.node.callee.name}`);\n+\n+ thisMutator.replaceWithSkip(\n+ path,\n+ template({\n+ CALL: path.node,\n+ }).expression);\n+ }\n+\n+ path.skip();\n+ },\n+ }\n+ }\n+}\n+\n+module.exports = {\n+ FunctionCallMutator: FunctionCallMutator,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/mutator.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/mutator.js\nnew file mode 100644\nindex 0000000000..9f27d16906\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/mutator.js\n@@ -0,0 +1,98 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Mutator\n+ *\/\n+'use strict';\n+\n+const babelTraverse = require('@babel\/traverse').default;\n+const babelTypes = require('@babel\/types');\n+\n+class Mutator {\n+ get visitor() {\n+ return null;\n+ }\n+\n+ _traverse(ast, visitor) {\n+ let oldEnter = null;\n+ if (Object.prototype.hasOwnProperty.call(visitor, 'enter')) {\n+ oldEnter = visitor['enter'];\n+ }\n+\n+ \/\/ Transparently skip nodes that are marked.\n+ visitor['enter'] = (path) => {\n+ if (this.shouldSkip(path.node)) {\n+ path.skip();\n+ return;\n+ }\n+\n+ if (oldEnter) {\n+ oldEnter(path);\n+ }\n+ }\n+\n+ babelTraverse(ast, visitor);\n+ }\n+\n+ mutate(source) {\n+ if (Array.isArray(this.visitor)) {\n+ for (const visitor of this.visitor) {\n+ this._traverse(source.ast, visitor);\n+ }\n+ } else {\n+ this._traverse(source.ast, this.visitor);\n+ }\n+ }\n+\n+ get _skipPropertyName() {\n+ return '__skip' + this.constructor.name;\n+ }\n+\n+ shouldSkip(node) {\n+ return Boolean(node[this._skipPropertyName]);\n+ }\n+\n+ skipMutations(node) {\n+ \/\/ Mark a node to skip further mutations of the same kind.\n+ if (Array.isArray(node)) {\n+ for (const item of node) {\n+ item[this._skipPropertyName] = true;\n+ }\n+ } else {\n+ node[this._skipPropertyName] = true;\n+ }\n+\n+ return node;\n+ }\n+\n+ insertBeforeSkip(path, node) {\n+ this.skipMutations(node);\n+ path.insertBefore(node);\n+ }\n+\n+ insertAfterSkip(path, node) {\n+ this.skipMutations(node);\n+ path.insertAfter(node);\n+ }\n+\n+ replaceWithSkip(path, node) {\n+ this.skipMutations(node);\n+ path.replaceWith(node);\n+ }\n+\n+ replaceWithMultipleSkip(path, node) {\n+ this.skipMutations(node);\n+ path.replaceWithMultiple(node);\n+ }\n+\n+ annotate(node, message) {\n+ babelTypes.addComment(\n+ node, 'leading', ` ${this.constructor.name}: ${message} `);\n+ }\n+}\n+\n+module.exports = {\n+ Mutator: Mutator,\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/normalizer.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/normalizer.js\nnew file mode 100644\nindex 0000000000..7b5a35a7b3\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/normalizer.js\n@@ -0,0 +1,89 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Normalizer.\n+ * This renames variables so that we don't have collisions when combining\n+ * different files. It also simplifies other logic when e.g. determining the\n+ * type of an identifier.\n+ *\/\n+'use strict';\n+\n+const babelTypes = require('@babel\/types');\n+\n+const mutator = require('.\/mutator.js');\n+\n+class NormalizerContext {\n+ constructor() {\n+ this.funcIndex = 0;\n+ this.varIndex = 0;\n+ this.classIndex = 0;\n+ }\n+}\n+\n+class IdentifierNormalizer extends mutator.Mutator {\n+ constructor() {\n+ super();\n+ this.context = new NormalizerContext();\n+ }\n+\n+ get visitor() {\n+ const context = this.context;\n+ const renamed = new WeakSet();\n+ const globalMappings = new Map();\n+\n+ return [{\n+ Scope(path) {\n+ for (const [name, binding] of Object.entries(path.scope.bindings)) {\n+ if (renamed.has(binding.identifier)) {\n+ continue;\n+ }\n+\n+ renamed.add(binding.identifier);\n+\n+ if (babelTypes.isClassDeclaration(binding.path.node) ||\n+ babelTypes.isClassExpression(binding.path.node)) {\n+ path.scope.rename(name, '__c_' + context.classIndex++);\n+ } else if (babelTypes.isFunctionDeclaration(binding.path.node) ||\n+ babelTypes.isFunctionExpression(binding.path.node)) {\n+ path.scope.rename(name, '__f_' + context.funcIndex++);\n+ } else {\n+ path.scope.rename(name, '__v_' + context.varIndex++);\n+ }\n+ }\n+ },\n+\n+ AssignmentExpression(path) {\n+ \/\/ Find assignments for which we have no binding in the scope. We assume\n+ \/\/ that these are globals which are local to our script (which weren't\n+ \/\/ declared with var\/let\/const etc).\n+ const ids = path.getBindingIdentifiers();\n+ for (const name in ids) {\n+ if (!path.scope.getBinding(name)) {\n+ globalMappings.set(name, '__v_' + context.varIndex++);\n+ }\n+ }\n+ }\n+ }, {\n+ \/\/ Second pass to rename globals that weren't declared with\n+ \/\/ var\/let\/const etc.\n+ Identifier(path) {\n+ if (!globalMappings.has(path.node.name)) {\n+ return;\n+ }\n+\n+ if (path.scope.getBinding(path.node.name)) {\n+ \/\/ Don't rename if there is a binding that hides the global.\n+ return;\n+ }\n+\n+ path.node.name = globalMappings.get(path.node.name);\n+ }\n+ }];\n+ }\n+}\n+\n+module.exports = {\n+ IdentifierNormalizer: IdentifierNormalizer,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/number_mutator.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/number_mutator.js\nnew file mode 100644\nindex 0000000000..c0f3ea8d93\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/number_mutator.js\n@@ -0,0 +1,105 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Numbers mutator.\n+ *\/\n+\n+'use strict';\n+\n+const babelTypes = require('@babel\/types');\n+\n+const common = require('.\/common.js');\n+const random = require('..\/random.js');\n+const mutator = require('.\/mutator.js');\n+\n+const MIN_SAFE_INTEGER = -9007199254740991;\n+const MAX_SAFE_INTEGER = 9007199254740991;\n+\n+\n+function isObjectKey(path) {\n+ return (path.parent &&\n+ babelTypes.isObjectMember(path.parent) &&\n+ path.parent.key === path.node);\n+}\n+\n+function createRandomNumber(value) {\n+ \/\/ TODO(ochang): Maybe replace with variable.\n+ const probability = random.random();\n+ if (probability < 0.01) {\n+ return babelTypes.numericLiteral(\n+ random.randInt(MIN_SAFE_INTEGER, MAX_SAFE_INTEGER));\n+ } else if (probability < 0.06) {\n+ return common.randomInterestingNumber();\n+ } else {\n+ return common.nearbyRandomNumber(value);\n+ }\n+}\n+\n+class NumberMutator extends mutator.Mutator {\n+ constructor(settings) {\n+ super();\n+ this.settings = settings;\n+ }\n+\n+ ignore(path) {\n+ return !random.choose(this.settings.MUTATE_NUMBERS) ||\n+ common.isInForLoopCondition(path) ||\n+ common.isInWhileLoop(path);\n+ }\n+\n+ randomReplace(path, value, forcePositive=false) {\n+ const randomNumber = createRandomNumber(value);\n+\n+ if (forcePositive) {\n+ randomNumber.value = Math.abs(randomNumber.value);\n+ }\n+\n+ this.annotate(\n+ path.node,\n+ `Replaced ${value} with ${randomNumber.value}`);\n+\n+ this.replaceWithSkip(path, randomNumber);\n+ }\n+\n+ get visitor() {\n+ const thisMutator = this;\n+\n+ return {\n+ NumericLiteral(path) {\n+ if (thisMutator.ignore(path)) {\n+ return;\n+ }\n+\n+ \/\/ We handle negative unary expressions separately to replace the whole\n+ \/\/ expression below. E.g. -5 is UnaryExpression(-, NumericLiteral(5)).\n+ if (path.parent && babelTypes.isUnaryExpression(path.parent) &&\n+ path.parent.operator === '-') {\n+ return;\n+ }\n+\n+ \/\/ Enfore positive numbers if the literal is the key of an object\n+ \/\/ property or method. Negative keys cause syntax errors.\n+ const forcePositive = isObjectKey(path);\n+\n+ thisMutator.randomReplace(path, path.node.value, forcePositive);\n+ },\n+ UnaryExpression(path) {\n+ if (thisMutator.ignore(path)) {\n+ return;\n+ }\n+\n+ \/\/ Handle the case we ignore above.\n+ if (path.node.operator === '-' &&\n+ babelTypes.isNumericLiteral(path.node.argument)) {\n+ thisMutator.randomReplace(path, -path.node.argument.value);\n+ }\n+ }\n+ };\n+ }\n+}\n+\n+module.exports = {\n+ NumberMutator: NumberMutator,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/object_mutator.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/object_mutator.js\nnew file mode 100644\nindex 0000000000..7906b4f1a0\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/object_mutator.js\n@@ -0,0 +1,135 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Mutator for object expressions.\n+ *\/\n+\n+'use strict';\n+\n+const babelTypes = require('@babel\/types');\n+\n+const common = require('.\/common.js');\n+const mutator = require('.\/mutator.js');\n+const random = require('..\/random.js');\n+\n+const MAX_PROPERTIES = 50;\n+\n+\/**\n+ * Turn the key of an object property into a string literal.\n+ *\/\n+function keyToString(key) {\n+ if (babelTypes.isNumericLiteral(key)) {\n+ return babelTypes.stringLiteral(key.value.toString());\n+ }\n+ if (babelTypes.isIdentifier(key)) {\n+ return babelTypes.stringLiteral(key.name);\n+ }\n+ \/\/ Already a string literal.\n+ return key;\n+}\n+\n+class ObjectMutator extends mutator.Mutator {\n+ constructor(settings) {\n+ super();\n+ this.settings = settings;\n+ }\n+\n+ get visitor() {\n+ const thisMutator = this;\n+\n+ return {\n+ ObjectExpression(path) {\n+ const properties = path.node.properties;\n+ if (!random.choose(thisMutator.settings.MUTATE_OBJECTS) ||\n+ properties.length > MAX_PROPERTIES) {\n+ return;\n+ }\n+\n+ \/\/ Use the indices of object properties for mutations. We ignore\n+ \/\/ getters and setters.\n+ const propertyIndicies = [];\n+ for (const [index, property] of properties.entries()) {\n+ if (babelTypes.isObjectProperty(property)) {\n+ propertyIndicies.push(index);\n+ }\n+ }\n+\n+ \/\/ The mutations below require at least one property.\n+ if (!propertyIndicies.length) {\n+ return;\n+ }\n+\n+ \/\/ Annotate object expression with the action taken.\n+ function annotate(message) {\n+ thisMutator.annotate(path.node, message);\n+ }\n+\n+ function getOneRandomProperty() {\n+ return properties[random.single(propertyIndicies)];\n+ }\n+\n+ function getTwoRandomProperties() {\n+ const [a, b] = random.sample(propertyIndicies, 2);\n+ return [properties[a], properties[b]];\n+ }\n+\n+ function swapPropertyValues() {\n+ if (propertyIndicies.length > 1) {\n+ annotate('Swap properties');\n+ const [a, b] = getTwoRandomProperties();\n+ [a.value, b.value] = [b.value, a.value];\n+ }\n+ }\n+\n+ function duplicatePropertyValue() {\n+ if (propertyIndicies.length > 1) {\n+ const [a, b] = random.shuffle(getTwoRandomProperties());\n+ if (common.isLargeNode(b.value)) {\n+ return;\n+ }\n+ annotate('Duplicate a property value');\n+ a.value = babelTypes.cloneDeep(b.value);\n+ }\n+ }\n+\n+ function insertRandomValue() {\n+ annotate('Insert a random value');\n+ const property = getOneRandomProperty();\n+ property.value = common.randomValue(path);\n+ }\n+\n+ function stringifyKey() {\n+ annotate('Stringify a property key');\n+ const property = getOneRandomProperty();\n+ property.key = keyToString(property.key);\n+ }\n+\n+ function removeProperty() {\n+ annotate('Remove a property');\n+ properties.splice(random.single(propertyIndicies), 1);\n+ }\n+\n+ \/\/ Mutation options. Repeated mutations have a higher probability.\n+ const mutations = [\n+ swapPropertyValues,\n+ swapPropertyValues,\n+ duplicatePropertyValue,\n+ duplicatePropertyValue,\n+ insertRandomValue,\n+ insertRandomValue,\n+ removeProperty,\n+ stringifyKey,\n+ ];\n+\n+ \/\/ Perform mutation.\n+ random.single(mutations)();\n+ },\n+ }\n+ }\n+}\n+\n+module.exports = {\n+ ObjectMutator: ObjectMutator,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/try_catch.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/try_catch.js\nnew file mode 100644\nindex 0000000000..57f81f2a00\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/try_catch.js\n@@ -0,0 +1,175 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Try catch wrapper.\n+ *\/\n+\n+const babelTypes = require('@babel\/types');\n+\n+const common = require('.\/common.js');\n+const mutator = require('.\/mutator.js');\n+const random = require('..\/random.js');\n+\n+\/\/ Default target probability for skipping try-catch completely.\n+const DEFAULT_SKIP_PROB = 0.2;\n+\n+\/\/ Default target probability to wrap only on toplevel, i.e. to not nest\n+\/\/ try-catch.\n+const DEFAULT_TOPLEVEL_PROB = 0.3;\n+\n+\/\/ Probability to deviate from defaults and use extreme cases.\n+const IGNORE_DEFAULT_PROB = 0.05;\n+\n+\/\/ Member expressions to be wrapped. List of (object, property) identifier\n+\/\/ tuples.\n+const WRAPPED_MEMBER_EXPRESSIONS = [\n+ ['WebAssembly', 'Module'],\n+ ['WebAssembly', 'Instantiate'],\n+];\n+\n+function wrapTryCatch(node) {\n+ return babelTypes.tryStatement(\n+ babelTypes.blockStatement([node]),\n+ babelTypes.catchClause(\n+ babelTypes.identifier('e'),\n+ babelTypes.blockStatement([])));\n+}\n+\n+function wrapTryCatchInFunction(node) {\n+ const ret = wrapTryCatch(babelTypes.returnStatement(node));\n+ const anonymousFun = babelTypes.functionExpression(\n+ null, [], babelTypes.blockStatement([ret]));\n+ return babelTypes.callExpression(anonymousFun, []);\n+}\n+\n+\/\/ Wrap particular member expressions after `new` that are known to appear\n+\/\/ in initializer lists of `let` and `const`.\n+function replaceNewExpression(path) {\n+ const callee = path.node.callee;\n+ if (!babelTypes.isMemberExpression(callee) ||\n+ !babelTypes.isIdentifier(callee.object) ||\n+ !babelTypes.isIdentifier(callee.property)) {\n+ return;\n+ }\n+ if (WRAPPED_MEMBER_EXPRESSIONS.some(\n+ ([object, property]) => callee.object.name === object &&\n+ callee.property.name === property)) {\n+ path.replaceWith(wrapTryCatchInFunction(path.node));\n+ path.skip();\n+ }\n+}\n+\n+function replaceAndSkip(path) {\n+ if (!babelTypes.isLabeledStatement(path.parent) ||\n+ !babelTypes.isLoop(path.node)) {\n+ \/\/ Don't wrap loops with labels as it makes continue\n+ \/\/ statements syntactically invalid. We wrap the label\n+ \/\/ instead below.\n+ path.replaceWith(wrapTryCatch(path.node));\n+ }\n+ \/\/ Prevent infinite looping.\n+ path.skip();\n+}\n+\n+class AddTryCatchMutator extends mutator.Mutator {\n+ callWithProb(path, fun) {\n+ const probability = random.random();\n+ if (probability < this.skipProb * this.loc) {\n+ \/\/ Entirely skip try-catch wrapper.\n+ path.skip();\n+ } else if (probability < (this.skipProb + this.toplevelProb) * this.loc) {\n+ \/\/ Only wrap on top-level.\n+ fun(path);\n+ }\n+ }\n+\n+ get visitor() {\n+ const thisMutator = this;\n+ const accessStatement = {\n+ enter(path) {\n+ thisMutator.callWithProb(path, replaceAndSkip);\n+ },\n+ exit(path) {\n+ \/\/ Apply nested wrapping (is only executed if not skipped above).\n+ replaceAndSkip(path);\n+ }\n+ };\n+ return {\n+ Program: {\n+ enter(path) {\n+ \/\/ Track original source location fraction in [0, 1).\n+ thisMutator.loc = 0;\n+ \/\/ Target probability for skipping try-catch.\n+ thisMutator.skipProb = DEFAULT_SKIP_PROB;\n+ \/\/ Target probability for not nesting try-catch.\n+ thisMutator.toplevelProb = DEFAULT_TOPLEVEL_PROB;\n+ \/\/ Maybe deviate from target probability for the entire test.\n+ if (random.choose(IGNORE_DEFAULT_PROB)) {\n+ thisMutator.skipProb = random.uniform(0, 1);\n+ thisMutator.toplevelProb = random.uniform(0, 1);\n+ thisMutator.annotate(\n+ path.node,\n+ 'Target skip probability ' + thisMutator.skipProb +\n+ ' and toplevel probability ' + thisMutator.toplevelProb);\n+ }\n+ }\n+ },\n+ Noop: {\n+ enter(path) {\n+ if (common.getSourceLoc(path.node)) {\n+ thisMutator.loc = common.getSourceLoc(path.node);\n+ }\n+ },\n+ },\n+ ExpressionStatement: accessStatement,\n+ IfStatement: accessStatement,\n+ LabeledStatement: {\n+ enter(path) {\n+ \/\/ Apply an extra try-catch around the label of a loop, since we\n+ \/\/ ignore the loop itself if it has a label.\n+ if (babelTypes.isLoop(path.node.body)) {\n+ thisMutator.callWithProb(path, replaceAndSkip);\n+ }\n+ },\n+ exit(path) {\n+ \/\/ Apply nested wrapping (is only executed if not skipped above).\n+ if (babelTypes.isLoop(path.node.body)) {\n+ replaceAndSkip(path);\n+ }\n+ },\n+ },\n+ \/\/ This covers {While|DoWhile|ForIn|ForOf|For}Statement.\n+ Loop: accessStatement,\n+ NewExpression: {\n+ enter(path) {\n+ thisMutator.callWithProb(path, replaceNewExpression);\n+ },\n+ exit(path) {\n+ \/\/ Apply nested wrapping (is only executed if not skipped above).\n+ replaceNewExpression(path);\n+ }\n+ },\n+ SwitchStatement: accessStatement,\n+ VariableDeclaration: {\n+ enter(path) {\n+ if (path.node.kind !== 'var' || babelTypes.isLoop(path.parent))\n+ return;\n+ thisMutator.callWithProb(path, replaceAndSkip);\n+ },\n+ exit(path) {\n+ if (path.node.kind !== 'var' || babelTypes.isLoop(path.parent))\n+ return;\n+ \/\/ Apply nested wrapping (is only executed if not skipped above).\n+ replaceAndSkip(path);\n+ }\n+ },\n+ WithStatement: accessStatement,\n+ };\n+ }\n+}\n+\n+module.exports = {\n+ AddTryCatchMutator: AddTryCatchMutator,\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/variable_mutator.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/variable_mutator.js\nnew file mode 100644\nindex 0000000000..4222932058\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/variable_mutator.js\n@@ -0,0 +1,73 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Variables mutator.\n+ *\/\n+\n+'use strict';\n+\n+const babelTypes = require('@babel\/types');\n+\n+const common = require('.\/common.js');\n+const random = require('..\/random.js');\n+const mutator = require('.\/mutator.js');\n+\n+function _isInFunctionParam(path) {\n+ const child = path.find(p => p.parent && babelTypes.isFunction(p.parent));\n+ return child && child.parentKey === 'params';\n+}\n+\n+class VariableMutator extends mutator.Mutator {\n+ constructor(settings) {\n+ super();\n+ this.settings = settings;\n+ }\n+\n+ get visitor() {\n+ const thisMutator = this;\n+\n+ return {\n+ Identifier(path) {\n+ if (!random.choose(thisMutator.settings.MUTATE_VARIABLES)) {\n+ return;\n+ }\n+\n+ if (!common.isVariableIdentifier(path.node.name)) {\n+ return;\n+ }\n+\n+ \/\/ Don't mutate variables that are being declared.\n+ if (babelTypes.isVariableDeclarator(path.parent)) {\n+ return;\n+ }\n+\n+ \/\/ Don't mutate function params.\n+ if (_isInFunctionParam(path)) {\n+ return;\n+ }\n+\n+ if (common.isInForLoopCondition(path) ||\n+ common.isInWhileLoop(path)) {\n+ return;\n+ }\n+\n+ const randVar = common.randomVariable(path);\n+ if (!randVar) {\n+ return;\n+ }\n+\n+ const newName = randVar.name;\n+ thisMutator.annotate(\n+ path.node,\n+ `Replaced ${path.node.name} with ${newName}`);\n+ path.node.name = newName;\n+ }\n+ };\n+ }\n+}\n+\n+module.exports = {\n+ VariableMutator: VariableMutator,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/mutators\/variable_or_object_mutation.js b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/variable_or_object_mutation.js\nnew file mode 100644\nindex 0000000000..3c96464c81\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/mutators\/variable_or_object_mutation.js\n@@ -0,0 +1,154 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Variables mutator.\n+ *\/\n+\n+'use strict';\n+\n+const babelTemplate = require('@babel\/template').default;\n+const babelTypes = require('@babel\/types');\n+\n+const common = require('.\/common.js');\n+const random = require('..\/random.js');\n+const mutator = require('.\/mutator.js');\n+\n+const MAX_MUTATION_RECURSION_DEPTH = 5;\n+\n+class VariableOrObjectMutator extends mutator.Mutator {\n+ constructor(settings) {\n+ super();\n+ this.settings = settings;\n+ }\n+\n+ _randomVariableOrObject(path) {\n+ const randomVar = common.randomVariable(path);\n+ if (random.choose(0.05) || !randomVar) {\n+ return common.randomObject();\n+ }\n+\n+ return randomVar;\n+ }\n+\n+ _randomVariableOrObjectMutations(path, recurseDepth=0) {\n+ if (recurseDepth >= MAX_MUTATION_RECURSION_DEPTH) {\n+ return new Array();\n+ }\n+\n+ const probability = random.random();\n+\n+ if (probability < 0.3) {\n+ const first = this._randomVariableOrObjectMutations(path, recurseDepth + 1);\n+ const second = this._randomVariableOrObjectMutations(\n+ path, recurseDepth + 1);\n+ return first.concat(second);\n+ }\n+\n+ const randVarOrObject = this._randomVariableOrObject(path);\n+ const randProperty = common.randomProperty(randVarOrObject);\n+ let newRandVarOrObject = randVarOrObject;\n+ if (random.choose(0.2)) {\n+ newRandVarOrObject = this._randomVariableOrObject(path);\n+ }\n+\n+ const mutations = new Array();\n+\n+ if (probability < 0.4) {\n+ const template = babelTemplate(\n+ 'delete IDENTIFIER[PROPERTY], __callGC()')\n+ mutations.push(template({\n+ IDENTIFIER: randVarOrObject,\n+ PROPERTY: randProperty\n+ }));\n+ } else if (probability < 0.5) {\n+ const template = babelTemplate(\n+ 'IDENTIFIER[PROPERTY], __callGC()')\n+ mutations.push(template({\n+ IDENTIFIER: randVarOrObject,\n+ PROPERTY: randProperty\n+ }));\n+ } else if (probability < 0.6) {\n+ const template = babelTemplate(\n+ 'IDENTIFIER[PROPERTY] = RANDOM, __callGC()')\n+ mutations.push(template({\n+ IDENTIFIER: randVarOrObject,\n+ PROPERTY: randProperty,\n+ RANDOM: common.randomValue(path),\n+ }));\n+ } else if (probability < 0.7) {\n+ mutations.push(\n+ babelTypes.expressionStatement(\n+ common.callRandomFunction(path, randVarOrObject)));\n+ } else if (probability < 0.8) {\n+ const template = babelTemplate(\n+ 'VAR = IDENTIFIER, __callGC()')\n+ var randomVar = common.randomVariable(path);\n+ if (!randomVar) {\n+ return mutations;\n+ }\n+\n+ mutations.push(template({\n+ VAR: randomVar,\n+ IDENTIFIER: randVarOrObject,\n+ }));\n+ } else if (probability < 0.9) {\n+ const template = babelTemplate(\n+ 'if (IDENTIFIER != null && typeof(IDENTIFIER) == \"object\") ' +\n+ 'Object.defineProperty(IDENTIFIER, PROPERTY, {value: VALUE})')\n+ mutations.push(template({\n+ IDENTIFIER: newRandVarOrObject,\n+ PROPERTY: randProperty,\n+ VALUE: common.randomValue(path),\n+ }));\n+ } else {\n+ const template = babelTemplate(\n+ 'if (IDENTIFIER != null && typeof(IDENTIFIER) == \"object\") ' +\n+ 'Object.defineProperty(IDENTIFIER, PROPERTY, {' +\n+ 'get: function() { GETTER_MUTATION ; return VALUE; },' +\n+ 'set: function(value) { SETTER_MUTATION; }' +\n+ '})');\n+ mutations.push(template({\n+ IDENTIFIER: newRandVarOrObject,\n+ PROPERTY: randProperty,\n+ GETTER_MUTATION: this._randomVariableOrObjectMutations(\n+ path, recurseDepth + 1),\n+ SETTER_MUTATION: this._randomVariableOrObjectMutations(\n+ path, recurseDepth + 1),\n+ VALUE: common.randomValue(path),\n+ }));\n+ }\n+\n+ return mutations;\n+ }\n+\n+\n+ get visitor() {\n+ const settings = this.settings;\n+ const thisMutator = this;\n+\n+ return {\n+ ExpressionStatement(path) {\n+ if (!random.choose(settings.ADD_VAR_OR_OBJ_MUTATIONS)) {\n+ return;\n+ }\n+\n+ const mutations = thisMutator._randomVariableOrObjectMutations(path);\n+ thisMutator.annotate(mutations[0], 'Random mutation');\n+\n+ if (random.choose(0.5)) {\n+ thisMutator.insertBeforeSkip(path, mutations);\n+ } else {\n+ thisMutator.insertAfterSkip(path, mutations);\n+ }\n+\n+ path.skip();\n+ }\n+ };\n+ }\n+}\n+\n+module.exports = {\n+ VariableOrObjectMutator: VariableOrObjectMutator,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/package.json b\/compiler\/forget\/packages\/js-fuzzer\/package.json\nnew file mode 100644\nindex 0000000000..962585d2e4\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/package.json\n@@ -0,0 +1,34 @@\n+{\n+ \"name\": \"ochang_js_fuzzer\",\n+ \"version\": \"1.0.0\",\n+ \"description\": \"\",\n+ \"main\": \"run.js\",\n+ \"scripts\": {\n+ \"test\": \"echo 'no test'\",\n+ \"build\": \"echo 'no build'\"\n+ },\n+ \"bin\": \"run.js\",\n+ \"author\": \"ochang@google.com\",\n+ \"license\": \"ISC\",\n+ \"dependencies\": {\n+ \"@babel\/generator\": \"^7.1.3\",\n+ \"@babel\/template\": \"^7.1.2\",\n+ \"@babel\/traverse\": \"^7.1.4\",\n+ \"@babel\/types\": \"^7.1.3\",\n+ \"@babel\/parser\": \"^7.1.3\",\n+ \"commander\": \"^2.11.0\",\n+ \"globals\": \"^10.1.0\",\n+ \"tempfile\": \"^3.0.0\",\n+ \"tempy\": \"^0.5.0\"\n+ },\n+ \"devDependencies\": {\n+ \"eslint\": \"^6.8.0\",\n+ \"mocha\": \"^3.5.3\",\n+ \"pkg\": \"^4.3.4\",\n+ \"prettier\": \"2.0.5\",\n+ \"sinon\": \"^4.0.0\"\n+ },\n+ \"pkg\": {\n+ \"assets\": \"resources\/**\/*\"\n+ }\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/package.sh b\/compiler\/forget\/packages\/js-fuzzer\/package.sh\nnew file mode 100755\nindex 0000000000..61ac465f69\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/package.sh\n@@ -0,0 +1,32 @@\n+#!