Proto commits in googleprojectzero/fuzzilli

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-07-23

[wasm] Add WasmLoadString instruction for imported JS string constants This CL adds a WasmLoadString instruction that returns a wasmRefJSString for the string constant it wraps. The string constant can also be mutated. Bug: 533397004 Change-Id: I83475e705939c0a22b91f61b1d8a7a8c929f83dc Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9548815 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

The documentation is generated from this commit.

[wasm] Add wasm:js-string concat, substring, equals, compare This CL adds a FuzzIL instruction for the "wasm:js-string" builtins: - "concat" - "substring" - "equals" - "compare" Bug: 533397004 Change-Id: Ide05c46fb7442723242ef43f1283cdeb58783504 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9548058 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

[wasm] Add wasm:js-string test This CL adds a FuzzIL instruction for the builtin "wasm:js-string" "test". Bug: 533397004 Change-Id: Id3506b0739a497489469947c249a548b13c541d3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9548057 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

[wasm] Add wasm:js-string cast This CL adds a FuzzIL instruction for the builtin "wasm:js-string" "cast". Bug: 533397004 Change-Id: I37c53be6061b26d7d91cefc4e889cc360a720c33 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9548056 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

[wasm] Add wasm:js-string intoCharCodeArray This CL adds a FuzzIL instruction for the builtin "wasm:js-string" "intoCharCodeArray". Bug: 533397004 Change-Id: I6c5c2400e031df2d6960bfe4991457c8257a1aeb Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9548055 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

[wasm] Add wasm:js-string codePointAt This CL adds a FuzzIL instruction for the builtin "wasm:js-string" "codePointAt". Bug: 533397004 Change-Id: Ib548694daf4a4edbecf5cbe12f96a27847a8f4b9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9547455 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[wasm] Add wasm:js-string charCodeAt This CL adds a FuzzIL instruction for the builtin "wasm:js-string" "charCodeAt". Bug: 533397004 Change-Id: I75d1b01b869f34949dd2047ea7a2657033b065dd Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9543957 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

[wasm] Add wasm:js-string fromCodePoint This CL adds a FuzzIL instruction for the builtin "wasm:js-string" "fromCodePoint". Bug: 533397004 Change-Id: I044148bb99871a4408b4fe80a8a2e9d83afcfd74 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9544075 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

[wasm] Add wasm:js-string fromCharCode This CL adds a FuzzIL instruction for the builtin "wasm:js-string" "fromCharCode". Bug: 533397004 Change-Id: I2280a7a7d1a2e35697288baf5fe4fd8d60379473 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9543956 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[wasm] Add wasm:js-string fromCharCodeArray This CL adds a FuzzIL instruction for the builtin "wasm:js-string" "fromCharCodeArray". Bug: 533397004 Change-Id: Icb759061d6a50e5df2a3f2655c332bd36e4a4cbc Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9543955 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[wasm] Add wasm:js-string length + alignment This CL adds the first instruction, wasmJSStringLength, for the builtin "wasm:js-string" "length". It also aligns the code for adding more builtins in follow-up CLs. Bug: 533397004 Change-Id: I1d22fa7cfa17a1c1d27b2db4345269c8c34c0a32 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9540616 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

[wasm] JS String Builtins: Add