\/bin\/bash\n+# Copyright 2020 the V8 project authors. All rights reserved.\n+# Use of this source code is governed by a BSD-style license that can be\n+# found in the LICENSE file.\n+\n+DIR=\"$( cd \"$( dirname \"${BASH_SOURCE[0]}\" )\" >\/dev\/null 2>&1 && pwd )\"\n+\n+OS=\"linux\"\n+OS_LABEL=\"Linux\"\n+SUFFIX=\"\"\n+if [[ -n \"$1\" && $1 == \"win\" ]]; then\n+ OS=\"win\"\n+ OS_LABEL=\"Windows\"\n+ SUFFIX=\".exe\"\n+elif [[ -n \"$1\" && $1 == \"macos\" ]]; then\n+ OS=\"macos\"\n+ OS_LABEL=\"MacOS\"\n+fi\n+\n+echo \"Building and packaging for $OS_LABEL...\"\n+(set -x; $DIR\/node_modules\/.bin\/pkg -t node10-$OS-x64 $DIR)\n+\n+rm -rf $DIR\/output > \/dev\/null 2>&1 || true\n+rm $DIR\/output.zip > \/dev\/null 2>&1 || true\n+\n+mkdir $DIR\/output\n+cd $DIR\/output\n+ln -s ..\/db db\n+ln -s ..\/ochang_js_fuzzer$SUFFIX run$SUFFIX\n+ln -s ..\/foozzie_launcher.py foozzie_launcher.py\n+echo \"Creating $DIR\/output.zip\"\n+(set -x; zip -r $DIR\/output.zip * > \/dev\/null)\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/random.js b\/compiler\/forget\/packages\/js-fuzzer\/random.js\nnew file mode 100644\nindex 0000000000..f6d73b6f11\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/random.js\n@@ -0,0 +1,113 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Random helpers.\n+ *\/\n+\n+'use strict';\n+\n+const assert = require('assert');\n+\n+function randInt(min, max) {\n+ return Math.floor(Math.random() * (max - min + 1)) + min;\n+}\n+\n+function choose(probability) {\n+ return Math.random() < probability;\n+}\n+\n+function random() {\n+ return Math.random();\n+}\n+\n+function uniform(min, max) {\n+ return Math.random() * (max - min) + min;\n+}\n+\n+function sample(iterable, count) {\n+ const result = new Array(count);\n+ let index = 0;\n+\n+ for (const item of iterable) {\n+ if (index < count) {\n+ result[index] = item;\n+ } else {\n+ const randIndex = randInt(0, index);\n+ if (randIndex < count) {\n+ result[randIndex] = item;\n+ }\n+ }\n+\n+ index++;\n+ }\n+\n+ if (index < count) {\n+ \/\/ Not enough items.\n+ result.length = index;\n+ }\n+\n+ return result;\n+}\n+\n+function swap(array, p1, p2) {\n+ [array[p1], array[p2]] = [array[p2], array[p1]];\n+}\n+\n+\/**\n+ * Returns \"count\" elements, randomly selected from \"highProbArray\" and\n+ * \"lowProbArray\". Elements from highProbArray have a \"factor\" times\n+ * higher chance to be chosen. As a side effect, this swaps the chosen\n+ * elements to the end of the respective input arrays. The complexity is\n+ * O(count).\n+ *\/\n+function twoBucketSample(lowProbArray, highProbArray, factor, count) {\n+ \/\/ Track number of available elements for choosing.\n+ let low = lowProbArray.length;\n+ let high = highProbArray.length;\n+ assert(low + high >= count);\n+ const result = [];\n+ for (let i = 0; i < count; i++) {\n+ \/\/ Map a random number to the summarized indices of both arrays. Give\n+ \/\/ highProbArray elements a \"factor\" times higher probability.\n+ const p = random();\n+ const index = Math.floor(p * (high * factor + low));\n+ if (index < low) {\n+ \/\/ If the index is in the low part, draw the element and discard it.\n+ result.push(lowProbArray[index]);\n+ swap(lowProbArray, index, --low);\n+ } else {\n+ \/\/ Same as above but for a highProbArray element. The index is first\n+ \/\/ mapped back to the array's range.\n+ const highIndex = Math.floor((index - low) \/ factor);\n+ result.push(highProbArray[highIndex]);\n+ swap(highProbArray, highIndex, --high);\n+ }\n+ }\n+ return result;\n+}\n+\n+function single(array) {\n+ return array[randInt(0, array.length - 1)];\n+}\n+\n+function shuffle(array) {\n+ for (let i = 0; i < array.length - 1; i++) {\n+ const j = randInt(i, array.length - 1);\n+ swap(array, i, j);\n+ }\n+\n+ return array;\n+}\n+\n+module.exports = {\n+ choose: choose,\n+ randInt: randInt,\n+ random: random,\n+ sample: sample,\n+ shuffle: shuffle,\n+ single: single,\n+ twoBucketSample: twoBucketSample,\n+ uniform: uniform,\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_chakra.js b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_chakra.js\nnew file mode 100644\nindex 0000000000..250d0a3026\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_chakra.js\n@@ -0,0 +1,17 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\n+\/\/ Adjust chakra behavior for differential fuzzing.\n+\n+this.WScript = new Proxy({}, {\n+ get(target, name) {\n+ switch (name) {\n+ case 'Echo':\n+ return __prettyPrintExtra;\n+ default:\n+ return {};\n+ }\n+ }\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_jstest.js b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_jstest.js\nnew file mode 100644\nindex 0000000000..5c4885cef2\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_jstest.js\n@@ -0,0 +1,11 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+function debug(msg) {\n+ __prettyPrintExtra(msg);\n+}\n+\n+function shouldBe(_a) {\n+ __prettyPrintExtra((typeof _a == \"function\" ? _a() : eval(_a)));\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_library.js b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_library.js\nnew file mode 100644\nindex 0000000000..37b95d15b2\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_library.js\n@@ -0,0 +1,122 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\n+\/\/ Helpers for printing in correctness fuzzing.\n+\n+\/\/ Global helper functions for printing.\n+var __prettyPrint;\n+var __prettyPrintExtra;\n+\n+\/\/ Track caught exceptions.\n+var __caught = 0;\n+\n+\/\/ Track a hash of all printed values - printing is cut off after a\n+\/\/ certain size.\n+var __hash = 0;\n+\n+(function() {\n+ const charCodeAt = String.prototype.charCodeAt;\n+ const join = Array.prototype.join;\n+ const map = Array.prototype.map;\n+ const substring = String.prototype.substring;\n+ const toString = Object.prototype.toString;\n+\n+ \/\/ Same as in mjsunit.js.\n+ const classOf = function(object) {\n+ \/\/ Argument must not be null or undefined.\n+ const string = toString.call(object);\n+ \/\/ String has format [object ].\n+ return substring.call(string, 8, string.length - 1);\n+ };\n+\n+ \/\/ For standard cases use original prettyPrinted from mjsunit.\n+ const origPrettyPrinted = prettyPrinted;\n+\n+ \/\/ Override prettyPrinted with a version that also recusively prints objects\n+ \/\/ and arrays with a depth of 4. We don't track circles, but we'd cut off\n+ \/\/ after a depth of 4 if there are any.\n+ prettyPrinted = function prettyPrinted(value, depth=4) {\n+ if (depth <= 0) {\n+ return \"...\";\n+ }\n+ switch (typeof value) {\n+ case \"object\":\n+ if (value === null) return \"null\";\n+ switch (classOf(value)) {\n+ case \"Array\":\n+ return prettyPrintedArray(value, depth);\n+ case \"Object\":\n+ return prettyPrintedObject(value, depth);\n+ }\n+ }\n+ \/\/ Fall through to original version for all other types.\n+ return origPrettyPrinted(value);\n+ }\n+\n+ \/\/ Helper for pretty array with depth.\n+ function prettyPrintedArray(array, depth) {\n+ const result = map.call(array, (value, index, array) => {\n+ if (value === undefined && !(index in array)) return \"\";\n+ return prettyPrinted(value, depth - 1);\n+ });\n+ return `[${join.call(result, \", \")}]`;\n+ }\n+\n+ \/\/ Helper for pretty objects with depth.\n+ function prettyPrintedObject(object, depth) {\n+ const keys = Object.keys(object);\n+ const prettyValues = map.call(keys, (key) => {\n+ return `${key}: ${prettyPrinted(object[key], depth - 1)}`;\n+ });\n+ const content = join.call(prettyValues, \", \");\n+ return `${object.constructor.name || \"Object\"}{${content}}`;\n+ }\n+\n+ \/\/ Helper for calculating a hash code of a string.\n+ function hashCode(str) {\n+ let hash = 0;\n+ if (str.length == 0) {\n+ return hash;\n+ }\n+ for (let i = 0; i < str.length; i++) {\n+ const char = charCodeAt.call(str, i);\n+ hash = ((hash << 5) - hash) + char;\n+ hash = hash & hash;\n+ }\n+ return hash;\n+ }\n+\n+ \/\/ Upper limit for calling extra printing. When reached, hashes of\n+ \/\/ strings are tracked and printed instead.\n+ let maxExtraPrinting = 100;\n+\n+ \/\/ Helper for pretty printing.\n+ __prettyPrint = function(value, extra=false) {\n+ let str = prettyPrinted(value);\n+\n+ \/\/ Change __hash with the contents of the full string to\n+ \/\/ keep track of differences also when we don't print.\n+ const hash = hashCode(str);\n+ __hash = hashCode(hash + __hash.toString());\n+\n+ if (extra && maxExtraPrinting-- <= 0) {\n+ return;\n+ }\n+\n+ \/\/ Cut off long strings to prevent overloading I\/O. We still track\n+ \/\/ the hash of the full string.\n+ if (str.length > 64) {\n+ const head = substring.call(str, 0, 54);\n+ const tail = substring.call(str, str.length - 10, str.length - 1);\n+ str = `${head}[...]${tail}`;\n+ }\n+\n+ print(str);\n+ };\n+\n+ __prettyPrintExtra = function (value) {\n+ __prettyPrint(value, true);\n+ }\n+})();\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_mjsunit.js b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_mjsunit.js\nnew file mode 100644\nindex 0000000000..901299b90d\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_mjsunit.js\n@@ -0,0 +1,8 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\n+\/\/ Substitute for mjsunit. We reuse prettyPrinted from mjsunit, but only if\n+\/\/ it is loaded. If not, we use this substitute instead.\n+let prettyPrinted = value => value;\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_suppressions.js b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_suppressions.js\nnew file mode 100644\nindex 0000000000..b964f786a5\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_suppressions.js\n@@ -0,0 +1,12 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\n+\/\/ Don't breach stack limit in differential fuzzing as it leads to\n+\/\/ early bailout.\n+runNearStackLimit = function(f) {\n+ try {\n+ f();\n+ } catch (e) {}\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_v8.js b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_v8.js\nnew file mode 100644\nindex 0000000000..f87641326e\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/resources\/differential_fuzz_v8.js\n@@ -0,0 +1,29 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\n+\/\/ Adjust mjsunit behavior for differential fuzzing.\n+\n+\/\/ We're not interested in stack traces.\n+MjsUnitAssertionError = () => {};\n+\n+\/\/ Do more printing in assertions for more correctness coverage.\n+failWithMessage = message => { __prettyPrint(message); };\n+assertSame = (expected, found, name_opt) => { __prettyPrint(found); };\n+assertNotSame = (expected, found, name_opt) => { __prettyPrint(found); };\n+assertEquals = (expected, found, name_opt) => { __prettyPrint(found); };\n+assertNotEquals = (expected, found, name_opt) => { __prettyPrint(found); };\n+assertNull = (value, name_opt) => { __prettyPrint(value); };\n+assertNotNull = (value, name_opt) => { __prettyPrint(value); };\n+\n+\/\/ Suppress optimization status as it leads to false positives.\n+assertUnoptimized = () => {};\n+assertOptimized = () => {};\n+isNeverOptimize = () => {};\n+isAlwaysOptimize = () => {};\n+isInterpreted = () => {};\n+isBaseline = () => {};\n+isUnoptimized = () => {};\n+isOptimized = () => {};\n+isTurboFanned = () => {};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/resources\/fuzz_library.js b\/compiler\/forget\/packages\/js-fuzzer\/resources\/fuzz_library.js\nnew file mode 100644\nindex 0000000000..343b4d149b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/resources\/fuzz_library.js\n@@ -0,0 +1,116 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Slightly modified variants from http:\/\/code.fitness\/post\/2016\/01\/javascript-enumerate-methods.html.\n+function __isPropertyOfType(obj, name, type) {\n+ let desc;\n+ try {\n+ desc = Object.getOwnPropertyDescriptor(obj, name);\n+ } catch(e) {\n+ return false;\n+ }\n+\n+ if (!desc)\n+ return false;\n+\n+ return typeof type === 'undefined' || typeof desc.value === type;\n+}\n+\n+function __getProperties(obj, type) {\n+ if (typeof obj === \"undefined\" || obj === null)\n+ return [];\n+\n+ let properties = [];\n+ for (let name of Object.getOwnPropertyNames(obj)) {\n+ if (__isPropertyOfType(obj, name, type))\n+ properties.push(name);\n+ }\n+\n+ let proto = Object.getPrototypeOf(obj);\n+ while (proto && proto != Object.prototype) {\n+ Object.getOwnPropertyNames(proto)\n+ .forEach (name => {\n+ if (name !== 'constructor') {\n+ if (__isPropertyOfType(proto, name, type))\n+ properties.push(name);\n+ }\n+ });\n+ proto = Object.getPrototypeOf(proto);\n+ }\n+ return properties;\n+}\n+\n+function* __getObjects(root = this, level = 0) {\n+ if (level > 4)\n+ return;\n+\n+ let obj_names = __getProperties(root, 'object');\n+ for (let obj_name of obj_names) {\n+ let obj = root[obj_name];\n+ if (obj === root)\n+ continue;\n+\n+ yield obj;\n+ yield* __getObjects(obj, level + 1);\n+ }\n+}\n+\n+function __getRandomObject(seed) {\n+ let objects = [];\n+ for (let obj of __getObjects()) {\n+ objects.push(obj);\n+ }\n+\n+ return objects[seed % objects.length];\n+}\n+\n+function __getRandomProperty(obj, seed) {\n+ let properties = __getProperties(obj);\n+ if (!properties.length)\n+ return undefined;\n+\n+ return properties[seed % properties.length];\n+}\n+\n+function __callRandomFunction(obj, seed, ...args)\n+{\n+ let functions = __getProperties(obj, 'function');\n+ if (!functions.length)\n+ return;\n+\n+ let random_function = functions[seed % functions.length];\n+ try {\n+ obj[random_function](...args);\n+ } catch(e) { }\n+}\n+\n+function runNearStackLimit(f) {\n+ function t() {\n+ try {\n+ return t();\n+ } catch (e) {\n+ return f();\n+ }\n+ };\n+ try {\n+ return t();\n+ } catch (e) {}\n+}\n+\n+\/\/ Limit number of times we cause major GCs in tests to reduce hangs\n+\/\/ when called within larger loops.\n+let __callGC;\n+(function() {\n+ let countGC = 0;\n+ __callGC = function() {\n+ if (countGC++ < 50) {\n+ gc();\n+ }\n+ };\n+})();\n+\n+\/\/ Neuter common test functions.\n+try { this.failWithMessage = nop; } catch(e) { }\n+try { this.triggerAssertFalse = nop; } catch(e) { }\n+try { this.quit = nop; } catch(e) { }\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/resources\/jstest_stubs.js b\/compiler\/forget\/packages\/js-fuzzer\/resources\/jstest_stubs.js\nnew file mode 100644\nindex 0000000000..b5921e00c8\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/resources\/jstest_stubs.js\n@@ -0,0 +1,41 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Minimally stub out methods from JSTest's standalone-pre.js.\n+function description(msg) {}\n+function debug(msg) {}\n+\n+function shouldBe(_a) {\n+ print((typeof _a == \"function\" ? _a() : eval(_a)));\n+}\n+\n+function shouldBeTrue(_a) { shouldBe(_a); }\n+function shouldBeFalse(_a) { shouldBe(_a); }\n+function shouldBeNaN(_a) { shouldBe(_a); }\n+function shouldBeNull(_a) { shouldBe(_a); }\n+function shouldNotThrow(_a) { shouldBe(_a); }\n+function shouldThrow(_a) { shouldBe(_a); }\n+\n+function noInline() {}\n+function finishJSTest() {}\n+\n+\/\/ Stub out $vm.\n+try {\n+ $vm;\n+} catch(e) {\n+ const handler = {\n+ get: function(x, prop) {\n+ if (prop == Symbol.toPrimitive) {\n+ return function() { return undefined; };\n+ }\n+ return dummy;\n+ },\n+ };\n+ const dummy = new Proxy(function() { return dummy; }, handler);\n+ this.$vm = dummy;\n+}\n+\n+\/\/ Other functions.\n+function ensureArrayStorage() {}\n+function transferArrayBuffer() {}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/resources\/stubs.js b\/compiler\/forget\/packages\/js-fuzzer\/resources\/stubs.js\nnew file mode 100644\nindex 0000000000..37d1c628c6\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/resources\/stubs.js\n@@ -0,0 +1,36 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Helper neuter function.\n+function nop() { return false; }\n+\n+\/\/ Stubs for non-standard functions.\n+try { gc; } catch(e) {\n+ this.gc = function () {\n+ for (let i = 0; i < 10000; i++) {\n+ let s = new String(\"AAAA\" + Math.random());\n+ }\n+ }\n+}\n+try { uneval; } catch(e) { this.uneval = this.nop; }\n+\n+try {\n+ \/\/ For Chakra tests.\n+ WScript;\n+} catch(e) {\n+ this.WScript = new Proxy({}, {\n+ get(target, name) {\n+ switch (name) {\n+ case 'Echo':\n+ return print;\n+ default:\n+ return {};\n+ }\n+\n+ }\n+ });\n+}\n+\n+try { this.alert = console.log; } catch(e) { }\n+try { this.print = console.log; } catch(e) { }\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/run.js b\/compiler\/forget\/packages\/js-fuzzer\/run.js\nnew file mode 100644\nindex 0000000000..29049e326c\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/run.js\n@@ -0,0 +1,241 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Description of this file.\n+ *\/\n+\n+'use strict';\n+\n+const assert = require('assert');\n+const fs = require('fs');\n+const path = require('path');\n+\n+const program = require('commander');\n+\n+const corpus = require('.\/corpus.js');\n+const differentialScriptMutator = require('.\/differential_script_mutator.js');\n+const random = require('.\/random.js');\n+const scriptMutator = require('.\/script_mutator.js');\n+const sourceHelpers = require('.\/source_helpers.js');\n+\n+\/\/ Maximum number of test inputs to use for one fuzz test.\n+const MAX_TEST_INPUTS_PER_TEST = 10;\n+\n+\/\/ Base implementations for default or differential fuzzing.\n+const SCRIPT_MUTATORS = {\n+ default: scriptMutator.ScriptMutator,\n+ foozzie: differentialScriptMutator.DifferentialScriptMutator,\n+};\n+\n+function getRandomInputs(primaryCorpus, secondaryCorpora, count) {\n+ count = random.randInt(2, count);\n+\n+ \/\/ Choose 40%-80% of inputs from primary corpus.\n+ const primaryCount = Math.floor(random.uniform(0.4, 0.8) * count);\n+ count -= primaryCount;\n+\n+ let inputs = primaryCorpus.getRandomTestcases(primaryCount);\n+\n+ \/\/ Split remainder equally between the secondary corpora.\n+ const secondaryCount = Math.floor(count \/ secondaryCorpora.length);\n+\n+ for (let i = 0; i < secondaryCorpora.length; i++) {\n+ let currentCount = secondaryCount;\n+ if (i == secondaryCorpora.length - 1) {\n+ \/\/ Last one takes the remainder.\n+ currentCount = count;\n+ }\n+\n+ count -= currentCount;\n+ if (currentCount) {\n+ inputs = inputs.concat(\n+ secondaryCorpora[i].getRandomTestcases(currentCount));\n+ }\n+ }\n+\n+ return random.shuffle(inputs);\n+}\n+\n+function collect(value, total) {\n+ total.push(value);\n+ return total;\n+}\n+\n+function overrideSettings(settings, settingOverrides) {\n+ for (const setting of settingOverrides) {\n+ const parts = setting.split('=');\n+ settings[parts[0]] = parseFloat(parts[1]);\n+ }\n+}\n+\n+function* randomInputGen(engine) {\n+ const inputDir = path.resolve(program.input_dir);\n+\n+ const v8Corpus = new corpus.Corpus(inputDir, 'v8');\n+ const chakraCorpus = new corpus.Corpus(inputDir, 'chakra');\n+ const spiderMonkeyCorpus = new corpus.Corpus(inputDir, 'spidermonkey');\n+ const jscCorpus = new corpus.Corpus(inputDir, 'WebKit\/JSTests');\n+ const crashTestsCorpus = new corpus.Corpus(inputDir, 'CrashTests');\n+\n+ for (let i = 0; i < program.no_of_files; i++) {\n+ let inputs;\n+ if (engine === 'V8') {\n+ inputs = getRandomInputs(\n+ v8Corpus,\n+ random.shuffle([chakraCorpus, spiderMonkeyCorpus, jscCorpus,\n+ crashTestsCorpus, v8Corpus]),\n+ MAX_TEST_INPUTS_PER_TEST);\n+ } else if (engine == 'chakra') {\n+ inputs = getRandomInputs(\n+ chakraCorpus,\n+ random.shuffle([v8Corpus, spiderMonkeyCorpus, jscCorpus,\n+ crashTestsCorpus]),\n+ MAX_TEST_INPUTS_PER_TEST);\n+ } else if (engine == 'spidermonkey') {\n+ inputs = getRandomInputs(\n+ spiderMonkeyCorpus,\n+ random.shuffle([v8Corpus, chakraCorpus, jscCorpus,\n+ crashTestsCorpus]),\n+ MAX_TEST_INPUTS_PER_TEST);\n+ } else {\n+ inputs = getRandomInputs(\n+ jscCorpus,\n+ random.shuffle([chakraCorpus, spiderMonkeyCorpus, v8Corpus,\n+ crashTestsCorpus]),\n+ MAX_TEST_INPUTS_PER_TEST);\n+ }\n+\n+ if (inputs.length > 0) {\n+ yield inputs;\n+ }\n+ }\n+}\n+\n+function* corpusInputGen() {\n+ const inputCorpus = new corpus.Corpus(\n+ path.resolve(program.input_dir),\n+ program.mutate_corpus,\n+ program.extra_strict);\n+ for (const input of inputCorpus.getAllTestcases()) {\n+ yield [input];\n+ }\n+}\n+\n+function* enumerate(iterable) {\n+ let i = 0;\n+ for (const value of iterable) {\n+ yield [i, value];\n+ i++;\n+ }\n+}\n+\n+function main() {\n+ Error.stackTraceLimit = Infinity;\n+\n+ program\n+ .version('0.0.1')\n+ .option('-i, --input_dir ', 'Input directory.')\n+ .option('-o, --output_dir ', 'Output directory.')\n+ .option('-n, --no_of_files ', 'Output directory.', parseInt)\n+ .option('-c, --mutate_corpus ', 'Mutate single files in a corpus.')\n+ .option('-e, --extra_strict', 'Additionally parse files in strict mode.')\n+ .option('-m, --mutate ', 'Mutate a file and output results.')\n+ .option('-s, --setting [setting]', 'Settings overrides.', collect, [])\n+ .option('-v, --verbose', 'More verbose printing.')\n+ .option('-z, --zero_settings', 'Zero all settings.')\n+ .parse(process.argv);\n+\n+ const settings = scriptMutator.defaultSettings();\n+ if (program.zero_settings) {\n+ for (const key of Object.keys(settings)) {\n+ settings[key] = 0.0;\n+ }\n+ }\n+\n+ if (program.setting.length > 0) {\n+ overrideSettings(settings, program.setting);\n+ }\n+\n+ let app_name = process.env.APP_NAME;\n+ if (app_name && app_name.endsWith('.exe')) {\n+ app_name = app_name.substr(0, app_name.length - 4);\n+ }\n+\n+ if (app_name === 'd8' ||\n+ app_name === 'v8_simple_inspector_fuzzer' ||\n+ app_name === 'v8_foozzie.py') {\n+ \/\/ V8 supports running the raw d8 executable, the inspector fuzzer or\n+ \/\/ the differential fuzzing harness 'foozzie'.\n+ settings.engine = 'V8';\n+ } else if (app_name === 'ch') {\n+ settings.engine = 'chakra';\n+ } else if (app_name === 'js') {\n+ settings.engine = 'spidermonkey';\n+ } else if (app_name === 'jsc') {\n+ settings.engine = 'jsc';\n+ } else {\n+ console.log('ERROR: Invalid APP_NAME');\n+ process.exit(1);\n+ }\n+\n+ const mode = process.env.FUZZ_MODE || 'default';\n+ assert(mode in SCRIPT_MUTATORS, `Unknown mode ${mode}`);\n+ const mutator = new SCRIPT_MUTATORS[mode](settings);\n+\n+ if (program.mutate) {\n+ const absPath = path.resolve(program.mutate);\n+ const baseDir = path.dirname(absPath);\n+ const fileName = path.basename(absPath);\n+ const input = sourceHelpers.loadSource(\n+ baseDir, fileName, program.extra_strict);\n+ const mutated = mutator.mutateMultiple([input]);\n+ console.log(mutated.code);\n+ return;\n+ }\n+\n+ let inputGen;\n+\n+ if (program.mutate_corpus) {\n+ inputGen = corpusInputGen();\n+ } else {\n+ inputGen = randomInputGen(settings.engine);\n+ }\n+\n+ for (const [i, inputs] of enumerate(inputGen)) {\n+ const outputPath = path.join(program.output_dir, 'fuzz-' + i + '.js');\n+\n+ const start = Date.now();\n+ const paths = inputs.map(input => input.relPath);\n+\n+ try {\n+ const mutated = mutator.mutateMultiple(inputs);\n+ fs.writeFileSync(outputPath, mutated.code);\n+\n+ if (settings.engine === 'V8' && mutated.flags && mutated.flags.length > 0) {\n+ const flagsPath = path.join(program.output_dir, 'flags-' + i + '.js');\n+ fs.writeFileSync(flagsPath, mutated.flags.join(' '));\n+ }\n+ } catch (e) {\n+ if (e.message.startsWith('ENOSPC')) {\n+ console.log('ERROR: No space left. Bailing out...');\n+ console.log(e);\n+ return;\n+ }\n+ console.log(`ERROR: Exception during mutate: ${paths}`);\n+ console.log(e);\n+ continue;\n+ } finally {\n+ if (program.verbose) {\n+ const duration = Date.now() - start;\n+ console.log(`Mutating ${paths} took ${duration} ms.`);\n+ }\n+ }\n+ if ((i + 1) % 10 == 0) {\n+ console.log('Up to ', i + 1);\n+ }\n+ }\n+}\n+\n+main();\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/script_mutator.js b\/compiler\/forget\/packages\/js-fuzzer\/script_mutator.js\nnew file mode 100644\nindex 0000000000..8729a73f30\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/script_mutator.js\n@@ -0,0 +1,253 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Script mutator.\n+ *\/\n+\n+'use strict';\n+\n+const fs = require('fs');\n+const path = require('path');\n+\n+const common = require('.\/mutators\/common.js');\n+const db = require('.\/db.js');\n+const random = require('.\/random.js');\n+const sourceHelpers = require('.\/source_helpers.js');\n+\n+const { AddTryCatchMutator } = require('.\/mutators\/try_catch.js');\n+const { ArrayMutator } = require('.\/mutators\/array_mutator.js');\n+const { CrossOverMutator } = require('.\/mutators\/crossover_mutator.js');\n+const { ExpressionMutator } = require('.\/mutators\/expression_mutator.js');\n+const { FunctionCallMutator } = require('.\/mutators\/function_call_mutator.js');\n+const { IdentifierNormalizer } = require('.\/mutators\/normalizer.js');\n+const { NumberMutator } = require('.\/mutators\/number_mutator.js');\n+const { ObjectMutator } = require('.\/mutators\/object_mutator.js');\n+const { VariableMutator } = require('.\/mutators\/variable_mutator.js');\n+const { VariableOrObjectMutator } = require('.\/mutators\/variable_or_object_mutation.js');\n+\n+const MAX_EXTRA_MUTATIONS = 5;\n+\n+function defaultSettings() {\n+ return {\n+ ADD_VAR_OR_OBJ_MUTATIONS: 0.1,\n+ DIFF_FUZZ_EXTRA_PRINT: 0.1,\n+ DIFF_FUZZ_TRACK_CAUGHT: 0.4,\n+ MUTATE_ARRAYS: 0.1,\n+ MUTATE_CROSSOVER_INSERT: 0.05,\n+ MUTATE_EXPRESSIONS: 0.1,\n+ MUTATE_FUNCTION_CALLS: 0.1,\n+ MUTATE_NUMBERS: 0.05,\n+ MUTATE_OBJECTS: 0.1,\n+ MUTATE_VARIABLES: 0.075,\n+ SCRIPT_MUTATOR_EXTRA_MUTATIONS: 0.2,\n+ SCRIPT_MUTATOR_SHUFFLE: 0.2,\n+ };\n+}\n+\n+class Result {\n+ constructor(code, flags) {\n+ this.code = code;\n+ this.flags = flags;\n+ }\n+}\n+\n+class ScriptMutator {\n+ constructor(settings, db_path=undefined) {\n+ \/\/ Use process.cwd() to bypass pkg's snapshot filesystem.\n+ this.mutateDb = new db.MutateDb(db_path || path.join(process.cwd(), 'db'));\n+ this.mutators = [\n+ new ArrayMutator(settings),\n+ new ObjectMutator(settings),\n+ new VariableMutator(settings),\n+ new NumberMutator(settings),\n+ new CrossOverMutator(settings, this.mutateDb),\n+ new ExpressionMutator(settings),\n+ new FunctionCallMutator(settings),\n+ new VariableOrObjectMutator(settings),\n+ ];\n+ this.trycatch = new AddTryCatchMutator(settings);\n+ this.settings = settings;\n+ }\n+\n+ _addMjsunitIfNeeded(dependencies, input) {\n+ if (dependencies.has('mjsunit')) {\n+ return;\n+ }\n+\n+ if (!input.absPath.includes('mjsunit')) {\n+ return;\n+ }\n+\n+ \/\/ Find mjsunit.js\n+ let mjsunitPath = input.absPath;\n+ while (path.dirname(mjsunitPath) != mjsunitPath &&\n+ path.basename(mjsunitPath) != 'mjsunit') {\n+ mjsunitPath = path.dirname(mjsunitPath);\n+ }\n+\n+ if (path.basename(mjsunitPath) == 'mjsunit') {\n+ mjsunitPath = path.join(mjsunitPath, 'mjsunit.js');\n+ dependencies.set('mjsunit', sourceHelpers.loadDependencyAbs(\n+ input.baseDir, mjsunitPath));\n+ return;\n+ }\n+\n+ console.log('ERROR: Failed to find mjsunit.js');\n+ }\n+\n+ _addSpiderMonkeyShellIfNeeded(dependencies, input) {\n+ \/\/ Find shell.js files\n+ const shellJsPaths = new Array();\n+ let currentDir = path.dirname(input.absPath);\n+\n+ while (path.dirname(currentDir) != currentDir) {\n+ const shellJsPath = path.join(currentDir, 'shell.js');\n+ if (fs.existsSync(shellJsPath)) {\n+ shellJsPaths.push(shellJsPath);\n+ }\n+\n+ if (currentDir == 'spidermonkey') {\n+ break;\n+ }\n+ currentDir = path.dirname(currentDir);\n+ }\n+\n+ \/\/ Add shell.js dependencies in reverse to add ones that are higher up in\n+ \/\/ the directory tree first.\n+ for (let i = shellJsPaths.length - 1; i >= 0; i--) {\n+ if (!dependencies.has(shellJsPaths[i])) {\n+ const dependency = sourceHelpers.loadDependencyAbs(\n+ input.baseDir, shellJsPaths[i]);\n+ dependencies.set(shellJsPaths[i], dependency);\n+ }\n+ }\n+ }\n+\n+ _addJSTestStubsIfNeeded(dependencies, input) {\n+ if (dependencies.has('jstest_stubs') ||\n+ !input.absPath.includes('JSTests')) {\n+ return;\n+ }\n+ dependencies.set(\n+ 'jstest_stubs', sourceHelpers.loadResource('jstest_stubs.js'));\n+ }\n+\n+ mutate(source) {\n+ let mutators = this.mutators.slice();\n+ let annotations = [];\n+ if (random.choose(this.settings.SCRIPT_MUTATOR_SHUFFLE)){\n+ annotations.push(' Script mutator: using shuffled mutators');\n+ random.shuffle(mutators);\n+ }\n+\n+ if (random.choose(this.settings.SCRIPT_MUTATOR_EXTRA_MUTATIONS)){\n+ for (let i = random.randInt(1, MAX_EXTRA_MUTATIONS); i > 0; i--) {\n+ let mutator = random.single(this.mutators);\n+ mutators.push(mutator);\n+ annotations.push(` Script mutator: extra ${mutator.constructor.name}`);\n+ }\n+ }\n+\n+ \/\/ Try-catch wrapping should always be the last mutation.\n+ mutators.push(this.trycatch);\n+\n+ for (const mutator of mutators) {\n+ mutator.mutate(source);\n+ }\n+\n+ for (const annotation of annotations.reverse()) {\n+ sourceHelpers.annotateWithComment(source.ast, annotation);\n+ }\n+ }\n+\n+ \/\/ Returns parsed dependencies for inputs.\n+ resolveInputDependencies(inputs) {\n+ const dependencies = new Map();\n+\n+ \/\/ Resolve test harness files.\n+ inputs.forEach(input => {\n+ try {\n+ \/\/ TODO(machenbach): Some harness files contain load expressions\n+ \/\/ that are not recursively resolved. We already remove them, but we\n+ \/\/ also need to load the dependencies they point to.\n+ this._addJSTestStubsIfNeeded(dependencies, input);\n+ this._addMjsunitIfNeeded(dependencies, input)\n+ this._addSpiderMonkeyShellIfNeeded(dependencies, input);\n+ } catch (e) {\n+ console.log(\n+ 'ERROR: Failed to resolve test harness for', input.relPath);\n+ throw e;\n+ }\n+ });\n+\n+ \/\/ Resolve dependencies loaded within the input files.\n+ inputs.forEach(input => {\n+ try {\n+ input.loadDependencies(dependencies);\n+ } catch (e) {\n+ console.log(\n+ 'ERROR: Failed to resolve dependencies for', input.relPath);\n+ throw e;\n+ }\n+ });\n+\n+ \/\/ Map.values() returns values in insertion order.\n+ return Array.from(dependencies.values());\n+ }\n+\n+ \/\/ Combines input dependencies with fuzzer resources.\n+ resolveDependencies(inputs) {\n+ const dependencies = this.resolveInputDependencies(inputs);\n+\n+ \/\/ Add stubs for non-standard functions in the beginning.\n+ dependencies.unshift(sourceHelpers.loadResource('stubs.js'));\n+\n+ \/\/ Add our fuzzing support helpers. This also overrides some common test\n+ \/\/ functions from earlier dependencies that cause early bailouts.\n+ dependencies.push(sourceHelpers.loadResource('fuzz_library.js'));\n+\n+ return dependencies;\n+ }\n+\n+ \/\/ Normalizes, combines and mutates multiple inputs.\n+ mutateInputs(inputs) {\n+ const normalizerMutator = new IdentifierNormalizer();\n+\n+ for (const [index, input] of inputs.entries()) {\n+ try {\n+ normalizerMutator.mutate(input);\n+ } catch (e) {\n+ console.log('ERROR: Failed to normalize ', input.relPath);\n+ throw e;\n+ }\n+\n+ common.setSourceLoc(input, index, inputs.length);\n+ }\n+\n+ \/\/ Combine ASTs into one. This is so that mutations have more context to\n+ \/\/ cross over content between ASTs (e.g. variables).\n+ const combinedSource = common.concatPrograms(inputs);\n+ this.mutate(combinedSource);\n+\n+ return combinedSource;\n+ }\n+\n+ mutateMultiple(inputs) {\n+ \/\/ High level operation:\n+ \/\/ 1) Compute dependencies from inputs.\n+ \/\/ 2) Normalize, combine and mutate inputs.\n+ \/\/ 3) Generate code with dependency code prepended.\n+ const dependencies = this.resolveDependencies(inputs);\n+ const combinedSource = this.mutateInputs(inputs);\n+ const code = sourceHelpers.generateCode(combinedSource, dependencies);\n+ const flags = common.concatFlags(dependencies.concat([combinedSource]));\n+ return new Result(code, flags);\n+ }\n+}\n+\n+module.exports = {\n+ defaultSettings: defaultSettings,\n+ ScriptMutator: ScriptMutator,\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/source_helpers.js b\/compiler\/forget\/packages\/js-fuzzer\/source_helpers.js\nnew file mode 100644\nindex 0000000000..28709e6b56\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/source_helpers.js\n@@ -0,0 +1,466 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Source loader.\n+ *\/\n+\n+const fs = require('fs');\n+const fsPath = require('path');\n+\n+const { EOL } = require('os');\n+\n+const babelGenerator = require('@babel\/generator').default;\n+const babelTraverse = require('@babel\/traverse').default;\n+const babelTypes = require('@babel\/types');\n+const babylon = require('@babel\/parser');\n+\n+const exceptions = require('.\/exceptions.js');\n+\n+const SCRIPT = Symbol('SCRIPT');\n+const MODULE = Symbol('MODULE');\n+\n+const V8_BUILTIN_PREFIX = '__V8Builtin';\n+const V8_REPLACE_BUILTIN_REGEXP = new RegExp(\n+ V8_BUILTIN_PREFIX + '(\\\\w+)\\\\(', 'g');\n+\n+const BABYLON_OPTIONS = {\n+ sourceType: 'script',\n+ allowReturnOutsideFunction: true,\n+ tokens: false,\n+ ranges: false,\n+ plugins: [\n+ 'asyncGenerators',\n+ 'bigInt',\n+ 'classPrivateMethods',\n+ 'classPrivateProperties',\n+ 'classProperties',\n+ 'doExpressions',\n+ 'exportDefaultFrom',\n+ 'nullishCoalescingOperator',\n+ 'numericSeparator',\n+ 'objectRestSpread',\n+ 'optionalCatchBinding',\n+ 'optionalChaining',\n+ ],\n+}\n+\n+const BABYLON_REPLACE_VAR_OPTIONS = Object.assign({}, BABYLON_OPTIONS);\n+BABYLON_REPLACE_VAR_OPTIONS['placeholderPattern'] = \/^VAR_[0-9]+$\/;\n+\n+function _isV8OrSpiderMonkeyLoad(path) {\n+ \/\/ 'load' and 'loadRelativeToScript' used by V8 and SpiderMonkey.\n+ return (babelTypes.isIdentifier(path.node.callee) &&\n+ (path.node.callee.name == 'load' ||\n+ path.node.callee.name == 'loadRelativeToScript') &&\n+ path.node.arguments.length == 1 &&\n+ babelTypes.isStringLiteral(path.node.arguments[0]));\n+}\n+\n+function _isChakraLoad(path) {\n+ \/\/ 'WScript.LoadScriptFile' used by Chakra.\n+ \/\/ TODO(ochang): The optional second argument can change semantics (\"self\",\n+ \/\/ \"samethread\", \"crossthread\" etc).\n+ \/\/ Investigate whether if it still makes sense to include them.\n+ return (babelTypes.isMemberExpression(path.node.callee) &&\n+ babelTypes.isIdentifier(path.node.callee.property) &&\n+ path.node.callee.property.name == 'LoadScriptFile' &&\n+ path.node.arguments.length >= 1 &&\n+ babelTypes.isStringLiteral(path.node.arguments[0]));\n+}\n+\n+function _findPath(path, caseSensitive=true) {\n+ \/\/ If the path exists, return the path. Otherwise return null. Used to handle\n+ \/\/ case insensitive matches for Chakra tests.\n+ if (caseSensitive) {\n+ return fs.existsSync(path) ? path : null;\n+ }\n+\n+ path = fsPath.normalize(fsPath.resolve(path));\n+ const pathComponents = path.split(fsPath.sep);\n+ let realPath = fsPath.resolve(fsPath.sep);\n+\n+ for (let i = 1; i < pathComponents.length; i++) {\n+ \/\/ For each path component, do a directory listing to see if there is a case\n+ \/\/ insensitive match.\n+ const curListing = fs.readdirSync(realPath);\n+ let realComponent = null;\n+ for (const component of curListing) {\n+ if (i < pathComponents.length - 1 &&\n+ !fs.statSync(fsPath.join(realPath, component)).isDirectory()) {\n+ continue;\n+ }\n+\n+ if (component.toLowerCase() == pathComponents[i].toLowerCase()) {\n+ realComponent = component;\n+ break;\n+ }\n+ }\n+\n+ if (!realComponent) {\n+ return null;\n+ }\n+\n+ realPath = fsPath.join(realPath, realComponent);\n+ }\n+\n+ return realPath;\n+}\n+\n+function _findDependentCodePath(filePath, baseDirectory, caseSensitive=true) {\n+ const fullPath = fsPath.join(baseDirectory, filePath);\n+\n+ const realPath = _findPath(fullPath, caseSensitive)\n+ if (realPath) {\n+ \/\/ Check base directory of current file.\n+ return realPath;\n+ }\n+\n+ while (fsPath.dirname(baseDirectory) != baseDirectory) {\n+ \/\/ Walk up the directory tree.\n+ const testPath = fsPath.join(baseDirectory, filePath);\n+ const realPath = _findPath(testPath, caseSensitive)\n+ if (realPath) {\n+ return realPath;\n+ }\n+\n+ baseDirectory = fsPath.dirname(baseDirectory);\n+ }\n+\n+ return null;\n+}\n+\n+\/**\n+ * Removes V8\/Spidermonkey\/Chakra load expressions in a source AST and returns\n+ * their string values in an array.\n+ *\n+ * @param {string} originalFilePath Absolute path to file.\n+ * @param {AST} ast Babel AST of the sources.\n+ *\/\n+function resolveLoads(originalFilePath, ast) {\n+ const dependencies = [];\n+\n+ babelTraverse(ast, {\n+ CallExpression(path) {\n+ const isV8OrSpiderMonkeyLoad = _isV8OrSpiderMonkeyLoad(path);\n+ const isChakraLoad = _isChakraLoad(path);\n+ if (!isV8OrSpiderMonkeyLoad && !isChakraLoad) {\n+ return;\n+ }\n+\n+ let loadValue = path.node.arguments[0].extra.rawValue;\n+ \/\/ Normalize Windows path separators.\n+ loadValue = loadValue.replace(\/\\\\\/g, fsPath.sep);\n+\n+ \/\/ Remove load call.\n+ path.remove();\n+\n+ const resolvedPath = _findDependentCodePath(\n+ loadValue, fsPath.dirname(originalFilePath), !isChakraLoad);\n+ if (!resolvedPath) {\n+ console.log('ERROR: Could not find dependent path for', loadValue);\n+ return;\n+ }\n+\n+ if (exceptions.isTestSkippedAbs(resolvedPath)) {\n+ \/\/ Dependency is skipped.\n+ return;\n+ }\n+\n+ \/\/ Add the dependency path.\n+ dependencies.push(resolvedPath);\n+ }\n+ });\n+ return dependencies;\n+}\n+\n+function isStrictDirective(directive) {\n+ return (directive.value &&\n+ babelTypes.isDirectiveLiteral(directive.value) &&\n+ directive.value.value === 'use strict');\n+}\n+\n+function replaceV8Builtins(code) {\n+ return code.replace(\/%(\\w+)\\(\/g, V8_BUILTIN_PREFIX + '$1(');\n+}\n+\n+function restoreV8Builtins(code) {\n+ return code.replace(V8_REPLACE_BUILTIN_REGEXP, '%$1(');\n+}\n+\n+function maybeUseStict(code, useStrict) {\n+ if (useStrict) {\n+ return `'use strict';${EOL}${EOL}${code}`;\n+ }\n+ return code;\n+}\n+\n+class Source {\n+ constructor(baseDir, relPath, flags, dependentPaths) {\n+ this.baseDir = baseDir;\n+ this.relPath = relPath;\n+ this.flags = flags;\n+ this.dependentPaths = dependentPaths;\n+ this.sloppy = exceptions.isTestSloppyRel(relPath);\n+ }\n+\n+ get absPath() {\n+ return fsPath.join(this.baseDir, this.relPath);\n+ }\n+\n+ \/**\n+ * Specifies if the source isn't compatible with strict mode.\n+ *\/\n+ isSloppy() {\n+ return this.sloppy;\n+ }\n+\n+ \/**\n+ * Specifies if the source has a top-level 'use strict' directive.\n+ *\/\n+ isStrict() {\n+ throw Error('Not implemented');\n+ }\n+\n+ \/**\n+ * Generates the code as a string without any top-level 'use strict'\n+ * directives. V8 natives that were replaced before parsing are restored.\n+ *\/\n+ generateNoStrict() {\n+ throw Error('Not implemented');\n+ }\n+\n+ \/**\n+ * Recursively adds dependencies of a this source file.\n+ *\n+ * @param {Map} dependencies Dependency map to which to add new, parsed\n+ * dependencies unless they are already in the map.\n+ * @param {Map} visitedDependencies A set for avoiding loops.\n+ *\/\n+ loadDependencies(dependencies, visitedDependencies) {\n+ visitedDependencies = visitedDependencies || new Set();\n+\n+ for (const absPath of this.dependentPaths) {\n+ if (dependencies.has(absPath) ||\n+ visitedDependencies.has(absPath)) {\n+ \/\/ Already added.\n+ continue;\n+ }\n+\n+ \/\/ Prevent infinite loops.\n+ visitedDependencies.add(absPath);\n+\n+ \/\/ Recursively load dependencies.\n+ const dependency = loadDependencyAbs(this.baseDir, absPath);\n+ dependency.loadDependencies(dependencies, visitedDependencies);\n+\n+ \/\/ Add the dependency.\n+ dependencies.set(absPath, dependency);\n+ }\n+ }\n+}\n+\n+\/**\n+ * Represents sources whose AST can be manipulated.\n+ *\/\n+class ParsedSource extends Source {\n+ constructor(ast, baseDir, relPath, flags, dependentPaths) {\n+ super(baseDir, relPath, flags, dependentPaths);\n+ this.ast = ast;\n+ }\n+\n+ isStrict() {\n+ return !!this.ast.program.directives.filter(isStrictDirective).length;\n+ }\n+\n+ generateNoStrict() {\n+ const allDirectives = this.ast.program.directives;\n+ this.ast.program.directives = this.ast.program.directives.filter(\n+ directive => !isStrictDirective(directive));\n+ try {\n+ const code = babelGenerator(this.ast.program, {comments: true}).code;\n+ return restoreV8Builtins(code);\n+ } finally {\n+ this.ast.program.directives = allDirectives;\n+ }\n+ }\n+}\n+\n+\/**\n+ * Represents sources with cached code.\n+ *\/\n+class CachedSource extends Source {\n+ constructor(source) {\n+ super(source.baseDir, source.relPath, source.flags, source.dependentPaths);\n+ this.use_strict = source.isStrict();\n+ this.code = source.generateNoStrict();\n+ }\n+\n+ isStrict() {\n+ return this.use_strict;\n+ }\n+\n+ generateNoStrict() {\n+ return this.code;\n+ }\n+}\n+\n+\/**\n+ * Read file path into an AST.\n+ *\n+ * Post-processes the AST by replacing V8 natives and removing disallowed\n+ * natives, as well as removing load expressions and adding the paths-to-load\n+ * as meta data.\n+ *\/\n+function loadSource(baseDir, relPath, parseStrict=false) {\n+ const absPath = fsPath.resolve(fsPath.join(baseDir, relPath));\n+ const data = fs.readFileSync(absPath, 'utf-8');\n+\n+ if (guessType(data) !== SCRIPT) {\n+ return null;\n+ }\n+\n+ const preprocessed = maybeUseStict(replaceV8Builtins(data), parseStrict);\n+ const ast = babylon.parse(preprocessed, BABYLON_OPTIONS);\n+\n+ removeComments(ast);\n+ cleanAsserts(ast);\n+ annotateWithOriginalPath(ast, relPath);\n+\n+ const flags = loadFlags(data);\n+ const dependentPaths = resolveLoads(absPath, ast);\n+\n+ return new ParsedSource(ast, baseDir, relPath, flags, dependentPaths);\n+}\n+\n+function guessType(data) {\n+ if (data.includes('\/\/ MODULE')) {\n+ return MODULE;\n+ }\n+\n+ return SCRIPT;\n+}\n+\n+\/**\n+ * Remove existing comments.\n+ *\/\n+function removeComments(ast) {\n+ babelTraverse(ast, {\n+ enter(path) {\n+ babelTypes.removeComments(path.node);\n+ }\n+ });\n+}\n+\n+\/**\n+ * Removes \"Assert\" from strings in spidermonkey shells or from older\n+ * crash tests: https:\/\/crbug.com\/1068268\n+ *\/\n+function cleanAsserts(ast) {\n+ function replace(string) {\n+ return string == null ? null : string.replace(\/[Aa]ssert\/g, '*****t');\n+ }\n+ babelTraverse(ast, {\n+ StringLiteral(path) {\n+ path.node.value = replace(path.node.value);\n+ path.node.extra.raw = replace(path.node.extra.raw);\n+ path.node.extra.rawValue = replace(path.node.extra.rawValue);\n+ },\n+ TemplateElement(path) {\n+ path.node.value.cooked = replace(path.node.value.cooked);\n+ path.node.value.raw = replace(path.node.value.raw);\n+ },\n+ });\n+}\n+\n+\/**\n+ * Annotate code with top-level comment.\n+ *\/\n+function annotateWithComment(ast, comment) {\n+ if (ast.program && ast.program.body && ast.program.body.length > 0) {\n+ babelTypes.addComment(\n+ ast.program.body[0], 'leading', comment, true);\n+ }\n+}\n+\n+\/**\n+ * Annotate code with original file path.\n+ *\/\n+function annotateWithOriginalPath(ast, relPath) {\n+ annotateWithComment(ast, ' Original: ' + relPath);\n+}\n+\n+\/\/ TODO(machenbach): Move this into the V8 corpus. Other test suites don't\n+\/\/ use this flag logic.\n+function loadFlags(data) {\n+ const result = [];\n+ let count = 0;\n+ for (const line of data.split('\\n')) {\n+ if (count++ > 40) {\n+ \/\/ No need to process the whole file. Flags are always added after the\n+ \/\/ copyright header.\n+ break;\n+ }\n+ const match = line.match(\/\\\/\\\/ Flags:\\s*(.*)\\s*\/);\n+ if (!match) {\n+ continue;\n+ }\n+ for (const flag of exceptions.filterFlags(match[1].split(\/\\s+\/))) {\n+ result.push(flag);\n+ }\n+ }\n+ return result;\n+}\n+\n+\/\/ Convenience helper to load sources with absolute paths.\n+function loadSourceAbs(baseDir, absPath) {\n+ return loadSource(baseDir, fsPath.relative(baseDir, absPath));\n+}\n+\n+const dependencyCache = new Map();\n+\n+function loadDependency(baseDir, relPath) {\n+ const absPath = fsPath.join(baseDir, relPath);\n+ let dependency = dependencyCache.get(absPath);\n+ if (!dependency) {\n+ const source = loadSource(baseDir, relPath);\n+ dependency = new CachedSource(source);\n+ dependencyCache.set(absPath, dependency);\n+ }\n+ return dependency;\n+}\n+\n+function loadDependencyAbs(baseDir, absPath) {\n+ return loadDependency(baseDir, fsPath.relative(baseDir, absPath));\n+}\n+\n+\/\/ Convenience helper to load a file from the resources directory.\n+function loadResource(fileName) {\n+ return loadDependency(__dirname, fsPath.join('resources', fileName));\n+}\n+\n+function generateCode(source, dependencies=[]) {\n+ const allSources = dependencies.concat([source]);\n+ const codePieces = allSources.map(\n+ source => source.generateNoStrict());\n+\n+ if (allSources.some(source => source.isStrict()) &&\n+ !allSources.some(source => source.isSloppy())) {\n+ codePieces.unshift('\\'use strict\\';');\n+ }\n+\n+ return codePieces.join(EOL + EOL);\n+}\n+\n+module.exports = {\n+ BABYLON_OPTIONS: BABYLON_OPTIONS,\n+ BABYLON_REPLACE_VAR_OPTIONS: BABYLON_REPLACE_VAR_OPTIONS,\n+ annotateWithComment: annotateWithComment,\n+ generateCode: generateCode,\n+ loadDependencyAbs: loadDependencyAbs,\n+ loadResource: loadResource,\n+ loadSource: loadSource,\n+ loadSourceAbs: loadSourceAbs,\n+ ParsedSource: ParsedSource,\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/helpers.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/helpers.js\nnew file mode 100644\nindex 0000000000..172f8c8187\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/helpers.js\n@@ -0,0 +1,75 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Test helpers.\n+ *\/\n+\n+'use strict';\n+\n+const assert = require('assert');\n+const path = require('path');\n+const fs = require('fs');\n+\n+const sourceHelpers = require('..\/source_helpers.js');\n+\n+const BASE_DIR = path.join(path.dirname(__dirname), 'test_data');\n+const DB_DIR = path.join(BASE_DIR, 'fake_db');\n+\n+const HEADER = `\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+`;\n+\n+\/**\n+ * Create a function that returns one of `probs` when called. It rotates\n+ * through the values. Useful to replace `random.random()` in tests using\n+ * the probabilities that trigger different interesting cases.\n+ *\/\n+function cycleProbabilitiesFun(probs) {\n+ let index = 0;\n+ return () => {\n+ index = index % probs.length;\n+ return probs[index++];\n+ };\n+}\n+\n+\/**\n+ * Replace Math.random with a deterministic pseudo-random function.\n+ *\/\n+function deterministicRandom(sandbox) {\n+ let seed = 1;\n+ function random() {\n+ const x = Math.sin(seed++) * 10000;\n+ return x - Math.floor(x);\n+ }\n+ sandbox.stub(Math, 'random').callsFake(() => { return random(); });\n+}\n+\n+function loadTestData(relPath) {\n+ return sourceHelpers.loadSource(BASE_DIR, relPath);\n+}\n+\n+function assertExpectedResult(expectedPath, result) {\n+ const absPath = path.join(BASE_DIR, expectedPath);\n+ if (process.env.GENERATE) {\n+ fs.writeFileSync(absPath, HEADER + result.trim() + '\\n');\n+ return;\n+ }\n+\n+ \/\/ Omit copyright header when comparing files.\n+ const expected = fs.readFileSync(absPath, 'utf-8').trim().split('\\n');\n+ expected.splice(0, 4);\n+ assert.strictEqual(expected.join('\\n'), result.trim());\n+}\n+\n+module.exports = {\n+ BASE_DIR: BASE_DIR,\n+ DB_DIR: DB_DIR,\n+ assertExpectedResult: assertExpectedResult,\n+ cycleProbabilitiesFun: cycleProbabilitiesFun,\n+ deterministicRandom: deterministicRandom,\n+ loadTestData: loadTestData,\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_available_variables.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_available_variables.js\nnew file mode 100644\nindex 0000000000..bf699ec5a2\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_available_variables.js\n@@ -0,0 +1,34 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Tests for mutating variables\n+ *\/\n+\n+'use strict';\n+\n+const babelTraverse = require('@babel\/traverse').default;\n+\n+const common = require('..\/mutators\/common.js');\n+const helpers = require('.\/helpers.js');\n+\n+describe('Available variables and functions', () => {\n+ it('test', () => {\n+ const source = helpers.loadTestData('available_variables.js');\n+ const result = new Array();\n+\n+ babelTraverse(source.ast, {\n+ CallExpression(path) {\n+ result.push({\n+ variables: common.availableVariables(path),\n+ functions: common.availableFunctions(path),\n+ });\n+ }\n+ });\n+\n+ helpers.assertExpectedResult(\n+ 'available_variables_expected.js',\n+ JSON.stringify(result, null, 2));\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_corpus.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_corpus.js\nnew file mode 100644\nindex 0000000000..1f35199816\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_corpus.js\n@@ -0,0 +1,113 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Corpus loading.\n+ *\/\n+\n+'use strict';\n+\n+const assert = require('assert');\n+const sinon = require('sinon');\n+\n+const exceptions = require('..\/exceptions.js');\n+const corpus = require('..\/corpus.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+function testSoftSkipped(count, softSkipped, paths) {\n+ sandbox.stub(exceptions, 'getSoftSkipped').callsFake(() => {\n+ return softSkipped;\n+ });\n+ const mjsunit = new corpus.Corpus('test_data', 'mjsunit_softskipped');\n+ const cases = mjsunit.getRandomTestcasePaths(count);\n+ assert.deepEqual(paths, cases);\n+}\n+\n+describe('Loading corpus', () => {\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('keeps all tests with no soft-skipped tests', () => {\n+ sandbox.stub(Math, 'random').callsFake(() => 0.9);\n+ testSoftSkipped(\n+ 3,\n+ [],\n+ ['mjsunit_softskipped\/permitted.js',\n+ 'mjsunit_softskipped\/object-literal.js',\n+ 'mjsunit_softskipped\/regress\/binaryen-123.js']);\n+ });\n+\n+ it('choose one test with no soft-skipped tests', () => {\n+ sandbox.stub(Math, 'random').callsFake(() => 0.9);\n+ testSoftSkipped(\n+ 1,\n+ [],\n+ ['mjsunit_softskipped\/permitted.js']);\n+ });\n+\n+ it('keeps soft-skipped tests', () => {\n+ sandbox.stub(Math, 'random').callsFake(() => 0.9);\n+ testSoftSkipped(\n+ 1,\n+ [\/^binaryen.*\\.js\/, 'object-literal.js'],\n+ ['mjsunit_softskipped\/permitted.js']);\n+ });\n+\n+ it('keeps no generated soft-skipped tests', () => {\n+ sandbox.stub(Math, 'random').callsFake(() => 0.9);\n+ const softSkipped = [\n+ \/\/ Correctly listed full relative path of test case.\n+ 'mjsunit_softskipped\/regress\/binaryen-123.js',\n+ \/\/ Only basename doesn't match.\n+ 'object-literal.js',\n+ \/\/ Only pieces of the path don't match.\n+ 'mjsunit_softskipped',\n+ ];\n+ sandbox.stub(exceptions, 'getGeneratedSoftSkipped').callsFake(\n+ () => { return new Set(softSkipped); });\n+ testSoftSkipped(\n+ 2,\n+ \/\/ None soft-skipped for basenames and regexps.\n+ [],\n+ \/\/ Only binaryen-123.js gets filtered out.\n+ ['mjsunit_softskipped\/object-literal.js',\n+ 'mjsunit_softskipped\/permitted.js']);\n+ });\n+\n+ it('keeps soft-skipped tests by chance', () => {\n+ sandbox.stub(Math, 'random').callsFake(() => 0);\n+ testSoftSkipped(\n+ 3,\n+ [\/^binaryen.*\\.js\/, 'object-literal.js'],\n+ ['mjsunit_softskipped\/object-literal.js',\n+ 'mjsunit_softskipped\/regress\/binaryen-123.js',\n+ 'mjsunit_softskipped\/permitted.js']);\n+ });\n+\n+ it('caches relative paths', () => {\n+ sandbox.stub(Math, 'random').callsFake(() => 0);\n+ sandbox.stub(exceptions, 'getSoftSkipped').callsFake(\n+ () => { return ['object-literal.js']; });\n+ const generatedSoftSkipped = [\n+ 'mjsunit_softskipped\/regress\/binaryen-123.js',\n+ ];\n+ sandbox.stub(exceptions, 'getGeneratedSoftSkipped').callsFake(\n+ () => { return new Set(generatedSoftSkipped); });\n+ const mjsunit = new corpus.Corpus('test_data' , 'mjsunit_softskipped');\n+ assert.deepEqual(\n+ ['mjsunit_softskipped\/object-literal.js',\n+ 'mjsunit_softskipped\/regress\/binaryen-123.js'],\n+ mjsunit.softSkippedFiles);\n+ assert.deepEqual(\n+ ['mjsunit_softskipped\/permitted.js'],\n+ mjsunit.permittedFiles);\n+ assert.deepEqual(\n+ ['mjsunit_softskipped\/permitted.js',\n+ 'mjsunit_softskipped\/object-literal.js',\n+ 'mjsunit_softskipped\/regress\/binaryen-123.js'],\n+ Array.from(mjsunit.relFiles()));\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_db.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_db.js\nnew file mode 100644\nindex 0000000000..1b645865b7\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_db.js\n@@ -0,0 +1,33 @@\n+\/\/ Copyright 2021 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Test the script building the DB.\n+ *\/\n+\n+'use strict';\n+\n+const assert = require('assert');\n+const { execSync } = require(\"child_process\");\n+const fs = require('fs');\n+const path = require('path');\n+const tempy = require('tempy');\n+\n+function buildDb(inputDir, corpusName, outputDir) {\n+ execSync(\n+ `node build_db.js -i ${inputDir} -o ${outputDir} ${corpusName}`,\n+ {stdio: ['pipe']});\n+}\n+\n+describe('DB tests', () => {\n+ \/\/ Test feeds an expression that does not apply.\n+ it('omits erroneous expressions', () => {\n+ const outPath = tempy.directory();\n+ buildDb('test_data\/db', 'this', outPath);\n+ const indexFile = path.join(outPath, 'index.json');\n+ const indexJSON = JSON.parse(fs.readFileSync(indexFile), 'utf-8');\n+ assert.deepEqual(\n+ indexJSON, {\"statements\": [], \"superStatements\": [], \"all\": []});\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_differential_fuzz.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_differential_fuzz.js\nnew file mode 100644\nindex 0000000000..31fe9898c8\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_differential_fuzz.js\n@@ -0,0 +1,141 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Tests for differential fuzzing.\n+ *\/\n+\n+'use strict';\n+\n+const assert = require('assert');\n+const program = require('commander');\n+const sinon = require('sinon');\n+\n+const helpers = require('.\/helpers.js');\n+const scriptMutator = require('..\/script_mutator.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+const random = require('..\/random.js');\n+\n+const { DifferentialFuzzMutator, DifferentialFuzzSuppressions } = require(\n+ '..\/mutators\/differential_fuzz_mutator.js');\n+const { DifferentialScriptMutator } = require(\n+ '..\/differential_script_mutator.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+function testMutators(settings, mutatorClass, inputFile, expectedFile) {\n+ const source = helpers.loadTestData('differential_fuzz\/' + inputFile);\n+\n+ const mutator = new mutatorClass(settings);\n+ mutator.mutate(source);\n+\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'differential_fuzz\/' + expectedFile, mutated);\n+}\n+\n+describe('Differential fuzzing', () => {\n+ beforeEach(() => {\n+ \/\/ Zero settings for all mutators.\n+ this.settings = scriptMutator.defaultSettings();\n+ for (const key of Object.keys(this.settings)) {\n+ this.settings[key] = 0.0;\n+ }\n+ \/\/ By default, deterministically use all mutations of differential\n+ \/\/ fuzzing.\n+ this.settings['DIFF_FUZZ_EXTRA_PRINT'] = 1.0;\n+ this.settings['DIFF_FUZZ_TRACK_CAUGHT'] = 1.0;\n+\n+ \/\/ Fake fuzzer being called with --input_dir flag.\n+ this.oldInputDir = program.input_dir;\n+ program.input_dir = helpers.BASE_DIR;\n+ });\n+\n+ afterEach(() => {\n+ sandbox.restore();\n+ program.input_dir = this.oldInputDir;\n+ });\n+\n+ it('applies suppressions', () => {\n+ \/\/ This selects the first random variable when replacing .arguments.\n+ sandbox.stub(random, 'single').callsFake(a => a[0]);\n+ testMutators(\n+ this.settings,\n+ DifferentialFuzzSuppressions,\n+ 'suppressions.js',\n+ 'suppressions_expected.js');\n+ });\n+\n+ it('adds extra printing', () => {\n+ testMutators(\n+ this.settings,\n+ DifferentialFuzzMutator,\n+ 'mutations.js',\n+ 'mutations_expected.js');\n+ });\n+\n+ it('does no extra printing', () => {\n+ this.settings['DIFF_FUZZ_EXTRA_PRINT'] = 0.0;\n+ testMutators(\n+ this.settings,\n+ DifferentialFuzzMutator,\n+ 'exceptions.js',\n+ 'exceptions_expected.js');\n+ });\n+\n+ it('runs end to end', () => {\n+ \/\/ Don't choose any zeroed settings or IGNORE_DEFAULT_PROB in try-catch\n+ \/\/ mutator. Choose using original flags with >= 2%.\n+ const chooseOrigFlagsProb = 0.2;\n+ sandbox.stub(random, 'choose').callsFake((p) => p >= chooseOrigFlagsProb);\n+\n+ \/\/ Fake build directory from which two json configurations for flags are\n+ \/\/ loaded.\n+ const env = {\n+ APP_DIR: 'test_data\/differential_fuzz',\n+ GENERATE: process.env.GENERATE,\n+ };\n+ sandbox.stub(process, 'env').value(env);\n+\n+ \/\/ Fake loading resources and instead load one fixed fake file for each.\n+ sandbox.stub(sourceHelpers, 'loadResource').callsFake(() => {\n+ return helpers.loadTestData('differential_fuzz\/fake_resource.js');\n+ });\n+\n+ \/\/ Load input files.\n+ const files = [\n+ 'differential_fuzz\/input1.js',\n+ 'differential_fuzz\/input2.js',\n+ ];\n+ const sources = files.map(helpers.loadTestData);\n+\n+ \/\/ Apply top-level fuzzing, with all probabilistic configs switched off.\n+ this.settings['DIFF_FUZZ_EXTRA_PRINT'] = 0.0;\n+ this.settings['DIFF_FUZZ_TRACK_CAUGHT'] = 0.0;\n+ const mutator = new DifferentialScriptMutator(\n+ this.settings, helpers.DB_DIR);\n+ const mutated = mutator.mutateMultiple(sources);\n+ helpers.assertExpectedResult(\n+ 'differential_fuzz\/combined_expected.js', mutated.code);\n+\n+ \/\/ Flags for v8_foozzie.py are calculated from v8_fuzz_experiments.json and\n+ \/\/ v8_fuzz_flags.json in test_data\/differential_fuzz.\n+ const expectedFlags = [\n+ '--first-config=ignition',\n+ '--second-config=ignition_turbo',\n+ '--second-d8=d8',\n+ '--second-config-extra-flags=--foo1',\n+ '--second-config-extra-flags=--foo2',\n+ '--first-config-extra-flags=--flag1',\n+ '--second-config-extra-flags=--flag1',\n+ '--first-config-extra-flags=--flag2',\n+ '--second-config-extra-flags=--flag2',\n+ '--first-config-extra-flags=--flag3',\n+ '--second-config-extra-flags=--flag3',\n+ '--first-config-extra-flags=--flag4',\n+ '--second-config-extra-flags=--flag4'\n+ ];\n+ assert.deepEqual(expectedFlags, mutated.flags);\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_differential_fuzz_library.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_differential_fuzz_library.js\nnew file mode 100644\nindex 0000000000..58e7c88e69\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_differential_fuzz_library.js\n@@ -0,0 +1,113 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Tests for the differential-fuzzing library files.\n+ *\/\n+\n+'use strict';\n+\n+const assert = require('assert');\n+const fs = require('fs');\n+const path = require('path');\n+\n+const libPath = path.resolve(\n+ path.join(__dirname, '..', 'resources', 'differential_fuzz_library.js'));\n+const code = fs.readFileSync(libPath, 'utf-8');\n+\n+\/\/ We wire the print function to write to this result variable.\n+const resultDummy = 'let result; const print = text => { result = text; };';\n+\n+\/\/ The prettyPrinted function from mjsunit is reused in the library.\n+const prettyPrint = 'let prettyPrinted = value => value;';\n+\n+const hookedUpCode = resultDummy + prettyPrint + code;\n+\n+\/\/ Runs the library, adds test code and verifies the result.\n+function testLibrary(testCode, expected) {\n+ \/\/ The code isn't structured as a module. The test code is expected to\n+ \/\/ evaluate to a result which we store in actual.\n+ const actual = eval(hookedUpCode + testCode);\n+ assert.deepEqual(expected, actual);\n+}\n+\n+describe('Differential fuzzing library', () => {\n+ it('prints objects', () => {\n+ testLibrary(\n+ '__prettyPrint([0, 1, 2, 3]); result;',\n+ '[0, 1, 2, 3]');\n+ testLibrary(\n+ '__prettyPrint({0: 1, 2: 3}); result;',\n+ 'Object{0: 1, 2: 3}');\n+ testLibrary(\n+ 'const o = {}; o.k = 42;__prettyPrint(o); result;',\n+ 'Object{k: 42}');\n+ });\n+\n+ it('cuts off deep nesting', () => {\n+ \/\/ We print only until a nesting depth of 4.\n+ testLibrary(\n+ '__prettyPrint({0: [1, 2, [3, {4: []}]]}); result;',\n+ 'Object{0: [1, 2, [3, Object{4: ...}]]}');\n+ });\n+\n+ it('cuts off long strings', () => {\n+ const long = new Array(66).join('a');\n+ const head = new Array(55).join('a');\n+ const tail = new Array(10).join('a');\n+ testLibrary(\n+ `__prettyPrint(\"${long}\"); result;`,\n+ `${head}[...]${tail}`);\n+ \/\/ If the string gets longer, the cut-off version is still the same.\n+ const veryLong = new Array(100).join('a');\n+ testLibrary(\n+ `__prettyPrint(\"${veryLong}\"); result;`,\n+ `${head}[...]${tail}`);\n+ });\n+\n+ it('tracks hash difference', () => {\n+ \/\/ Test that we track a hash value for each string we print.\n+ const long = new Array(66).join('a');\n+ testLibrary(\n+ `__prettyPrint(\"${long}\"); __hash;`,\n+ 2097980794);\n+ \/\/ Test that the hash value differs, also when the cut-off result doesn't.\n+ const veryLong = new Array(100).join('a');\n+ testLibrary(\n+ `__prettyPrint(\"${veryLong}\"); __hash;`,\n+ -428472866);\n+ \/\/ Test that repeated calls update the hash.\n+ testLibrary(\n+ `__prettyPrint(\"${long}\");__prettyPrint(\"${long}\"); __hash;`,\n+ -909224493);\n+ });\n+\n+ it('limits extra printing', () => {\n+ \/\/ Test that after exceeding the limit for calling extra printing, there\n+ \/\/ is no new string printed (in the test case no new result added).\n+ testLibrary(\n+ 'for (let i = 0; i < 20; i++) __prettyPrintExtra(i); result;',\n+ '19');\n+ testLibrary(\n+ 'for (let i = 0; i < 101; i++) __prettyPrintExtra(i); result;',\n+ '99');\n+ testLibrary(\n+ 'for (let i = 0; i < 102; i++) __prettyPrintExtra(i); result;',\n+ '99');\n+ });\n+\n+ it('tracks hash after limit', () => {\n+ \/\/ Test that after exceeding the limit for calling extra printing, the\n+ \/\/ hash is still updated.\n+ testLibrary(\n+ 'for (let i = 0; i < 20; i++) __prettyPrintExtra(i); __hash;',\n+ -945753644);\n+ testLibrary(\n+ 'for (let i = 0; i < 101; i++) __prettyPrintExtra(i); __hash;',\n+ 1907055979);\n+ testLibrary(\n+ 'for (let i = 0; i < 102; i++) __prettyPrintExtra(i); __hash;',\n+ -590842070);\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_load.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_load.js\nnew file mode 100644\nindex 0000000000..202bbbe576\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_load.js\n@@ -0,0 +1,69 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Test normalization.\n+ *\/\n+\n+'use strict';\n+\n+const sinon = require('sinon');\n+\n+const helpers = require('.\/helpers.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+\n+const { ScriptMutator } = require('..\/script_mutator.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+function testLoad(testPath, expectedPath) {\n+ const mutator = new ScriptMutator({}, helpers.DB_DIR);\n+ const source = helpers.loadTestData(testPath);\n+ const dependencies = mutator.resolveInputDependencies([source]);\n+ const code = sourceHelpers.generateCode(source, dependencies);\n+ helpers.assertExpectedResult(expectedPath, code);\n+}\n+\n+describe('V8 dependencies', () => {\n+ it('test', () => {\n+ testLoad(\n+ 'mjsunit\/test_load.js',\n+ 'mjsunit\/test_load_expected.js');\n+\n+ });\n+ it('does not loop indefinitely', () => {\n+ testLoad(\n+ 'mjsunit\/test_load_self.js',\n+ 'mjsunit\/test_load_self_expected.js');\n+ });\n+});\n+\n+describe('Chakra dependencies', () => {\n+ it('test', () => {\n+ testLoad(\n+ 'chakra\/load.js',\n+ 'chakra\/load_expected.js');\n+ });\n+});\n+\n+describe('JSTest dependencies', () => {\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('test', () => {\n+ const fakeStubs = sourceHelpers.loadSource(\n+ helpers.BASE_DIR, 'JSTests\/fake_stub.js');\n+ sandbox.stub(sourceHelpers, 'loadResource').callsFake(() => fakeStubs);\n+ testLoad('JSTests\/load.js', 'JSTests\/load_expected.js');\n+ });\n+});\n+\n+describe('SpiderMonkey dependencies', () => {\n+ it('test', () => {\n+ testLoad(\n+ 'spidermonkey\/test\/load.js',\n+ 'spidermonkey\/test\/load_expected.js');\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_arrays.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_arrays.js\nnew file mode 100644\nindex 0000000000..1af1094725\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_arrays.js\n@@ -0,0 +1,47 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Tests for mutating arrays\n+ *\/\n+\n+'use strict';\n+\n+const sinon = require('sinon');\n+\n+const babylon = require('@babel\/parser');\n+\n+const common = require('..\/mutators\/common.js');\n+const helpers = require('.\/helpers.js');\n+const scriptMutator = require('..\/script_mutator.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+\n+const {ArrayMutator} = require('..\/mutators\/array_mutator.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+describe('Mutate arrays', () => {\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('performs all mutations', () => {\n+ \/\/ Make random operations deterministic.\n+ sandbox.stub(common, 'randomValue').callsFake(\n+ () => babylon.parseExpression('\"\"'));\n+ helpers.deterministicRandom(sandbox);\n+\n+ const source = helpers.loadTestData('mutate_arrays.js');\n+\n+ const settings = scriptMutator.defaultSettings();\n+ settings['MUTATE_ARRAYS'] = 1.0;\n+\n+ const mutator = new ArrayMutator(settings);\n+ mutator.mutate(source);\n+\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'mutate_arrays_expected.js', mutated);\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_expressions.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_expressions.js\nnew file mode 100644\nindex 0000000000..0b808a77a4\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_expressions.js\n@@ -0,0 +1,79 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Tests for mutating expressions\n+ *\/\n+\n+'use strict';\n+\n+const assert = require('assert');\n+\n+const babelTypes = require('@babel\/types');\n+const sinon = require('sinon');\n+\n+const common = require('..\/mutators\/common.js');\n+const expressionMutator = require('..\/mutators\/expression_mutator.js');\n+const helpers = require('.\/helpers.js');\n+const scriptMutator = require('..\/script_mutator.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+const random = require('..\/random.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+function testCloneSiblings(expected_file) {\n+ const source = helpers.loadTestData('mutate_expressions.js');\n+\n+ const settings = scriptMutator.defaultSettings();\n+ settings['MUTATE_EXPRESSIONS'] = 1.0;\n+\n+ const mutator = new expressionMutator.ExpressionMutator(settings);\n+ mutator.mutate(source);\n+\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(expected_file, mutated);\n+}\n+\n+describe('Mutate expressions', () => {\n+ beforeEach(() => {\n+ \/\/ Select the previous sibling.\n+ sandbox.stub(random, 'randInt').callsFake((a, b) => b);\n+ \/\/ This chooses cloning siblings.\n+ sandbox.stub(random, 'random').callsFake(() => 0.8);\n+ });\n+\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('clones previous to current', () => {\n+ \/\/ Keep the order of [previous, current], select previous.\n+ sandbox.stub(random, 'shuffle').callsFake(a => a);\n+ \/\/ Insert after. Keep returning true for the MUTATE_EXPRESSIONS check.\n+ sandbox.stub(random, 'choose').callsFake(a => a === 1);\n+\n+ testCloneSiblings('mutate_expressions_previous_expected.js');\n+ });\n+\n+ it('clones current to previous', () => {\n+ \/\/ Switch the order of [previous, current], select current.\n+ sandbox.stub(random, 'shuffle').callsFake(a => [a[1], a[0]]);\n+ \/\/ Insert before.\n+ sandbox.stub(random, 'choose').callsFake(() => true);\n+\n+ testCloneSiblings('mutate_expressions_current_expected.js');\n+ });\n+});\n+\n+describe('Cloning', () => {\n+ \/\/ Ensure that the source location we add are not cloned.\n+ it('is not copying added state', () => {\n+ const source = helpers.loadTestData('mutate_expressions.js');\n+ common.setSourceLoc(source, 5, 10);\n+ const noopNode = source.ast.program.body[0];\n+ assert.equal(0.5, common.getSourceLoc(noopNode));\n+ const cloned = babelTypes.cloneDeep(noopNode);\n+ assert.equal(undefined, common.getSourceLoc(cloned));\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_function_calls.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_function_calls.js\nnew file mode 100644\nindex 0000000000..70b6038dd6\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_function_calls.js\n@@ -0,0 +1,84 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Tests for mutating funciton calls.\n+ *\/\n+\n+'use strict';\n+\n+const sinon = require('sinon');\n+\n+const helpers = require('.\/helpers.js');\n+const random = require('..\/random.js');\n+const scriptMutator = require('..\/script_mutator.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+const functionCallMutator = require('..\/mutators\/function_call_mutator.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+function loadAndMutate(input_file) {\n+ const source = helpers.loadTestData(input_file);\n+\n+ const settings = scriptMutator.defaultSettings();\n+ settings['engine'] = 'V8';\n+ settings['MUTATE_FUNCTION_CALLS'] = 1.0;\n+\n+ const mutator = new functionCallMutator.FunctionCallMutator(settings);\n+ mutator.mutate(source);\n+ return source;\n+}\n+\n+describe('Mutate functions', () => {\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('is robust without available functions', () => {\n+ sandbox.stub(random, 'random').callsFake(() => { return 0.2; });\n+\n+ \/\/ We just ensure here that mutating this file doesn't throw.\n+ loadAndMutate('mutate_function_call.js');\n+ });\n+\n+ it('optimizes functions with turbofan in V8', () => {\n+ sandbox.stub(random, 'random').callsFake(() => { return 0.5; });\n+ sandbox.stub(random, 'choose').callsFake(p => true);\n+\n+ const source = loadAndMutate('mutate_function_call.js');\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'mutate_function_call_expected.js', mutated);\n+ });\n+\n+ it('optimizes functions with maglev in V8', () => {\n+ sandbox.stub(random, 'random').callsFake(() => { return 0.5; });\n+ \/\/ False-path takes 'Maglev'. Other calls to choose should return\n+ \/\/ true. It's also used to determine if a mutator should be chosen.\n+ sandbox.stub(random, 'choose').callsFake(p => p == 0.7 ? false : true);\n+\n+ const source = loadAndMutate('mutate_function_call.js');\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'mutate_function_call_maglev_expected.js', mutated);\n+ });\n+\n+ it('compiles functions in V8 to baseline', () => {\n+ sandbox.stub(random, 'random').callsFake(() => { return 0.7; });\n+\n+ const source = loadAndMutate('mutate_function_call.js');\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'mutate_function_call_baseline_expected.js', mutated);\n+ });\n+\n+ it('deoptimizes functions in V8', () => {\n+ sandbox.stub(random, 'random').callsFake(() => { return 0.8; });\n+\n+ const source = loadAndMutate('mutate_function_call.js');\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'mutate_function_call_deopt_expected.js', mutated);\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_numbers.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_numbers.js\nnew file mode 100644\nindex 0000000000..b9d63116c8\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_numbers.js\n@@ -0,0 +1,54 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Tests for mutating variables\n+ *\/\n+\n+'use strict';\n+\n+const babelTypes = require('@babel\/types');\n+const sinon = require('sinon');\n+\n+const common = require('..\/mutators\/common.js');\n+const helpers = require('.\/helpers.js');\n+const scriptMutator = require('..\/script_mutator.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+const numberMutator = require('..\/mutators\/number_mutator.js');\n+const random = require('..\/random.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+describe('Mutate numbers', () => {\n+ beforeEach(() => {\n+ sandbox.stub(common, 'nearbyRandomNumber').callsFake(\n+ () => { return babelTypes.numericLiteral(-3) });\n+ sandbox.stub(common, 'randomInterestingNumber').callsFake(\n+ () => { return babelTypes.numericLiteral(-4) });\n+ sandbox.stub(random, 'randInt').callsFake(() => { return -5 });\n+\n+ \/\/ Interesting cases from number mutator.\n+ const interestingProbs = [0.009, 0.05, 0.5];\n+ sandbox.stub(random, 'random').callsFake(\n+ helpers.cycleProbabilitiesFun(interestingProbs));\n+ });\n+\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('test', () => {\n+ const source = helpers.loadTestData('mutate_numbers.js');\n+\n+ const settings = scriptMutator.defaultSettings();\n+ settings['MUTATE_NUMBERS'] = 1.0;\n+\n+ const mutator = new numberMutator.NumberMutator(settings);\n+ mutator.mutate(source);\n+\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'mutate_numbers_expected.js', mutated);\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_objects.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_objects.js\nnew file mode 100644\nindex 0000000000..184e627c7a\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_objects.js\n@@ -0,0 +1,47 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Tests for mutating object expressions\n+ *\/\n+\n+'use strict';\n+\n+const sinon = require('sinon');\n+\n+const babylon = require('@babel\/parser');\n+\n+const common = require('..\/mutators\/common.js');\n+const helpers = require('.\/helpers.js');\n+const scriptMutator = require('..\/script_mutator.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+\n+const {ObjectMutator} = require('..\/mutators\/object_mutator.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+describe('Mutate objects', () => {\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('performs all mutations', () => {\n+ \/\/ Make random operations deterministic.\n+ sandbox.stub(common, 'randomValue').callsFake(\n+ () => babylon.parseExpression('\"\"'));\n+ helpers.deterministicRandom(sandbox);\n+\n+ const source = helpers.loadTestData('mutate_objects.js');\n+\n+ const settings = scriptMutator.defaultSettings();\n+ settings['MUTATE_OBJECTS'] = 1.0;\n+\n+ const mutator = new ObjectMutator(settings);\n+ mutator.mutate(source);\n+\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'mutate_objects_expected.js', mutated);\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_variable_or_object.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_variable_or_object.js\nnew file mode 100644\nindex 0000000000..7bdfe90cb6\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_variable_or_object.js\n@@ -0,0 +1,72 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Test variable-or-object mutator.\n+ *\/\n+\n+'use strict';\n+\n+const babylon = require('@babel\/parser');\n+const sinon = require('sinon');\n+\n+const common = require('..\/mutators\/common.js');\n+const helpers = require('.\/helpers.js');\n+const variableOrObject = require('..\/mutators\/variable_or_object_mutation.js');\n+const random = require('..\/random.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+function testMutations(testPath, expectedPath) {\n+ const source = helpers.loadTestData(testPath);\n+\n+ const mutator = new variableOrObject.VariableOrObjectMutator(\n+ { ADD_VAR_OR_OBJ_MUTATIONS: 1.0 });\n+\n+ mutator.mutate(source);\n+\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(expectedPath, mutated);\n+}\n+\n+describe('Variable or object mutator', () => {\n+ beforeEach(() => {\n+ \/\/ Make before\/after insertion deterministic. This also chooses\n+ \/\/ random objects.\n+ sandbox.stub(random, 'choose').callsFake(() => { return true; });\n+ \/\/ This stubs out the random seed.\n+ sandbox.stub(random, 'randInt').callsFake(() => { return 123; });\n+ \/\/ Random value is itself dependent on too much randomization.\n+ sandbox.stub(common, 'randomValue').callsFake(\n+ () => { return babylon.parseExpression('0'); });\n+ });\n+\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('test', () => {\n+ let index = 0;\n+ \/\/ Test different cases of _randomVariableOrObjectMutations in\n+ \/\/ variable_or_object_mutation.js.\n+ const choices = [\n+ 0.2, \/\/ Trigger recursive case.\n+ 0.3, \/\/ Recursion 1: Delete.\n+ 0.4, \/\/ Recursion 2: Property access.\n+ 0.5, \/\/ Random assignment.\n+ \/\/ 0.6 case for randomFunction omitted as it has too much randomization.\n+ 0.7, \/\/ Variable assignment.\n+ 0.8, \/\/ Object.defineProperty.\n+ 0.9, \/\/ Object.defineProperty recursive.\n+ 0.3, \/\/ Recursion 1: Delete.\n+ 0.4, \/\/ Recursion 2: Property access.\n+ ];\n+ sandbox.stub(random, 'random').callsFake(\n+ () => { return choices[index++]; });\n+ testMutations(\n+ 'mutate_var_or_obj.js',\n+ 'mutate_var_or_obj_expected.js');\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_variables.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_variables.js\nnew file mode 100644\nindex 0000000000..e54459910b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutate_variables.js\n@@ -0,0 +1,47 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Tests for mutating variables\n+ *\/\n+\n+'use strict';\n+\n+const babelTypes = require('@babel\/types');\n+const sinon = require('sinon');\n+\n+const common = require('..\/mutators\/common.js');\n+const helpers = require('.\/helpers.js');\n+const scriptMutator = require('..\/script_mutator.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+const variableMutator = require('..\/mutators\/variable_mutator.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+describe('Mutate variables', () => {\n+ beforeEach(() => {\n+ sandbox.stub(\n+ common, 'randomVariable').callsFake(\n+ () => { return babelTypes.identifier('REPLACED') });\n+ });\n+\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('test', () => {\n+\n+ const source = helpers.loadTestData('mutate_variables.js');\n+\n+ const settings = scriptMutator.defaultSettings();\n+ settings['MUTATE_VARIABLES'] = 1.0;\n+\n+ const mutator = new variableMutator.VariableMutator(settings);\n+ mutator.mutate(source);\n+\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'mutate_variables_expected.js', mutated);\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutation_order.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutation_order.js\nnew file mode 100644\nindex 0000000000..4d7fbfed54\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_mutation_order.js\n@@ -0,0 +1,56 @@\n+\/\/ Copyright 2022 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Test shuffling mutators and extra mutations.\n+ *\n+ * Use minimal probability settings to demonstrate order changes of top-level\n+ * mutators. Which mutations are used exactly is not relevant to the test and\n+ * handled pseudo-randomly.\n+ *\/\n+\n+'use strict';\n+\n+const sinon = require('sinon');\n+\n+const helpers = require('.\/helpers.js');\n+const scriptMutator = require('..\/script_mutator.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+const random = require('..\/random.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+describe('Toplevel mutations', () => {\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('shuffle their order', () => {\n+ \/\/ Make random operations deterministic.\n+ helpers.deterministicRandom(sandbox);\n+\n+ this.settings = {\n+ ADD_VAR_OR_OBJ_MUTATIONS: 0.0,\n+ MUTATE_CROSSOVER_INSERT: 0.0,\n+ MUTATE_EXPRESSIONS: 0.0,\n+ MUTATE_FUNCTION_CALLS: 1.0,\n+ MUTATE_NUMBERS: 1.0,\n+ MUTATE_VARIABLES: 0.0,\n+ SCRIPT_MUTATOR_SHUFFLE: 1.0,\n+ SCRIPT_MUTATOR_EXTRA_MUTATIONS: 1.0,\n+ engine: 'V8',\n+ testing: true,\n+ };\n+\n+ const source = helpers.loadTestData('mutation_order\/input.js');\n+ const mutator = new scriptMutator.ScriptMutator(this.settings, helpers.DB_DIR);\n+ const mutated = mutator.mutateInputs([source]);\n+ const code = sourceHelpers.generateCode(mutated);\n+\n+ \/\/ The test data should be rich enough to produce a pattern from the\n+ \/\/ FunctionCallMutator that afterwards gets mutated by the NumberMutator.\n+ helpers.assertExpectedResult(\n+ 'mutation_order\/output_expected.js', code);\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_normalize.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_normalize.js\nnew file mode 100644\nindex 0000000000..d92ad572e3\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_normalize.js\n@@ -0,0 +1,42 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Test normalization.\n+ *\/\n+\n+'use strict';\n+\n+const helpers = require('.\/helpers.js');\n+const normalizer = require('..\/mutators\/normalizer.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+\n+describe('Normalize', () => {\n+ it('test basic', () => {\n+ const source = helpers.loadTestData('normalize.js');\n+\n+ const mutator = new normalizer.IdentifierNormalizer();\n+ mutator.mutate(source);\n+\n+ const normalized_0 = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'normalize_expected_0.js', normalized_0);\n+\n+ mutator.mutate(source);\n+ const normalized_1 = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'normalize_expected_1.js', normalized_1);\n+ });\n+\n+ it('test simple_test.js', () => {\n+ const source = helpers.loadTestData('simple_test.js');\n+\n+ const mutator = new normalizer.IdentifierNormalizer();\n+ mutator.mutate(source);\n+\n+ const normalized = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(\n+ 'simple_test_expected.js', normalized);\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_random.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_random.js\nnew file mode 100644\nindex 0000000000..b27b992720\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_random.js\n@@ -0,0 +1,51 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Test random utilities.\n+ *\/\n+\n+'use strict';\n+\n+const assert = require('assert');\n+const sinon = require('sinon');\n+\n+const { twoBucketSample } = require('..\/random.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+\n+describe('Two-bucket choosing', () => {\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('with one empty', () => {\n+ sandbox.stub(Math, 'random').callsFake(() => 0.5);\n+ assert.deepEqual([1, 2], twoBucketSample([0, 1, 2], [], 1, 2));\n+ assert.deepEqual([1, 2], twoBucketSample([], [0, 1, 2], 1, 2));\n+ assert.deepEqual([0], twoBucketSample([0], [], 1, 1));\n+ assert.deepEqual([0], twoBucketSample([], [0], 1, 1));\n+ });\n+\n+ it('chooses with 0.3', () => {\n+ sandbox.stub(Math, 'random').callsFake(() => 0.3);\n+ assert.deepEqual([1, 2], twoBucketSample([0, 1, 2], [3, 4, 5], 1, 2));\n+ \/\/ Higher factor.\n+ assert.deepEqual([3, 5], twoBucketSample([0, 1, 2], [3, 4, 5], 4, 2));\n+ });\n+\n+ it('chooses with 0.7', () => {\n+ sandbox.stub(Math, 'random').callsFake(() => 0.7);\n+ assert.deepEqual([4, 3], twoBucketSample([0, 1, 2], [3, 4, 5], 1, 2));\n+ });\n+\n+ it('chooses with 0.5', () => {\n+ sandbox.stub(Math, 'random').callsFake(() => 0.5);\n+ assert.deepEqual([3], twoBucketSample([0, 1], [2, 3, 4, 5], 1, 1));\n+ assert.deepEqual([3], twoBucketSample([0, 1, 2, 3], [4, 5], 1, 1));\n+ \/\/ Higher factor.\n+ assert.deepEqual([4], twoBucketSample([0, 1, 2, 3], [4, 5], 2, 1));\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_regressions.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_regressions.js\nnew file mode 100644\nindex 0000000000..62481f1f40\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_regressions.js\n@@ -0,0 +1,113 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Regression tests.\n+ *\/\n+\n+'use strict';\n+\n+const assert = require('assert');\n+const { execSync } = require(\"child_process\");\n+const fs = require('fs');\n+const sinon = require('sinon');\n+const tempfile = require('tempfile');\n+const tempy = require('tempy');\n+\n+const exceptions = require('..\/exceptions.js');\n+const helpers = require('.\/helpers.js');\n+const scriptMutator = require('..\/script_mutator.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+const SYNTAX_ERROR_RE = \/.*SyntaxError.*\/\n+\n+function createFuzzTest(fake_db, settings, inputFiles) {\n+ const sources = inputFiles.map(input => helpers.loadTestData(input));\n+\n+ const mutator = new scriptMutator.ScriptMutator(settings, fake_db);\n+ const result = mutator.mutateMultiple(sources);\n+\n+ const output_file = tempfile('.js');\n+ fs.writeFileSync(output_file, result.code);\n+ return output_file;\n+}\n+\n+function execFile(jsFile) {\n+ execSync(\"node \" + jsFile, {stdio: ['pipe']});\n+}\n+\n+describe('Regression tests', () => {\n+ beforeEach(() => {\n+ helpers.deterministicRandom(sandbox);\n+\n+ this.settings = {\n+ ADD_VAR_OR_OBJ_MUTATIONS: 0.0,\n+ MUTATE_CROSSOVER_INSERT: 0.0,\n+ MUTATE_EXPRESSIONS: 0.0,\n+ MUTATE_FUNCTION_CALLS: 0.0,\n+ MUTATE_NUMBERS: 0.0,\n+ MUTATE_VARIABLES: 0.0,\n+ engine: 'V8',\n+ testing: true,\n+ }\n+ });\n+\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ it('combine strict and with', () => {\n+ \/\/ Test that when a file with \"use strict\" is used in the inputs,\n+ \/\/ the result is only strict if no other file contains anything\n+ \/\/ prohibited in strict mode (here a with statement).\n+ \/\/ It is assumed that such input files are marked as sloppy in the\n+ \/\/ auto generated exceptions.\n+ sandbox.stub(exceptions, 'getGeneratedSloppy').callsFake(\n+ () => { return new Set(['regress\/strict\/input_with.js']); });\n+ const file = createFuzzTest(\n+ 'test_data\/regress\/strict\/db',\n+ this.settings,\n+ ['regress\/strict\/input_strict.js', 'regress\/strict\/input_with.js']);\n+ execFile(file);\n+ });\n+\n+ it('combine strict and delete', () => {\n+ \/\/ As above with unqualified delete.\n+ sandbox.stub(exceptions, 'getGeneratedSloppy').callsFake(\n+ () => { return new Set(['regress\/strict\/input_delete.js']); });\n+ const file = createFuzzTest(\n+ 'test_data\/regress\/strict\/db',\n+ this.settings,\n+ ['regress\/strict\/input_strict.js', 'regress\/strict\/input_delete.js']);\n+ execFile(file);\n+ });\n+\n+ it('mutates negative value', () => {\n+ \/\/ This tests that the combination of number, function call and expression\n+ \/\/ mutator does't produce an update expression.\n+ \/\/ Previously the 1 in -1 was replaced with another negative number leading\n+ \/\/ to e.g. -\/*comment\/*-2. Then cloning the expression removed the\n+ \/\/ comment and produced --2 in the end.\n+ this.settings['MUTATE_NUMBERS'] = 1.0;\n+ this.settings['MUTATE_FUNCTION_CALLS'] = 1.0;\n+ this.settings['MUTATE_EXPRESSIONS'] = 1.0;\n+ const file = createFuzzTest(\n+ 'test_data\/regress\/numbers\/db',\n+ this.settings,\n+ ['regress\/numbers\/input_negative.js']);\n+ execFile(file);\n+ });\n+\n+ it('mutates indices', () => {\n+ \/\/ Test that indices are not replaced with a negative number causing a\n+ \/\/ syntax error (e.g. {-1: \"\"}).\n+ this.settings['MUTATE_NUMBERS'] = 1.0;\n+ const file = createFuzzTest(\n+ 'test_data\/regress\/numbers\/db',\n+ this.settings,\n+ ['regress\/numbers\/input_indices.js']);\n+ execFile(file);\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test\/test_try_catch.js b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_try_catch.js\nnew file mode 100644\nindex 0000000000..b7cd296404\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test\/test_try_catch.js\n@@ -0,0 +1,85 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Test normalization.\n+ *\/\n+\n+'use strict';\n+\n+const sinon = require('sinon');\n+\n+const common = require('..\/mutators\/common.js');\n+const helpers = require('.\/helpers.js');\n+const random = require('..\/random.js');\n+const sourceHelpers = require('..\/source_helpers.js');\n+const tryCatch = require('..\/mutators\/try_catch.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+function loadSource() {\n+ return helpers.loadTestData('try_catch.js');\n+}\n+\n+function testTryCatch(source, expected) {\n+ const mutator = new tryCatch.AddTryCatchMutator();\n+ mutator.mutate(source);\n+\n+ const mutated = sourceHelpers.generateCode(source);\n+ helpers.assertExpectedResult(expected, mutated);\n+}\n+\n+describe('Try catch', () => {\n+ afterEach(() => {\n+ sandbox.restore();\n+ });\n+\n+ \/\/ Wrap on exit, hence wrap everything nested.\n+ it('wraps all', () => {\n+ sandbox.stub(random, 'choose').callsFake(() => { return false; });\n+ sandbox.stub(random, 'random').callsFake(() => { return 0.7; });\n+ testTryCatch(loadSource(), 'try_catch_expected.js');\n+ });\n+\n+ \/\/ Wrap on enter and skip.\n+ it('wraps toplevel', () => {\n+ sandbox.stub(random, 'choose').callsFake(() => { return false; });\n+ sandbox.stub(random, 'random').callsFake(() => { return 0.04; });\n+ const source = loadSource();\n+\n+ \/\/ Fake source fraction 0.1 (i.e. the second of 10 files).\n+ \/\/ Probability for toplevel try-catch is 0.05.\n+ common.setSourceLoc(source, 1, 10);\n+\n+ testTryCatch(source, 'try_catch_toplevel_expected.js');\n+ });\n+\n+ \/\/ Choose the rare case of skipping try-catch.\n+ it('wraps nothing', () => {\n+ sandbox.stub(random, 'choose').callsFake(() => { return false; });\n+ sandbox.stub(random, 'random').callsFake(() => { return 0.01; });\n+ const source = loadSource();\n+\n+ \/\/ Fake source fraction 0.1 (i.e. the second of 10 files).\n+ \/\/ Probability for skipping is 0.02.\n+ common.setSourceLoc(source, 1, 10);\n+\n+ testTryCatch(source, 'try_catch_nothing_expected.js');\n+ });\n+\n+ \/\/ Choose to alter the target probability to 0.9 resulting in skipping\n+ \/\/ all try-catch.\n+ it('wraps nothing with high target probability', () => {\n+ sandbox.stub(random, 'choose').callsFake(() => { return true; });\n+ sandbox.stub(random, 'uniform').callsFake(() => { return 0.9; });\n+ sandbox.stub(random, 'random').callsFake(() => { return 0.8; });\n+ const source = loadSource();\n+\n+ \/\/ Fake source fraction 0.9 (i.e. the last of 10 files).\n+ \/\/ Probability for skipping is 0.81 (0.9 * 0.9).\n+ common.setSourceLoc(source, 9, 10);\n+\n+ testTryCatch(source, 'try_catch_alternate_expected.js');\n+ });\n+});\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/fake_stub.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/fake_stub.js\nnew file mode 100644\nindex 0000000000..57f50060e2\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/fake_stub.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+print(\"Fake stub\");\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/load.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/load.js\nnew file mode 100644\nindex 0000000000..41582e01b2\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/load.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+print(\"JSTest\");\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/load_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/load_expected.js\nnew file mode 100644\nindex 0000000000..113397c208\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/JSTests\/load_expected.js\n@@ -0,0 +1,9 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: JSTests\/fake_stub.js\n+print(\"Fake stub\");\n+\n+\/\/ Original: JSTests\/load.js\n+print(\"JSTest\");\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/available_variables.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/available_variables.js\nnew file mode 100644\nindex 0000000000..d711567829\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/available_variables.js\n@@ -0,0 +1,33 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+let __v_0 = 0;\n+let __v_1 = 0;\n+\n+console.log(__v_0, __v_1, __f_0, __f_1);\n+\n+function __f_0() {\n+ let __v_2 = 0;\n+ console.log(__v_0, __v_1, __v_2, __f_0, __f_1);\n+}\n+\n+let __v_3 = 0;\n+\n+console.log(__v_0, __v_1, __v_3, __f_0, __f_1);\n+\n+function __f_1(__v_7) {\n+ let __v_4 = 0;\n+\n+ console.log(__v_0, __v_1, __v_3, __v_4, __v_7, __f_0, __f_1);\n+ {\n+ let __v_5 = 0;\n+ var __v_6 = 0;\n+ console.log(__v_0, __v_1, __v_3, __v_4, __v_5, __v_6, __v_7, __f_0, __f_1, __f_2);\n+ function __f_2 () {};\n+ console.log(__v_0, __v_1, __v_3, __v_4, __v_5, __v_6, __v_7, __f_0, __f_1, __f_2);\n+ }\n+ \/\/ TODO(machenbach): __f_2 is missing as available identifier.\n+ console.log(__v_0, __v_1, __v_3, __v_4, __v_6, __v_7, __f_0, __f_1, __f_2);\n+}\n+console.log(__v_0, __v_1, __v_3, __f_0, __f_1);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/available_variables_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/available_variables_expected.js\nnew file mode 100644\nindex 0000000000..4562bb23e4\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/available_variables_expected.js\n@@ -0,0 +1,270 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+[\n+ {\n+ \"variables\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_1\"\n+ }\n+ ],\n+ \"functions\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_1\"\n+ }\n+ ]\n+ },\n+ {\n+ \"variables\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_2\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_1\"\n+ }\n+ ],\n+ \"functions\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_1\"\n+ }\n+ ]\n+ },\n+ {\n+ \"variables\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_1\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_3\"\n+ }\n+ ],\n+ \"functions\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_1\"\n+ }\n+ ]\n+ },\n+ {\n+ \"variables\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_7\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_4\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_1\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_3\"\n+ }\n+ ],\n+ \"functions\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_1\"\n+ }\n+ ]\n+ },\n+ {\n+ \"variables\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_5\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_7\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_4\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_6\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_1\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_3\"\n+ }\n+ ],\n+ \"functions\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_2\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_1\"\n+ }\n+ ]\n+ },\n+ {\n+ \"variables\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_5\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_7\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_4\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_6\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_1\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_3\"\n+ }\n+ ],\n+ \"functions\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_2\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_1\"\n+ }\n+ ]\n+ },\n+ {\n+ \"variables\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_7\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_4\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_6\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_1\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_3\"\n+ }\n+ ],\n+ \"functions\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_1\"\n+ }\n+ ]\n+ },\n+ {\n+ \"variables\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_1\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__v_3\"\n+ }\n+ ],\n+ \"functions\": [\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_0\"\n+ },\n+ {\n+ \"type\": \"Identifier\",\n+ \"name\": \"__f_1\"\n+ }\n+ ]\n+ }\n+]\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/dir\/load3.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/dir\/load3.js\nnew file mode 100644\nindex 0000000000..c836f1b567\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/dir\/load3.js\n@@ -0,0 +1,6 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+WScript.LoadScriptFile(\"..\\\\load2.js\", \"self\");\n+console.log('load3');\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load.js\nnew file mode 100644\nindex 0000000000..bfddb5d69e\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load.js\n@@ -0,0 +1,9 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+if (this.WScript && this.WScript.LoadScriptFile) {\n+ WScript.LoadScriptFile(\"load1.js\");\n+}\n+\n+console.log('load.js');\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load1.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load1.js\nnew file mode 100644\nindex 0000000000..14f6814220\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load1.js\n@@ -0,0 +1,8 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Test case insensitivity.\n+WScript.LoadScriptFile(\"DIR\\\\LoAd3.js\");\n+\n+console.log('load1.js');\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load2.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load2.js\nnew file mode 100644\nindex 0000000000..a8ee5d296e\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load2.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+console.log('load2.js');\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load_expected.js\nnew file mode 100644\nindex 0000000000..9711227ac3\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/chakra\/load_expected.js\n@@ -0,0 +1,17 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: chakra\/load2.js\n+console.log('load2.js');\n+\n+\/\/ Original: chakra\/dir\/load3.js\n+console.log('load3');\n+\n+\/\/ Original: chakra\/load1.js\n+console.log('load1.js');\n+\n+\/\/ Original: chakra\/load.js\n+if (this.WScript && this.WScript.LoadScriptFile) {}\n+\n+console.log('load.js');\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/cross_over_mutator_class_input.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/cross_over_mutator_class_input.js\nnew file mode 100644\nindex 0000000000..f16fb2fe53\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/cross_over_mutator_class_input.js\n@@ -0,0 +1,11 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+class __C {\n+ foo() {\n+ let __v_0 = 2;\n+ let __v_1 = 2;\n+ Math.pow(__v_0, __v_1);\n+ }\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/db\/this\/file.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/db\/this\/file.js\nnew file mode 100644\nindex 0000000000..115616da0d\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/db\/this\/file.js\n@@ -0,0 +1,9 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+function C() {\n+ this.c = \"c\";\n+}\n+\n+var c = new C();\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/combined_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/combined_expected.js\nnew file mode 100644\nindex 0000000000..1caeebd13f\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/combined_expected.js\n@@ -0,0 +1,59 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: differential_fuzz\/fake_resource.js\n+print(\"I'm a resource.\");\n+\n+\/\/ Original: differential_fuzz\/fake_resource.js\n+print(\"I'm a resource.\");\n+\n+\/\/ Original: differential_fuzz\/fake_resource.js\n+print(\"I'm a resource.\");\n+\n+\/\/ Original: differential_fuzz\/fake_resource.js\n+print(\"I'm a resource.\");\n+\n+\/\/ Original: differential_fuzz\/fake_resource.js\n+print(\"I'm a resource.\");\n+\n+\/* DifferentialFuzzMutator: Print variables and exceptions from section *\/\n+try {\n+ print(\"Hash: \" + __hash);\n+ print(\"Caught: \" + __caught);\n+} catch (e) {}\n+\n+print(\"v8-foozzie source: differential_fuzz\/input1.js\");\n+\n+\/\/ Original: differential_fuzz\/input1.js\n+try {\n+ var __v_0 = 0;\n+} catch (e) {}\n+\n+try {\n+ \/* DifferentialFuzzMutator: Pretty printing *\/\n+ __prettyPrintExtra(__v_0);\n+} catch (e) {}\n+\n+\/* DifferentialFuzzMutator: Print variables and exceptions from section *\/\n+try {\n+ print(\"Hash: \" + __hash);\n+ print(\"Caught: \" + __caught);\n+\n+ __prettyPrint(__v_0);\n+} catch (e) {}\n+\n+print(\"v8-foozzie source: differential_fuzz\/input2.js\");\n+\n+\/\/ Original: differential_fuzz\/input2.js\n+let __v_1 = 1;\n+\n+\/* DifferentialFuzzMutator: Print variables and exceptions from section *\/\n+try {\n+ print(\"Hash: \" + __hash);\n+ print(\"Caught: \" + __caught);\n+\n+ __prettyPrint(__v_0);\n+\n+ __prettyPrint(__v_1);\n+} catch (e) {}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/exceptions.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/exceptions.js\nnew file mode 100644\nindex 0000000000..2ff571f716\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/exceptions.js\n@@ -0,0 +1,8 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\n+try {\n+ let __v_0 = boom;\n+} catch (e) {}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/exceptions_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/exceptions_expected.js\nnew file mode 100644\nindex 0000000000..b5498a52f1\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/exceptions_expected.js\n@@ -0,0 +1,16 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: differential_fuzz\/exceptions.js\n+try {\n+ let __v_0 = boom;\n+} catch (e) {\n+ __caught++;\n+}\n+\n+\/* DifferentialFuzzMutator: Print variables and exceptions from section *\/\n+try {\n+ print(\"Hash: \" + __hash);\n+ print(\"Caught: \" + __caught);\n+} catch (e) {}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/fake_resource.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/fake_resource.js\nnew file mode 100644\nindex 0000000000..c417acd365\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/fake_resource.js\n@@ -0,0 +1,7 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\n+\/\/ This file represents anything loaded from the resources directory.\n+print(\"I'm a resource.\");\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/input1.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/input1.js\nnew file mode 100644\nindex 0000000000..cbf2e853c0\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/input1.js\n@@ -0,0 +1,9 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Flags: --flag1 --flag2\n+\/\/ Flags: --flag3\n+\n+var a = 0;\n+print(a);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/input2.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/input2.js\nnew file mode 100644\nindex 0000000000..e22b1cc106\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/input2.js\n@@ -0,0 +1,7 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Flags: --flag4\n+\n+let b = 1;\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/mutations.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/mutations.js\nnew file mode 100644\nindex 0000000000..606527bb2a\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/mutations.js\n@@ -0,0 +1,26 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\n+\/\/ Print after declaration.\n+var __v_0 = [1, 2, 3];\n+\n+\/\/ Don't print after declarations or assigments in loops.\n+for (let __v_1 = 0; __v_1 < 3; __v_1 += 1) {\n+\n+ \/\/ Print after multiple declarations.\n+ let __v_2, __v_3 = 0;\n+\n+ \/\/ Print after assigning to member.\n+ __v_0.foo = undefined;\n+\n+ \/\/ Replace with deep printing.\n+ print(0);\n+\n+ \/\/ Print exception.\n+ try {\n+ \/\/ Print after assignment.\n+ __v_1 += 1;\n+ } catch(e) {}\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/mutations_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/mutations_expected.js\nnew file mode 100644\nindex 0000000000..5b7ff6f413\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/mutations_expected.js\n@@ -0,0 +1,44 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: differential_fuzz\/mutations.js\n+var __v_0 = [1, 2, 3];\n+\n+\/* DifferentialFuzzMutator: Extra variable printing *\/\n+__prettyPrintExtra(__v_0);\n+\n+for (let __v_1 = 0; __v_1 < 3; __v_1 += 1) {\n+ let __v_2,\n+ __v_3 = 0;\n+\n+ \/* DifferentialFuzzMutator: Extra variable printing *\/\n+ __prettyPrintExtra(__v_2);\n+\n+ __prettyPrintExtra(__v_3);\n+\n+ __v_0.foo = undefined;\n+\n+ \/* DifferentialFuzzMutator: Extra variable printing *\/\n+ __prettyPrintExtra(__v_0);\n+\n+ \/* DifferentialFuzzMutator: Pretty printing *\/\n+ __prettyPrintExtra(0);\n+\n+ try {\n+ __v_1 += 1;\n+\n+ \/* DifferentialFuzzMutator: Extra variable printing *\/\n+ __prettyPrintExtra(__v_1);\n+ } catch (e) {\n+ __prettyPrintExtra(e);\n+ }\n+}\n+\n+\/* DifferentialFuzzMutator: Print variables and exceptions from section *\/\n+try {\n+ print(\"Hash: \" + __hash);\n+ print(\"Caught: \" + __caught);\n+\n+ __prettyPrint(__v_0);\n+} catch (e) {}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/suppressions.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/suppressions.js\nnew file mode 100644\nindex 0000000000..59be2c3cbb\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/suppressions.js\n@@ -0,0 +1,15 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ These statements might come from a CrashTest.\n+print(\"v8-foozzie source: some\/file\/name\");\n+print('v8-foozzie source: some\/file\/name');\n+\n+function foo(__v_0) {\n+ \/\/ This is an unsupported language feature.\n+ return 1 in foo.arguments;\n+}\n+\n+\/\/ This leads to precision differences in optimized code.\n+print(192 ** -0.5);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/suppressions_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/suppressions_expected.js\nnew file mode 100644\nindex 0000000000..bf78cae1b5\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/suppressions_expected.js\n@@ -0,0 +1,21 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: differential_fuzz\/suppressions.js\n+print(\n+\/* DifferentialFuzzSuppressions: Replaced magic string *\/\n+\"v***************e: some\/file\/name\");\n+print(\n+\/* DifferentialFuzzSuppressions: Replaced magic string *\/\n+\"v***************e: some\/file\/name\");\n+\n+function foo(__v_0) {\n+ return 1 in\n+ \/* DifferentialFuzzSuppressions: Replaced .arguments *\/\n+ __v_0;\n+}\n+\n+print(\n+\/* DifferentialFuzzSuppressions: Replaced ** *\/\n+192 + -0.5);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/v8_fuzz_experiments.json b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/v8_fuzz_experiments.json\nnew file mode 100644\nindex 0000000000..9f83ff503b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/v8_fuzz_experiments.json\n@@ -0,0 +1,3 @@\n+[\n+ [100, \"ignition\", \"ignition_turbo\", \"d8\"]\n+]\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/v8_fuzz_flags.json b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/v8_fuzz_flags.json\nnew file mode 100644\nindex 0000000000..cbb498c987\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/differential_fuzz\/v8_fuzz_flags.json\n@@ -0,0 +1,3 @@\n+[\n+ [1.0, \"--foo1 --foo2\"]\n+]\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/fake_db\/index.json b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/fake_db\/index.json\nnew file mode 100644\nindex 0000000000..0967ef424b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/fake_db\/index.json\n@@ -0,0 +1 @@\n+{}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/mjsunit.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/mjsunit.js\nnew file mode 100644\nindex 0000000000..1506cd3912\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/mjsunit.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+var fakeMjsunit = 'fake';\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load.js\nnew file mode 100644\nindex 0000000000..342c9d87a3\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load.js\n@@ -0,0 +1,7 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+var testLoad = 'test_load';\n+load('test_data\/mjsunit\/test_load_1.js');\n+load('test_load_0.js');\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_0.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_0.js\nnew file mode 100644\nindex 0000000000..d0e66e4a9f\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_0.js\n@@ -0,0 +1,8 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+load('test_data\/mjsunit\/test_load_1.js');\n+load('test_load_2.js');\n+load('test_load_3.js');\n+var testLoad0 = 'test_load_0';\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_1.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_1.js\nnew file mode 100644\nindex 0000000000..03c9166975\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_1.js\n@@ -0,0 +1,6 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+load('test_load_2.js');\n+var testLoad1 = 'test_load_1';\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_2.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_2.js\nnew file mode 100644\nindex 0000000000..47ef1c7933\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_2.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+var testLoad2 = 'test_load_2';\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_3.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_3.js\nnew file mode 100644\nindex 0000000000..c6a15467be\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_3.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+var testLoad3 = 'test_load_3';\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_expected.js\nnew file mode 100644\nindex 0000000000..e545df8ead\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_expected.js\n@@ -0,0 +1,21 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: mjsunit\/mjsunit.js\n+var fakeMjsunit = 'fake';\n+\n+\/\/ Original: mjsunit\/test_load_2.js\n+var testLoad2 = 'test_load_2';\n+\n+\/\/ Original: mjsunit\/test_load_1.js\n+var testLoad1 = 'test_load_1';\n+\n+\/\/ Original: mjsunit\/test_load_3.js\n+var testLoad3 = 'test_load_3';\n+\n+\/\/ Original: mjsunit\/test_load_0.js\n+var testLoad0 = 'test_load_0';\n+\n+\/\/ Original: mjsunit\/test_load.js\n+var testLoad = 'test_load';\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_self.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_self.js\nnew file mode 100644\nindex 0000000000..31a9f4c507\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_self.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+load(\"test_load_self.js\");\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_self_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_self_expected.js\nnew file mode 100644\nindex 0000000000..495ebf9d0b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit\/test_load_self_expected.js\n@@ -0,0 +1,6 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: mjsunit\/mjsunit.js\n+var fakeMjsunit = 'fake';\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/object-literal.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/object-literal.js\nnew file mode 100644\nindex 0000000000..65ffc18c50\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/object-literal.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Fake file\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/permitted.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/permitted.js\nnew file mode 100644\nindex 0000000000..65ffc18c50\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/permitted.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Fake file\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/regress\/binaryen-123.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/regress\/binaryen-123.js\nnew file mode 100644\nindex 0000000000..65ffc18c50\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mjsunit_softskipped\/regress\/binaryen-123.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Fake file\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_arrays.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_arrays.js\nnew file mode 100644\nindex 0000000000..8d907ae8d9\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_arrays.js\n@@ -0,0 +1,34 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+[];\n+[];\n+[];\n+[];\n+[];\n+[];\n+[];\n+[];\n+[];\n+[];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\n+[1, 2, 3];\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_arrays_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_arrays_expected.js\nnew file mode 100644\nindex 0000000000..ce53377029\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_arrays_expected.js\n@@ -0,0 +1,109 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: mutate_arrays.js\n+\n+\/* ArrayMutator: Remove elements *\/\n+\n+\/* ArrayMutator: Insert a hole *\/\n+[];\n+[];\n+\n+\/* ArrayMutator: Shuffle array *\/\n+[];\n+\n+\/* ArrayMutator: Insert a random value *\/\n+[\"\"];\n+\n+\/* ArrayMutator: Insert a random value (replaced) *\/\n+[\"\"];\n+\n+\/* ArrayMutator: Insert a hole (replaced) *\/\n+[,];\n+[];\n+\n+\/* ArrayMutator: Insert a hole (replaced) *\/\n+[,];\n+\n+\/* ArrayMutator: Remove elements *\/\n+[];\n+\n+\/* ArrayMutator: Remove elements *\/\n+[];\n+\n+\/* ArrayMutator: Duplicate an element *\/\n+[1, 1, 2, 3];\n+\n+\/* ArrayMutator: Insert a random value (replaced) *\/\n+[1, \"\", 3];\n+\n+\/* ArrayMutator: Remove elements *\/\n+[];\n+\n+\/* ArrayMutator: Duplicate an element *\/\n+[1, 2, 3, 2];\n+\n+\/* ArrayMutator: Remove elements *\/\n+[3];\n+\n+\/* ArrayMutator: Duplicate an element (replaced) *\/\n+[1, 2, 3];\n+\n+\/* ArrayMutator: Insert a hole (replaced) *\/\n+\n+\/* ArrayMutator: Duplicate an element (replaced) *\/\n+[1, 2,,];\n+\n+\/* ArrayMutator: Remove elements *\/\n+[1, 2];\n+\n+\/* ArrayMutator: Insert a hole (replaced) *\/\n+\n+\/* ArrayMutator: Duplicate an element *\/\n+[1, 1, 2,,];\n+\n+\/* ArrayMutator: Shuffle array *\/\n+[2, 1, 3];\n+\n+\/* ArrayMutator: Remove elements *\/\n+\n+\/* ArrayMutator: Remove elements *\/\n+[3];\n+\n+\/* ArrayMutator: Duplicate an element (replaced) *\/\n+[1, 2, 1];\n+\n+\/* ArrayMutator: Duplicate an element (replaced) *\/\n+\n+\/* ArrayMutator: Duplicate an element (replaced) *\/\n+[1, 2, 2];\n+\n+\/* ArrayMutator: Insert a random value *\/\n+[1, 2, 3, \"\"];\n+\n+\/* ArrayMutator: Duplicate an element *\/\n+[1, 2, 3, 3];\n+\n+\/* ArrayMutator: Remove elements *\/\n+\n+\/* ArrayMutator: Duplicate an element *\/\n+[1, 2];\n+\n+\/* ArrayMutator: Insert a random value (replaced) *\/\n+\n+\/* ArrayMutator: Duplicate an element (replaced) *\/\n+[1, 2, \"\"];\n+\n+\/* ArrayMutator: Insert a random value (replaced) *\/\n+\n+\/* ArrayMutator: Insert a random value (replaced) *\/\n+[\"\", 2, 3];\n+\n+\/* ArrayMutator: Duplicate an element *\/\n+\n+\/* ArrayMutator: Remove elements *\/\n+[1, 1, 3];\n+\n+\/* ArrayMutator: Remove elements *\/\n+[1, 2];\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions.js\nnew file mode 100644\nindex 0000000000..0ffae115ab\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions.js\n@@ -0,0 +1,8 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+1;\n+let foo = undefined;\n+2;\n+3;\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions_current_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions_current_expected.js\nnew file mode 100644\nindex 0000000000..f3d4e49a1f\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions_current_expected.js\n@@ -0,0 +1,15 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: mutate_expressions.js\n+1;\n+\n+\/* ExpressionMutator: Cloned sibling *\/\n+2;\n+let foo = undefined;\n+\n+\/* ExpressionMutator: Cloned sibling *\/\n+3;\n+2;\n+3;\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions_previous_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions_previous_expected.js\nnew file mode 100644\nindex 0000000000..1473183034\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_expressions_previous_expected.js\n@@ -0,0 +1,12 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: mutate_expressions.js\n+1;\n+let foo = undefined;\n+2;\n+3;\n+\n+\/* ExpressionMutator: Cloned sibling *\/\n+2;\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call.js\nnew file mode 100644\nindex 0000000000..2da557df3d\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call.js\n@@ -0,0 +1,7 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+__f_0(1);\n+a = __f_0(1);\n+foo(1, __f_0());\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_baseline_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_baseline_expected.js\nnew file mode 100644\nindex 0000000000..1c02041cc5\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_baseline_expected.js\n@@ -0,0 +1,16 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/* FunctionCallMutator: Compiling baseline __f_0 *\/\n+%CompileBaseline(__f_0);\n+\n+\/\/ Original: mutate_function_call.js\n+__f_0(1);\n+\n+a = (\n+\/* FunctionCallMutator: Compiling baseline __f_0 *\/\n+%CompileBaseline(__f_0), __f_0(1));\n+foo(1, (\n+\/* FunctionCallMutator: Compiling baseline __f_0 *\/\n+%CompileBaseline(__f_0), __f_0()));\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_deopt_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_deopt_expected.js\nnew file mode 100644\nindex 0000000000..085322c612\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_deopt_expected.js\n@@ -0,0 +1,19 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+var _temp, _temp2;\n+\n+\/\/ Original: mutate_function_call.js\n+\n+\/* FunctionCallMutator: Deoptimizing __f_0 *\/\n+__f_0(1);\n+\n+%DeoptimizeFunction(__f_0);\n+\n+a = (\n+\/* FunctionCallMutator: Deoptimizing __f_0 *\/\n+_temp = __f_0(1), %DeoptimizeFunction(__f_0), _temp);\n+foo(1, (\n+\/* FunctionCallMutator: Deoptimizing __f_0 *\/\n+_temp2 = __f_0(), %DeoptimizeFunction(__f_0), _temp2));\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_expected.js\nnew file mode 100644\nindex 0000000000..f4fe3cb9e8\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_expected.js\n@@ -0,0 +1,23 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+%PrepareFunctionForOptimization(__f_0);\n+\n+__f_0(1);\n+\n+__f_0(1);\n+\n+%OptimizeFunctionOnNextCall(__f_0);\n+\n+\/\/ Original: mutate_function_call.js\n+\n+\/* FunctionCallMutator: Optimizing __f_0 *\/\n+__f_0(1);\n+\n+a = (\n+\/* FunctionCallMutator: Optimizing __f_0 *\/\n+%PrepareFunctionForOptimization(__f_0), __f_0(1), __f_0(1), %OptimizeFunctionOnNextCall(__f_0), __f_0(1));\n+foo(1, (\n+\/* FunctionCallMutator: Optimizing __f_0 *\/\n+%PrepareFunctionForOptimization(__f_0), __f_0(), __f_0(), %OptimizeFunctionOnNextCall(__f_0), __f_0()));\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_maglev_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_maglev_expected.js\nnew file mode 100644\nindex 0000000000..f6b8823635\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_function_call_maglev_expected.js\n@@ -0,0 +1,23 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+%PrepareFunctionForOptimization(__f_0);\n+\n+__f_0(1);\n+\n+__f_0(1);\n+\n+%OptimizeMaglevOnNextCall(__f_0);\n+\n+\/\/ Original: mutate_function_call.js\n+\n+\/* FunctionCallMutator: Optimizing __f_0 *\/\n+__f_0(1);\n+\n+a = (\n+\/* FunctionCallMutator: Optimizing __f_0 *\/\n+%PrepareFunctionForOptimization(__f_0), __f_0(1), __f_0(1), %OptimizeMaglevOnNextCall(__f_0), __f_0(1));\n+foo(1, (\n+\/* FunctionCallMutator: Optimizing __f_0 *\/\n+%PrepareFunctionForOptimization(__f_0), __f_0(), __f_0(), %OptimizeMaglevOnNextCall(__f_0), __f_0()));\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_numbers.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_numbers.js\nnew file mode 100644\nindex 0000000000..44bfc4a262\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_numbers.js\n@@ -0,0 +1,22 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+'use strict';\n+\n+function foo() {\n+ let a = 123;\n+ for (let i = 0; i < 456; i++) {\n+ a += 1;\n+ }\n+\n+ let b = 0;\n+ while (b < 10) {\n+ b += 2;\n+ }\n+\n+ a += 1;\n+}\n+\n+var a = {0: \"\", 1: \"\", get 1(){}};\n+var b = -10;\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_numbers_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_numbers_expected.js\nnew file mode 100644\nindex 0000000000..cac1c6004b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_numbers_expected.js\n@@ -0,0 +1,46 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+'use strict';\n+\n+\/\/ Original: mutate_numbers.js\n+function foo() {\n+ let a =\n+ \/* NumberMutator: Replaced 123 with -5 *\/\n+ -5;\n+\n+ for (let i = 0; i < 456; i++) {\n+ a +=\n+ \/* NumberMutator: Replaced 1 with -4 *\/\n+ -4;\n+ }\n+\n+ let b =\n+ \/* NumberMutator: Replaced 0 with -3 *\/\n+ -3;\n+\n+ while (b < 10) {\n+ b += 2;\n+ }\n+\n+ a +=\n+ \/* NumberMutator: Replaced 1 with -5 *\/\n+ -5;\n+}\n+\n+var a = {\n+ \/* NumberMutator: Replaced 0 with 4 *\/\n+ 4: \"\",\n+\n+ \/* NumberMutator: Replaced 1 with 3 *\/\n+ 3: \"\",\n+\n+ get\n+ \/* NumberMutator: Replaced 1 with 5 *\/\n+ 5() {}\n+\n+};\n+var b =\n+\/* NumberMutator: Replaced -10 with -4 *\/\n+-4;\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_objects.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_objects.js\nnew file mode 100644\nindex 0000000000..3f70329c44\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_objects.js\n@@ -0,0 +1,41 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Empty objects are not manipulated.\n+a = {};\n+a = {};\n+a = {};\n+a = {};\n+a = {};\n+a = {};\n+\n+\/\/ Small objects only get some mutations.\n+a = {1: 0};\n+a = {a: 0};\n+a = {\"s\": 0};\n+a = {1: 0};\n+a = {a: 0};\n+a = {\"s\": 0};\n+\n+\/\/ Larger objects get all mutations.\n+a = {1: \"a\", 2: \"b\", 3: \"c\"};\n+a = {1: \"a\", 2: \"b\", 3: \"c\"};\n+a = {1: \"a\", 2: \"b\", 3: \"c\"};\n+a = {1: \"a\", 2: \"b\", 3: \"c\"};\n+a = {1: \"a\", 2: \"b\", 3: \"c\"};\n+a = {1: \"a\", 2: \"b\", 3: \"c\"};\n+a = {1: \"a\", 2: \"b\", 3: \"c\"};\n+a = {1: \"a\", 2: \"b\", 3: \"c\"};\n+a = {1: \"a\", 2: \"b\", 3: \"c\"};\n+a = {1: \"a\", 2: \"b\", 3: \"c\"};\n+\n+\/\/ Getters and setters are ignored.\n+a = {get bar() { return 0 }, 1: 0, set bar(t) {}};\n+a = {get bar() { return 0 }, 1: 0, set bar(t) {}};\n+a = {get bar() { return 0 }, 1: 0, set bar(t) {}};\n+\n+\/\/ Recursive.\n+a = {1: {4: \"4\", 5: \"5\", 6: \"6\"}, 2: {3: \"3\"}};\n+a = {1: {4: \"4\", 5: \"5\", 6: \"6\"}, 2: {3: \"3\"}};\n+a = {1: {4: \"4\", 5: \"5\", 6: \"6\"}, 2: {3: \"3\"}};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_objects_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_objects_expected.js\nnew file mode 100644\nindex 0000000000..6c3e3cf6d7\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_objects_expected.js\n@@ -0,0 +1,182 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: mutate_objects.js\n+a = {};\n+a = {};\n+a = {};\n+a = {};\n+a = {};\n+a = {};\n+a =\n+\/* ObjectMutator: Insert a random value *\/\n+{\n+ 1: \"\"\n+};\n+a = {\n+ a: 0\n+};\n+a =\n+\/* ObjectMutator: Insert a random value *\/\n+{\n+ \"s\": \"\"\n+};\n+a =\n+\/* ObjectMutator: Stringify a property key *\/\n+{\n+ \"1\": 0\n+};\n+a =\n+\/* ObjectMutator: Remove a property *\/\n+{};\n+a = {\n+ \"s\": 0\n+};\n+a =\n+\/* ObjectMutator: Swap properties *\/\n+{\n+ 1: \"c\",\n+ 2: \"b\",\n+ 3: \"a\"\n+};\n+a =\n+\/* ObjectMutator: Remove a property *\/\n+{\n+ 2: \"b\",\n+ 3: \"c\"\n+};\n+a =\n+\/* ObjectMutator: Insert a random value *\/\n+{\n+ 1: \"a\",\n+ 2: \"\",\n+ 3: \"c\"\n+};\n+a =\n+\/* ObjectMutator: Swap properties *\/\n+{\n+ 1: \"b\",\n+ 2: \"a\",\n+ 3: \"c\"\n+};\n+a =\n+\/* ObjectMutator: Swap properties *\/\n+{\n+ 1: \"c\",\n+ 2: \"b\",\n+ 3: \"a\"\n+};\n+a =\n+\/* ObjectMutator: Stringify a property key *\/\n+{\n+ \"1\": \"a\",\n+ 2: \"b\",\n+ 3: \"c\"\n+};\n+a =\n+\/* ObjectMutator: Remove a property *\/\n+{\n+ 2: \"b\",\n+ 3: \"c\"\n+};\n+a =\n+\/* ObjectMutator: Swap properties *\/\n+{\n+ 1: \"b\",\n+ 2: \"a\",\n+ 3: \"c\"\n+};\n+a =\n+\/* ObjectMutator: Duplicate a property value *\/\n+{\n+ 1: \"c\",\n+ 2: \"b\",\n+ 3: \"c\"\n+};\n+a =\n+\/* ObjectMutator: Duplicate a property value *\/\n+{\n+ 1: \"a\",\n+ 2: \"b\",\n+ 3: \"b\"\n+};\n+a = {\n+ get bar() {\n+ return 0;\n+ },\n+\n+ 1: 0,\n+\n+ set bar(t) {}\n+\n+};\n+a =\n+\/* ObjectMutator: Insert a random value *\/\n+{\n+ get bar() {\n+ return 0;\n+ },\n+\n+ 1: \"\",\n+\n+ set bar(t) {}\n+\n+};\n+a =\n+\/* ObjectMutator: Remove a property *\/\n+{\n+ get bar() {\n+ return 0;\n+ },\n+\n+ set bar(t) {}\n+\n+};\n+a =\n+\/* ObjectMutator: Duplicate a property value *\/\n+{\n+ 1:\n+ \/* ObjectMutator: Remove a property *\/\n+ {},\n+ 2:\n+ \/* ObjectMutator: Stringify a property key *\/\n+ {\n+ \"3\": \"3\"\n+ }\n+};\n+a =\n+\/* ObjectMutator: Duplicate a property value *\/\n+{\n+ 1:\n+ \/* ObjectMutator: Swap properties *\/\n+ {\n+ 4: \"4\",\n+ 5: \"6\",\n+ 6: \"5\"\n+ },\n+ 2:\n+ \/* ObjectMutator: Remove a property *\/\n+ {\n+ 5: \"5\",\n+ 6: \"6\"\n+ }\n+};\n+a =\n+\/* ObjectMutator: Duplicate a property value *\/\n+{\n+ 1:\n+ \/* ObjectMutator: Swap properties *\/\n+ {\n+ 4: \"6\",\n+ 5: \"5\",\n+ 6: \"4\"\n+ },\n+ 2:\n+ \/* ObjectMutator: Stringify a property key *\/\n+ {\n+ 4: \"4\",\n+ 5: \"5\",\n+ \"6\": \"6\"\n+ }\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_var_or_obj.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_var_or_obj.js\nnew file mode 100644\nindex 0000000000..d8a6583eac\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_var_or_obj.js\n@@ -0,0 +1,10 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+let __v_0 = {};\n+Math.pow(1, 2);\n+Math.pow(1, 2);\n+Math.pow(1, 2);\n+Math.pow(1, 2);\n+Math.pow(1, 2);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_var_or_obj_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_var_or_obj_expected.js\nnew file mode 100644\nindex 0000000000..19a4d5fd47\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_var_or_obj_expected.js\n@@ -0,0 +1,37 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: mutate_var_or_obj.js\n+let __v_0 = {};\n+\n+\/* VariableOrObjectMutator: Random mutation *\/\n+delete __getRandomObject(123)[__getRandomProperty(__getRandomObject(123), 123)], __callGC();\n+__getRandomObject(123)[__getRandomProperty(__getRandomObject(123), 123)], __callGC();\n+Math.pow(1, 2);\n+\n+\/* VariableOrObjectMutator: Random mutation *\/\n+__getRandomObject(123)[__getRandomProperty(__getRandomObject(123), 123)] = 0, __callGC();\n+Math.pow(1, 2);\n+\n+\/* VariableOrObjectMutator: Random mutation *\/\n+__v_0 = __getRandomObject(123), __callGC();\n+Math.pow(1, 2);\n+\n+\/* VariableOrObjectMutator: Random mutation *\/\n+if (__getRandomObject(123) != null && typeof __getRandomObject(123) == \"object\") Object.defineProperty(__getRandomObject(123), __getRandomProperty(__getRandomObject(123), 123), {\n+ value: 0\n+});\n+Math.pow(1, 2);\n+\n+\/* VariableOrObjectMutator: Random mutation *\/\n+if (__getRandomObject(123) != null && typeof __getRandomObject(123) == \"object\") Object.defineProperty(__getRandomObject(123), __getRandomProperty(__getRandomObject(123), 123), {\n+ get: function () {\n+ delete __getRandomObject(123)[__getRandomProperty(__getRandomObject(123), 123)], __callGC();\n+ return 0;\n+ },\n+ set: function (value) {\n+ __getRandomObject(123)[__getRandomProperty(__getRandomObject(123), 123)], __callGC();\n+ }\n+});\n+Math.pow(1, 2);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_variables.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_variables.js\nnew file mode 100644\nindex 0000000000..93fed1b53f\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_variables.js\n@@ -0,0 +1,30 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+function __f_0(__v_10, __v_11) {\n+ let __v_4 = 4;\n+ let __v_5 = 5;\n+ let __v_6 = 6;\n+ let __v_7 = 7;\n+ console.log(__v_4);\n+ console.log(__v_5);\n+ console.log(__v_6);\n+ console.log(__v_7);\n+ for (let __v_9 = 0; __v_9 < 10; __v_9++) {\n+ console.log(__v_4);\n+ }\n+ let __v_8 = 0;\n+ while (__v_8 < 10) {\n+ __v_8++;\n+ }\n+}\n+let __v_0 = 1;\n+let __v_1 = 2;\n+let __v_2 = 3;\n+let __v_3 = 4;\n+console.log(__v_0);\n+console.log(__v_1);\n+console.log(__v_2);\n+console.log(__v_3);\n+__f_0();\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_variables_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_variables_expected.js\nnew file mode 100644\nindex 0000000000..920e740447\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutate_variables_expected.js\n@@ -0,0 +1,54 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: mutate_variables.js\n+function __f_0(__v_10, __v_11) {\n+ let __v_4 = 4;\n+ let __v_5 = 5;\n+ let __v_6 = 6;\n+ let __v_7 = 7;\n+ console.log(\n+ \/* VariableMutator: Replaced __v_4 with REPLACED *\/\n+ REPLACED);\n+ console.log(\n+ \/* VariableMutator: Replaced __v_5 with REPLACED *\/\n+ REPLACED);\n+ console.log(\n+ \/* VariableMutator: Replaced __v_6 with REPLACED *\/\n+ REPLACED);\n+ console.log(\n+ \/* VariableMutator: Replaced __v_7 with REPLACED *\/\n+ REPLACED);\n+\n+ for (let __v_9 = 0; __v_9 < 10; __v_9++) {\n+ console.log(\n+ \/* VariableMutator: Replaced __v_4 with REPLACED *\/\n+ REPLACED);\n+ }\n+\n+ let __v_8 = 0;\n+\n+ while (__v_8 < 10) {\n+ __v_8++;\n+ }\n+}\n+\n+let __v_0 = 1;\n+let __v_1 = 2;\n+let __v_2 = 3;\n+let __v_3 = 4;\n+console.log(\n+\/* VariableMutator: Replaced __v_0 with REPLACED *\/\n+REPLACED);\n+console.log(\n+\/* VariableMutator: Replaced __v_1 with REPLACED *\/\n+REPLACED);\n+console.log(\n+\/* VariableMutator: Replaced __v_2 with REPLACED *\/\n+REPLACED);\n+console.log(\n+\/* VariableMutator: Replaced __v_3 with REPLACED *\/\n+REPLACED);\n+\n+__f_0();\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutation_order\/input.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutation_order\/input.js\nnew file mode 100644\nindex 0000000000..b58810985b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutation_order\/input.js\n@@ -0,0 +1,23 @@\n+\/\/ Copyright 2022 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+var i = 1;\n+var j = 'str';\n+var k = undefined;\n+var l = {0: 1};\n+\n+function foo(a, b) {\n+ return a + b;\n+}\n+\n+foo(i, 3);\n+\n+function bar(a) {\n+ return foo(a, a);\n+}\n+\n+foo('foo', j);\n+bar(2, foo(i, j));\n+foo(i, j);\n+bar(j, 3);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutation_order\/output_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutation_order\/output_expected.js\nnew file mode 100644\nindex 0000000000..ddad108080\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/mutation_order\/output_expected.js\n@@ -0,0 +1,119 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Script mutator: using shuffled mutators\n+\/\/ Script mutator: extra ArrayMutator\n+\/\/ Script mutator: extra VariableMutator\n+\/\/ Script mutator: extra ExpressionMutator\n+\/\/ Script mutator: extra ArrayMutator\n+\n+\/\/ Original: mutation_order\/input.js\n+try {\n+ var __v_0 =\n+ \/* NumberMutator: Replaced 1 with -10 *\/\n+ -10;\n+} catch (e) {}\n+\n+try {\n+ var __v_1 = 'str';\n+} catch (e) {}\n+\n+try {\n+ var __v_2 = undefined;\n+} catch (e) {}\n+\n+try {\n+ var __v_3 = {\n+ \/* NumberMutator: Replaced 0 with 8 *\/\n+ 8:\n+ \/* NumberMutator: Replaced 1 with 3 *\/\n+ 3\n+ };\n+} catch (e) {}\n+\n+function __f_0(__v_4, __v_5) {\n+ return __v_4 + __v_5;\n+}\n+\n+try {\n+ %PrepareFunctionForOptimization(__f_0);\n+} catch (e) {}\n+\n+try {\n+ __f_0(__v_0,\n+ \/* NumberMutator: Replaced 3 with 5 *\/\n+ 5);\n+} catch (e) {}\n+\n+try {\n+ __f_0(__v_0,\n+ \/* NumberMutator: Replaced 3 with NaN *\/\n+ NaN);\n+} catch (e) {}\n+\n+try {\n+ %OptimizeFunctionOnNextCall(__f_0);\n+} catch (e) {}\n+\n+try {\n+ \/* FunctionCallMutator: Optimizing __f_0 *\/\n+ __f_0(__v_0,\n+ \/* NumberMutator: Replaced 3 with 2 *\/\n+ 2);\n+} catch (e) {}\n+\n+function __f_1(__v_6) {\n+ return (\n+ \/* FunctionCallMutator: Replaced __f_0 with __f_0 *\/\n+ __f_0(__v_6, __v_6)\n+ );\n+}\n+\n+try {\n+ %PrepareFunctionForOptimization(__f_0);\n+} catch (e) {}\n+\n+try {\n+ __f_0('foo', __v_1);\n+} catch (e) {}\n+\n+try {\n+ __f_0('foo', __v_1);\n+} catch (e) {}\n+\n+try {\n+ %OptimizeFunctionOnNextCall(__f_0);\n+} catch (e) {}\n+\n+try {\n+ \/* FunctionCallMutator: Optimizing __f_0 *\/\n+ __f_0('foo', __v_1);\n+} catch (e) {}\n+\n+try {\n+ \/* FunctionCallMutator: Compiling baseline __f_1 *\/\n+ %CompileBaseline(__f_1);\n+} catch (e) {}\n+\n+try {\n+ __f_1(\n+ \/* NumberMutator: Replaced 2 with -10 *\/\n+ -10, __f_0(__v_0, __v_1));\n+} catch (e) {}\n+\n+try {\n+ \/* FunctionCallMutator: Deoptimizing __f_0 *\/\n+ __f_0(__v_0, __v_1);\n+} catch (e) {}\n+\n+try {\n+ %DeoptimizeFunction(__f_0);\n+} catch (e) {}\n+\n+try {\n+ \/* FunctionCallMutator: Replaced __f_1 with __f_1 *\/\n+ __f_1(__v_1,\n+ \/* NumberMutator: Replaced 3 with 16 *\/\n+ 16);\n+} catch (e) {}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize.js\nnew file mode 100644\nindex 0000000000..ddf5b9f9fe\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize.js\n@@ -0,0 +1,23 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+'use strict';\n+\n+class Class {\n+ constructor() {\n+ this.abc = 789;\n+ this.selfRef = Class;\n+ }\n+}\n+\n+function foo() {\n+ let a = 123;\n+ console.log(a);\n+}\n+\n+foo();\n+let a = 456;\n+console.log(a);\n+let b = new Class();\n+console.log(b.abc);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize_expected_0.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize_expected_0.js\nnew file mode 100644\nindex 0000000000..5f832f7065\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize_expected_0.js\n@@ -0,0 +1,28 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+'use strict';\n+\n+\/\/ Original: normalize.js\n+class __c_0 {\n+ constructor() {\n+ this.abc = 789;\n+ this.selfRef = __c_0;\n+ }\n+\n+}\n+\n+function __f_0() {\n+ let __v_2 = 123;\n+ console.log(__v_2);\n+}\n+\n+__f_0();\n+\n+let __v_0 = 456;\n+console.log(__v_0);\n+\n+let __v_1 = new __c_0();\n+\n+console.log(__v_1.abc);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize_expected_1.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize_expected_1.js\nnew file mode 100644\nindex 0000000000..672f29e5f5\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/normalize_expected_1.js\n@@ -0,0 +1,28 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+'use strict';\n+\n+\/\/ Original: normalize.js\n+class __c_1 {\n+ constructor() {\n+ this.abc = 789;\n+ this.selfRef = __c_1;\n+ }\n+\n+}\n+\n+function __f_1() {\n+ let __v_5 = 123;\n+ console.log(__v_5);\n+}\n+\n+__f_1();\n+\n+let __v_3 = 456;\n+console.log(__v_3);\n+\n+let __v_4 = new __c_1();\n+\n+console.log(__v_4.abc);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/db\/index.json b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/db\/index.json\nnew file mode 100644\nindex 0000000000..0967ef424b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/db\/index.json\n@@ -0,0 +1 @@\n+{}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/input_indices.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/input_indices.js\nnew file mode 100644\nindex 0000000000..685453f5b7\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/input_indices.js\n@@ -0,0 +1,11 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+let a = {\n+ 0: \"\",\n+ 1: \"\",\n+ 2: \"\",\n+ 3: \"\",\n+ 4: \"\",\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/input_negative.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/input_negative.js\nnew file mode 100644\nindex 0000000000..d6747bb006\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/numbers\/input_negative.js\n@@ -0,0 +1,8 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+foo(-1);\n+foo(-1);\n+foo(-1);\n+foo(-1);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/db\/index.json b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/db\/index.json\nnew file mode 100644\nindex 0000000000..0967ef424b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/db\/index.json\n@@ -0,0 +1 @@\n+{}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/input.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/input.js\nnew file mode 100644\nindex 0000000000..fc34ae5cbd\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/input.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+print(\"Won't see this.\");\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/shell.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/shell.js\nnew file mode 100644\nindex 0000000000..4967ffbdfa\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/spidermonkey\/shell.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+loadRelativeToScript('PatternAsserts.js');\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/db\/index.json b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/db\/index.json\nnew file mode 100644\nindex 0000000000..0967ef424b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/db\/index.json\n@@ -0,0 +1 @@\n+{}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_delete.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_delete.js\nnew file mode 100644\nindex 0000000000..154bb60828\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_delete.js\n@@ -0,0 +1,6 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+var x;\n+delete x;\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_strict.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_strict.js\nnew file mode 100644\nindex 0000000000..779fa08fbf\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_strict.js\n@@ -0,0 +1,7 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\"use strict\";\n+\n+print(\"Hello\");\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_with.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_with.js\nnew file mode 100644\nindex 0000000000..abb0215953\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/regress\/strict\/input_with.js\n@@ -0,0 +1,7 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+with (Math) {\n+ print(PI);\n+}\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/simple_test.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/simple_test.js\nnew file mode 100644\nindex 0000000000..bb53b404f6\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/simple_test.js\n@@ -0,0 +1,87 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Test comment.\n+\/\/ Flags: --gc-interval = 1\n+var abs = Math.abs;\n+var v1 = 5, v2; var v3;\n+if (v1) {\n+ var v4 = 3;\n+ for (var v5 = 0; v5 < 4; v5++) {\n+ console.log('Value of v5: ' +\n+ v5);\n+ }\n+}\n+let v6 = 3;\n+const v7 = 5 + \\u{0076}6;\n+v1 = {['p' + v6]: ''};\n+v1 = `test\\`\n+value is ${ v6 + v7 }` + '\\0\\400\\377'\n+v1 = (v8=2, {v9 = eval('v8')},) => { return v8 + v9 + 4; };\n+v1 = () => 4 + 5;\n+v1 = v10 => { return v10 + 4; }\n+v1 = async v11 => v11 + 4;\n+v12 = [0, 1, 2,];\n+v13 = [3, 4, 5];\n+v14 = [...v12, ...v13];\n+v15 = ([v16, v17] = [1, 2], {v31: v18} = {v31: v16 + v17}) => v16 + v17 + v18;\n+v16 = 170%16\/16 + 2**32;\n+v17 = 0o1 + 0O1 + 01 + 0b011 + 0B011;\n+for (var v18 of [1, 2, 3]) console.log(v18);\n+function f1(v19,) {}\n+f1();\n+%OptimizeFunctionOnNextCall(f1);\n+function f2() {\n+ var v20 = 5;\n+ return v20 + 6;\n+}\n+(async function f3() {\n+ var v21 = await 1;\n+ console.log(v21);\n+})();\n+function* f4(v22=2, ...v23) {\n+ yield* [1, 2, 3];\n+}\n+function* f5() { (yield 3) + (yield); }\n+{ function f6() { } }\n+v23 = { v6, [v6]: 3, f7() { }, get f8 () { }, *f9 () { }, async f10 () { } }\n+var [v24, v25, ...v26] = [10, 20], {v27, v28} = {v27: 10, v28: 20};\n+class c1 {\n+ f11(v29) {\n+ return v29 + 1;\n+ }\n+ static* f12() {\n+ yield 'a' + super.f12();\n+ }\n+ constructor(v30) {\n+ console.log(new.target.name);\n+ }\n+ [0]() { }\n+}\n+class c2 extends c1 { }\n+do ; while(0);\n+v16 **= 4;\n+for (const v32 = 1; v32 < 1;);\n+for (let v33 = 1; v33 < 5; v33++);\n+for (var v34 = 1; v34 < 5; v34++);\n+for (const {v35 = 0, v36 = 3} = {}; v36 < 1;);\n+for (let {v37 = 0, v38 = 3} = {}; v38 != 0; v38--);\n+for (var {v39 = 0, v40 = 3} = {}; v40 != 0; v40--);\n+for (const v41 of [1, 2, 3]);\n+for (let v42 of [1, 2, 3]);\n+for (var v43 of [1, 2, 3]);\n+for (const v44 in [1, 2, 3]);\n+for (let v45 in [1, 2, 3]);\n+for (var v46 in [1, 2, 3]);\n+label: function f13() { }\n+\n+var a = function b() {\n+ b();\n+};\n+\n+var c = class C {\n+ constructor() {\n+ console.log(C.name);\n+ }\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/simple_test_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/simple_test_expected.js\nnew file mode 100644\nindex 0000000000..0405fac09b\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/simple_test_expected.js\n@@ -0,0 +1,177 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: simple_test.js\n+var __v_0 = Math.abs;\n+\n+var __v_1 = 5,\n+ __v_2;\n+\n+var __v_3;\n+\n+if (__v_1) {\n+ var __v_4 = 3;\n+\n+ for (var __v_5 = 0; __v_5 < 4; __v_5++) {\n+ console.log('Value of v5: ' + __v_5);\n+ }\n+}\n+\n+let __v_6 = 3;\n+\n+const __v_7 = 5 + __v_6;\n+\n+__v_1 = {\n+ ['p' + __v_6]: ''\n+};\n+__v_1 = `test\\`\n+value is ${__v_6 + __v_7}` + '\\0\\400\\377';\n+\n+__v_1 = (__v_21 = 2, {\n+ v9: __v_22 = eval('v8')\n+}) => {\n+ return __v_21 + __v_22 + 4;\n+};\n+\n+__v_1 = () => 4 + 5;\n+\n+__v_1 = __v_23 => {\n+ return __v_23 + 4;\n+};\n+\n+__v_1 = async __v_24 => __v_24 + 4;\n+\n+__v_25 = [0, 1, 2];\n+__v_26 = [3, 4, 5];\n+__v_27 = [...__v_25, ...__v_26];\n+\n+__v_28 = ([__v_29, __v_30] = [1, 2], {\n+ v31: __v_31\n+} = {\n+ v31: __v_29 + __v_30\n+}) => __v_29 + __v_30 + __v_31;\n+\n+__v_42 = 170 % 16 \/ 16 + 2 ** 32;\n+__v_33 = 0o1 + 0O1 + 01 + 0b011 + 0B011;\n+\n+for (var __v_8 of [1, 2, 3]) console.log(__v_8);\n+\n+function __f_0(__v_34) {}\n+\n+__f_0();\n+\n+%OptimizeFunctionOnNextCall(__f_0);\n+\n+function __f_1() {\n+ var __v_35 = 5;\n+ return __v_35 + 6;\n+}\n+\n+(async function __f_5() {\n+ var __v_36 = await 1;\n+\n+ console.log(__v_36);\n+})();\n+\n+function* __f_2(__v_37 = 2, ...__v_38) {\n+ yield* [1, 2, 3];\n+}\n+\n+function* __f_3() {\n+ (yield 3) + (yield);\n+}\n+\n+{\n+ function __f_6() {}\n+}\n+__v_39 = {\n+ v6: __v_6,\n+ [__v_6]: 3,\n+\n+ f7() {},\n+\n+ get f8() {},\n+\n+ *f9() {},\n+\n+ async f10() {}\n+\n+};\n+var [__v_9, __v_10, ...__v_11] = [10, 20],\n+ {\n+ v27: __v_12,\n+ v28: __v_13\n+} = {\n+ v27: 10,\n+ v28: 20\n+};\n+\n+class __c_0 {\n+ f11(__v_40) {\n+ return __v_40 + 1;\n+ }\n+\n+ static *f12() {\n+ yield 'a' + super.f12();\n+ }\n+\n+ constructor(__v_41) {\n+ console.log(new.target.name);\n+ }\n+\n+ [0]() {}\n+\n+}\n+\n+class __c_1 extends __c_0 {}\n+\n+do ; while (0);\n+\n+__v_42 **= 4;\n+\n+for (const __v_43 = 1; __v_43 < 1;);\n+\n+for (let __v_44 = 1; __v_44 < 5; __v_44++);\n+\n+for (var __v_14 = 1; __v_14 < 5; __v_14++);\n+\n+for (const {\n+ v35: __v_45 = 0,\n+ v36: __v_46 = 3\n+} = {}; __v_46 < 1;);\n+\n+for (let {\n+ v37: __v_47 = 0,\n+ v38: __v_48 = 3\n+} = {}; __v_48 != 0; __v_48--);\n+\n+for (var {\n+ v39: __v_15 = 0,\n+ v40: __v_16 = 3\n+} = {}; __v_16 != 0; __v_16--);\n+\n+for (const __v_49 of [1, 2, 3]);\n+\n+for (let __v_50 of [1, 2, 3]);\n+\n+for (var __v_17 of [1, 2, 3]);\n+\n+for (const __v_51 in [1, 2, 3]);\n+\n+for (let __v_52 in [1, 2, 3]);\n+\n+for (var __v_18 in [1, 2, 3]);\n+\n+label: function __f_4() {}\n+\n+var __v_19 = function __f_7() {\n+ __f_7();\n+};\n+\n+var __v_20 = class __c_2 {\n+ constructor() {\n+ console.log(__c_2.name);\n+ }\n+\n+};\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/load1.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/load1.js\nnew file mode 100644\nindex 0000000000..5e3f902ab1\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/load1.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+console.log('load1.js');\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/shell.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/shell.js\nnew file mode 100644\nindex 0000000000..7f138a53f3\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/shell.js\n@@ -0,0 +1,7 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+console.log('\/shell.js');\n+if (!ok)\n+ throw new Error(`assertion failed: ${f} did not throw as expected`);\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load.js\nnew file mode 100644\nindex 0000000000..6ae5f80dea\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load.js\n@@ -0,0 +1,15 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+load('load1.js');\n+loadRelativeToScript('load2.js');\n+console.log('load.js');\n+\n+if (!ok)\n+ throw new Error(`Assertion failed: Some text`);\n+\n+print(\"Assertion failed: Some text\");\n+\n+\/\/ Check that we can load template literals with null cooked value.\n+check()`\\01`;\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load2.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load2.js\nnew file mode 100644\nindex 0000000000..a8ee5d296e\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load2.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+console.log('load2.js');\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load_expected.js\nnew file mode 100644\nindex 0000000000..f45e4aa0d4\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/load_expected.js\n@@ -0,0 +1,22 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: spidermonkey\/shell.js\n+console.log('\/shell.js');\n+if (!ok) throw new Error(`*****tion failed: ${f} did not throw as expected`);\n+\n+\/\/ Original: spidermonkey\/test\/shell.js\n+console.log('\/test\/shell.js');\n+\n+\/\/ Original: spidermonkey\/load1.js\n+console.log('load1.js');\n+\n+\/\/ Original: spidermonkey\/test\/load2.js\n+console.log('load2.js');\n+\n+\/\/ Original: spidermonkey\/test\/load.js\n+console.log('load.js');\n+if (!ok) throw new Error(`*****tion failed: Some text`);\n+print(\"*****tion failed: Some text\");\n+check()`\\01`;\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/shell.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/shell.js\nnew file mode 100644\nindex 0000000000..9c0b357679\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/spidermonkey\/test\/shell.js\n@@ -0,0 +1,5 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+console.log('\/test\/shell.js');\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch.js\nnew file mode 100644\nindex 0000000000..9414a3b968\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch.js\n@@ -0,0 +1,41 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+function blah() {\n+ try {\n+ var a = 10;\n+ console.log(a);\n+ } catch (e) {}\n+\n+ label: for (var i = 0; i < 100; i++) {\n+ var b = 0;\n+ while (b < 10) {\n+ console.log(b);\n+ b += 2;\n+ continue label;\n+ }\n+ }\n+}\n+\n+blah();\n+blah();\n+\n+(function () {1;1;})();\n+\n+if (true) {\n+ 2;2;\n+} else {\n+ 3;3;\n+}\n+\n+let a = 0;\n+switch (a) {\n+ case 1: 1;\n+}\n+\n+with (Math) {\n+ cos(PI);\n+}\n+\n+let module = new WebAssembly.Module(builder.toBuffer());\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_alternate_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_alternate_expected.js\nnew file mode 100644\nindex 0000000000..31fe2837b7\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_alternate_expected.js\n@@ -0,0 +1,51 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/* AddTryCatchMutator: Target skip probability 0.9 and toplevel probability 0.9 *\/\n+\n+\/\/ Original: try_catch.js\n+function blah() {\n+ try {\n+ var a = 10;\n+ console.log(a);\n+ } catch (e) {}\n+\n+ label: for (var i = 0; i < 100; i++) {\n+ var b = 0;\n+\n+ while (b < 10) {\n+ console.log(b);\n+ b += 2;\n+ continue label;\n+ }\n+ }\n+}\n+\n+blah();\n+blah();\n+\n+(function () {\n+ 1;\n+ 1;\n+})();\n+\n+if (true) {\n+ 2;\n+ 2;\n+} else {\n+ 3;\n+ 3;\n+}\n+\n+let a = 0;\n+\n+switch (a) {\n+ case 1:\n+ 1;\n+}\n+\n+with (Math) {\n+ cos(PI);\n+}\n+let module = new WebAssembly.Module(builder.toBuffer());\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_expected.js\nnew file mode 100644\nindex 0000000000..266662b259\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_expected.js\n@@ -0,0 +1,104 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: try_catch.js\n+function blah() {\n+ try {\n+ try {\n+ var a = 10;\n+ } catch (e) {}\n+\n+ try {\n+ console.log(a);\n+ } catch (e) {}\n+ } catch (e) {}\n+\n+ try {\n+ label: for (var i = 0; i < 100; i++) {\n+ try {\n+ var b = 0;\n+ } catch (e) {}\n+\n+ try {\n+ while (b < 10) {\n+ try {\n+ console.log(b);\n+ } catch (e) {}\n+\n+ try {\n+ b += 2;\n+ } catch (e) {}\n+\n+ continue label;\n+ }\n+ } catch (e) {}\n+ }\n+ } catch (e) {}\n+}\n+\n+try {\n+ blah();\n+} catch (e) {}\n+\n+try {\n+ blah();\n+} catch (e) {}\n+\n+try {\n+ (function () {\n+ try {\n+ 1;\n+ } catch (e) {}\n+\n+ try {\n+ 1;\n+ } catch (e) {}\n+ })();\n+} catch (e) {}\n+\n+try {\n+ if (true) {\n+ try {\n+ 2;\n+ } catch (e) {}\n+\n+ try {\n+ 2;\n+ } catch (e) {}\n+ } else {\n+ try {\n+ 3;\n+ } catch (e) {}\n+\n+ try {\n+ 3;\n+ } catch (e) {}\n+ }\n+} catch (e) {}\n+\n+let a = 0;\n+\n+try {\n+ switch (a) {\n+ case 1:\n+ try {\n+ 1;\n+ } catch (e) {}\n+\n+ }\n+} catch (e) {}\n+\n+try {\n+ with (Math) {\n+ try {\n+ cos(PI);\n+ } catch (e) {}\n+ }\n+} catch (e) {}\n+\n+let module = function () {\n+ try {\n+ return new WebAssembly.Module(builder.toBuffer());\n+ } catch (e) {}\n+}();\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_nothing_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_nothing_expected.js\nnew file mode 100644\nindex 0000000000..b7b86f1b59\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_nothing_expected.js\n@@ -0,0 +1,49 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: try_catch.js\n+function blah() {\n+ try {\n+ var a = 10;\n+ console.log(a);\n+ } catch (e) {}\n+\n+ label: for (var i = 0; i < 100; i++) {\n+ var b = 0;\n+\n+ while (b < 10) {\n+ console.log(b);\n+ b += 2;\n+ continue label;\n+ }\n+ }\n+}\n+\n+blah();\n+blah();\n+\n+(function () {\n+ 1;\n+ 1;\n+})();\n+\n+if (true) {\n+ 2;\n+ 2;\n+} else {\n+ 3;\n+ 3;\n+}\n+\n+let a = 0;\n+\n+switch (a) {\n+ case 1:\n+ 1;\n+}\n+\n+with (Math) {\n+ cos(PI);\n+}\n+let module = new WebAssembly.Module(builder.toBuffer());\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_toplevel_expected.js b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_toplevel_expected.js\nnew file mode 100644\nindex 0000000000..39ee907a48\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_data\/try_catch_toplevel_expected.js\n@@ -0,0 +1,74 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/\/ Original: try_catch.js\n+function blah() {\n+ try {\n+ try {\n+ var a = 10;\n+ } catch (e) {}\n+\n+ try {\n+ console.log(a);\n+ } catch (e) {}\n+ } catch (e) {}\n+\n+ try {\n+ label: for (var i = 0; i < 100; i++) {\n+ var b = 0;\n+\n+ while (b < 10) {\n+ console.log(b);\n+ b += 2;\n+ continue label;\n+ }\n+ }\n+ } catch (e) {}\n+}\n+\n+try {\n+ blah();\n+} catch (e) {}\n+\n+try {\n+ blah();\n+} catch (e) {}\n+\n+try {\n+ (function () {\n+ 1;\n+ 1;\n+ })();\n+} catch (e) {}\n+\n+try {\n+ if (true) {\n+ 2;\n+ 2;\n+ } else {\n+ 3;\n+ 3;\n+ }\n+} catch (e) {}\n+\n+let a = 0;\n+\n+try {\n+ switch (a) {\n+ case 1:\n+ 1;\n+ }\n+} catch (e) {}\n+\n+try {\n+ with (Math) {\n+ cos(PI);\n+ }\n+} catch (e) {}\n+\n+let module = function () {\n+ try {\n+ return new WebAssembly.Module(builder.toBuffer());\n+ } catch (e) {}\n+}();\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/test_db.js b\/compiler\/forget\/packages\/js-fuzzer\/test_db.js\nnew file mode 100644\nindex 0000000000..35f7956b76\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/test_db.js\n@@ -0,0 +1,66 @@\n+\/\/ Copyright 2020 the V8 project authors. All rights reserved.\n+\/\/ Use of this source code is governed by a BSD-style license that can be\n+\/\/ found in the LICENSE file.\n+\n+\/**\n+ * @fileoverview Test all expressions in DB.\n+ *\/\n+\n+const fs = require('fs');\n+const fsPath = require('path');\n+const program = require('commander');\n+const sinon = require('sinon');\n+\n+const crossOverMutator = require('.\/mutators\/crossover_mutator.js');\n+const db = require('.\/db.js');\n+const random = require('.\/random.js');\n+const sourceHelpers = require('.\/source_helpers.js');\n+\n+const sandbox = sinon.createSandbox();\n+\n+function main() {\n+ program\n+ .version('0.0.1')\n+ .option('-i, --input_dir ', 'DB directory.')\n+ .parse(process.argv);\n+\n+ if (!program.input_dir) {\n+ console.log('Need to specify DB dir.');\n+ return;\n+ }\n+\n+ const mutateDb = new db.MutateDb(program.input_dir);\n+ const mutator = new crossOverMutator.CrossOverMutator(\n+ { MUTATE_CROSSOVER_INSERT: 1.0, testing: true }, mutateDb);\n+\n+ let nPass = 0;\n+ let nFail = 0;\n+ \/\/ Iterate over all statements saved in the DB.\n+ for (const statementPath of mutateDb.index.all) {\n+ const expression = JSON.parse(fs.readFileSync(\n+ fsPath.join(program.input_dir, statementPath)), 'utf-8');\n+ \/\/ Stub out choosing random variables in cross-over mutator.\n+ sandbox.stub(random, 'single').callsFake((a) => { return a[0]; });\n+ \/\/ Ensure we are selecting the statement of the current iteration.\n+ sandbox.stub(mutateDb, 'getRandomStatement').callsFake(\n+ () => { return expression; });\n+ \/\/ Use a source that will try to insert one statement, allowing\n+ \/\/ super.\n+ const source = sourceHelpers.loadSource(\n+ __dirname,\n+ 'test_data\/cross_over_mutator_class_input.js');\n+ try {\n+ mutator.mutate(source);\n+ nPass++;\n+ } catch (e) {\n+ console.log('******************************************************')\n+ console.log(expression);\n+ console.log(e.message);\n+ nFail++;\n+ }\n+ sandbox.restore();\n+ }\n+ console.log(`Result: ${nPass} passed, ${nFail} failed.`)\n+}\n+\n+main();\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/tools\/fuzz_one.py b\/compiler\/forget\/packages\/js-fuzzer\/tools\/fuzz_one.py\nnew file mode 100644\nindex 0000000000..c3df79ec27\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/tools\/fuzz_one.py\n@@ -0,0 +1,43 @@\n+#!\/usr\/bin\/env python3\n+# Copyright 2020 the V8 project authors. All rights reserved.\n+# Use of this source code is governed by a BSD-style license that can be\n+# found in the LICENSE file.\n+\n+\n+\"\"\"\n+Helper script to execute a single-processed fuzzing session.\n+\n+Creates fuzz tests in workdir\/output\/dir-\/fuzz-XXX.js.\n+Expects the as single parameter.\n+\"\"\"\n+\n+import os\n+import subprocess\n+import sys\n+import time\n+\n+BASE_PATH = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\n+APP_DIR = os.path.join(BASE_PATH, 'workdir', 'app_dir')\n+FUZZ_EXE = os.path.join(BASE_PATH, 'workdir', 'fuzzer', 'ochang_js_fuzzer')\n+INPUT_DIR = os.path.join(BASE_PATH, 'workdir', 'input')\n+TEST_CASES = os.path.join(BASE_PATH, 'workdir', 'output')\n+\n+COUNT = 64\n+FUZZ = ('FUZZ_MODE=foozzie APP_NAME=d8 APP_DIR=%s %s -o %%s -n %s -i %s > %%s'\n+ % (APP_DIR, FUZZ_EXE, COUNT, INPUT_DIR))\n+\n+assert(len(sys.argv) > 1)\n+dir_number = int(sys.argv[1])\n+assert(dir_number >= 0)\n+\n+path = os.path.join(TEST_CASES, 'dir-%d' % dir_number)\n+assert not os.path.exists(path), 'Need fresh workdir for fuzzing'\n+os.makedirs(path)\n+\n+start = time.time()\n+subprocess.check_call(\n+ FUZZ % (path, os.path.join(path, 'out.log')), shell=True)\n+duration = int(time.time() - start)\n+\n+with open(os.path.join(path, 'duration.log'), 'w') as f:\n+ f.write(str(duration))\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/tools\/minimize.py b\/compiler\/forget\/packages\/js-fuzzer\/tools\/minimize.py\nnew file mode 100644\nindex 0000000000..de4e136860\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/tools\/minimize.py\n@@ -0,0 +1,44 @@\n+#!\/usr\/bin\/env python3\n+# Copyright 2020 the V8 project authors. All rights reserved.\n+# Use of this source code is governed by a BSD-style license that can be\n+# found in the LICENSE file.\n+\n+\n+\"\"\"\n+Helper script to forge a command line for clusterfuzz' minimizer for\n+each failure found during a fuzzing session with workbench.py.\n+\n+Expects the path to the minimizer tools, e.g. something like:\n+path\/to\/src\/python\/bot\/minimizer\n+\"\"\"\n+\n+import json\n+from multiprocessing import cpu_count\n+import os\n+import sys\n+\n+PROCESSES = cpu_count()\n+BASE_PATH = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\n+OUT_PATH = os.path.join(BASE_PATH, 'out.js')\n+FAILURES_JSON_PATH = os.path.join(\n+ BASE_PATH, 'workdir', 'output', 'failures.json')\n+\n+assert len(sys.argv) > 1, 'Need to specify minimizer path.'\n+minimizer_path = sys.argv[1]\n+\n+def getcmd(command):\n+ parts = command.split(' ')\n+ prefix = command[:-(len(parts[-1]) + 1)]\n+ return ('python %s\/run.py -t%d -mjs -o %s \"%s\" %s' %\n+ (minimizer_path, PROCESSES, OUT_PATH, prefix, parts[-1]))\n+\n+with open(FAILURES_JSON_PATH) as f:\n+ failures = json.load(f)\n+\n+for failure in failures:\n+ print('*********************************************************')\n+ print('Source: ' + failure['source'])\n+ print('Command:')\n+ print(failure['command'])\n+ print('Minimize:')\n+ print(getcmd(failure['command']))\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/tools\/run_one.py b\/compiler\/forget\/packages\/js-fuzzer\/tools\/run_one.py\nnew file mode 100644\nindex 0000000000..8e7fc76a12\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/tools\/run_one.py\n@@ -0,0 +1,106 @@\n+#!\/usr\/bin\/env python3\n+# Copyright 2020 the V8 project authors. All rights reserved.\n+# Use of this source code is governed by a BSD-style license that can be\n+# found in the LICENSE file.\n+\n+\n+\"\"\"\n+Helper script to execute fuzz tests in a single process.\n+\n+Expects fuzz tests in workdir\/output\/dir-\/fuzz-XXX.js.\n+Expects the as single parameter.\n+\"\"\"\n+\n+import json\n+import os\n+import random\n+import re\n+import subprocess\n+import sys\n+\n+BASE_PATH = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\n+FOOZZIE = os.path.join(BASE_PATH, 'workdir', 'app_dir', 'v8_foozzie.py')\n+TEST_CASES = os.path.join(BASE_PATH, 'workdir', 'output')\n+\n+assert os.path.exists(FOOZZIE)\n+\n+# Output pattern from foozzie.py when it finds a failure.\n+FAILURE_RE = re.compile(\n+ r'# V8 correctness failure.'\n+ r'# V8 correctness configs: (?P.*).'\n+ r'# V8 correctness sources: (?P.*).'\n+ r'# V8 correctness suppression:.*', re.S)\n+\n+assert(len(sys.argv) > 1)\n+dir_number = int(sys.argv[1])\n+assert(dir_number >= 0)\n+\n+test_dir = os.path.join(TEST_CASES, 'dir-%d' % dir_number)\n+assert os.path.exists(test_dir)\n+\n+def failure_state(command, stdout):\n+ return dict(FAILURE_RE.search(stdout).groupdict(), command=command)\n+\n+def random_seed():\n+ \"\"\"Returns random, non-zero seed.\"\"\"\n+ seed = 0\n+ while not seed:\n+ seed = random.SystemRandom().randint(-2147483648, 2147483647)\n+ return seed\n+\n+def run(fuzz_file, flag_file):\n+ \"\"\"Executes the differential-fuzzing harness foozzie with one fuzz test.\"\"\"\n+ with open(flag_file) as f:\n+ flags = f.read().split(' ')\n+ args = [FOOZZIE, '--random-seed=%d' % random_seed()] + flags + [fuzz_file]\n+ cmd = ' '.join(args)\n+ try:\n+ output = subprocess.check_output(cmd, stderr=subprocess.PIPE, shell=True)\n+ return (cmd, output.decode('utf-8'))\n+ except Exception as e:\n+ return (cmd, e.output.decode('utf-8'))\n+\n+\n+def list_tests():\n+ \"\"\"Iterates all fuzz tests and corresponding flags in the given base dir.\"\"\"\n+ for f in os.listdir(test_dir):\n+ if f.startswith('fuzz'):\n+ n = int(re.match(r'fuzz-(\\d+)\\.js', f).group(1))\n+ ff = 'flags-%d.js' % n\n+ yield (os.path.join(test_dir, f), os.path.join(test_dir, ff))\n+\n+# Some counters for the statistics.\n+count = 0\n+count_timeout = 0\n+count_crash = 0\n+count_failure = 0\n+failures = []\n+\n+# Execute all tests in the given directory. Interpret foozzie's output and add\n+# it to the statistics.\n+for fuzz_file, flag_file in list_tests():\n+ cmd, output = run(fuzz_file, flag_file)\n+ count += 1\n+ if '# V8 correctness - pass' in output:\n+ continue\n+ if '# V8 correctness - T-I-M-E-O-U-T' in output:\n+ count_timeout += 1\n+ continue\n+ if '# V8 correctness - C-R-A-S-H' in output:\n+ count_crash += 1\n+ continue\n+ count_failure += 1\n+ failures.append(failure_state(cmd, output))\n+\n+with open(os.path.join(test_dir, 'failures.json'), 'w') as f:\n+ json.dump(failures, f)\n+\n+stats = {\n+ 'total': count,\n+ 'timeout': count_timeout,\n+ 'crash': count_crash,\n+ 'failure': count_failure,\n+}\n+\n+with open(os.path.join(test_dir, 'stats.json'), 'w') as f:\n+ json.dump(stats, f)\ndiff --git a\/compiler\/forget\/packages\/js-fuzzer\/tools\/workbench.py b\/compiler\/forget\/packages\/js-fuzzer\/tools\/workbench.py\nnew file mode 100644\nindex 0000000000..5a4fc0a19c\n--- \/dev\/null\n+++ b\/compiler\/forget\/packages\/js-fuzzer\/tools\/workbench.py\n@@ -0,0 +1,127 @@\n+#!\/usr\/bin\/env python3\n+# Copyright 2020 the V8 project authors. All rights reserved.\n+# Use of this source code is governed by a BSD-style license that can be\n+# found in the LICENSE file.\n+\n+\n+\"\"\"\n+Tool to execute multiprocessed fuzzing and testing sessions.\n+\n+Expects a single parameter with the number of sessions.\n+\n+Regularly updates a stats.json and failures.json during executions. E.g.\n+stay up-to-date with:\n+cat workdir\/output\/stats.json | python -m json.tool\n+\"\"\"\n+\n+# TODO(machenbach): This is currently tailored for differential fuzzing\n+# with foozzie. It could be generalized, but that'd require duplicating\n+# clusterfuzz' stack analysis to some degree. E.g. understanding asan\n+# or DCHECK failures.\n+\n+from __future__ import print_function\n+\n+import json\n+import math\n+from multiprocessing import Pool, cpu_count\n+import os\n+import random\n+import subprocess\n+import sys\n+\n+PROCESSES = cpu_count()\n+BASE_PATH = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\n+TEST_CASES = os.path.join(BASE_PATH, 'workdir', 'output')\n+FUZZ_ONE = os.path.join(BASE_PATH, 'tools', 'fuzz_one.py')\n+RUN_ONE = os.path.join(BASE_PATH, 'tools', 'run_one.py')\n+\n+os.chdir(BASE_PATH)\n+\n+if os.path.exists(TEST_CASES):\n+ if not os.path.isdir(TEST_CASES) or os.listdir(TEST_CASES):\n+ sys.exit(\"'output' must be an empty directory\")\n+else:\n+ os.mkdir(TEST_CASES)\n+\n+# Use ~40000 for 24 hours of fuzzing on a modern work station.\n+RUNS = 8\n+if len(sys.argv) > 1:\n+ RUNS = int(sys.argv[1])\n+\n+def run(n):\n+ \"\"\"Multiprocessed function that executes a single fuzz session and\n+ afterwards executes all fuzz tests and collects the statistics.\n+\n+ Args:\n+ n: Subdirectory index of this run.\n+ \"\"\"\n+ subprocess.check_call([sys.executable, FUZZ_ONE, str(n)])\n+ subprocess.check_call([sys.executable, RUN_ONE, str(n)])\n+ test_dir = os.path.join(TEST_CASES, 'dir-%d' % n)\n+ with open(os.path.join(test_dir, 'stats.json')) as f:\n+ stats = json.load(f)\n+ with open(os.path.join(test_dir, 'failures.json')) as f:\n+ failures = json.load(f)\n+ return (stats, failures)\n+\n+\n+class Stats(object):\n+ def __init__(self):\n+ self.total = 0\n+ self.crash = 0\n+ self.timeout = 0\n+ self.failure = 0\n+ self.dupe = 0\n+ self.failures = []\n+ self.known_states = set()\n+\n+ def add(self, stats, failures):\n+ # Aggregate common stats.\n+ self.total += stats['total']\n+ self.crash += stats['crash']\n+ self.timeout += stats['timeout']\n+\n+ # Dedupe failures.\n+ for failure in failures:\n+ if failure['source'] in self.known_states:\n+ self.dupe += 1\n+ continue\n+\n+ self.known_states.add(failure['source'])\n+ self.failure += 1\n+ self.failures.append(failure)\n+\n+ @property\n+ def stats(self):\n+ return {\n+ 'total': self.total,\n+ 'crash': self.crash,\n+ 'failure': self.failure,\n+ 'dupe': self.dupe,\n+ 'timeout': self.timeout,\n+ }\n+\n+all_stats = Stats()\n+count = 0\n+pool = Pool(processes=PROCESSES)\n+\n+# Iterate over all runs multiprocessed and merge the statistics and\n+# failure data of the single runs.\n+for stats, failures in pool.imap_unordered(run, range(RUNS)):\n+ all_stats.add(stats, failures)\n+ count += 1\n+ if count % max(1, int(RUNS \/ 20)) == 0:\n+ print('Progress: %d runs (%d%%)' % (count, count * 100 \/ RUNS))\n+\n+ # Update overall stats.\n+ with open(os.path.join(TEST_CASES, 'stats.json'), 'w') as f:\n+ json.dump(all_stats.stats, f)\n+ with open(os.path.join(TEST_CASES, 'failures.json'), 'w') as f:\n+ json.dump(all_stats.failures, f)\n+\n+print('Ran %(total)d test cases (%(timeout)d timeouts, '\n+ '%(crash)d crashes, %(failure)d failures, %(dupe)d dupes)'\n+ % all_stats.stats)\n+\n+for failure in all_stats.failures:\n+ print(failure)\n","parents":["1bf00e6b6edb9763a49f753c99609f863ee62492"]}

dillon1000/react

Files changed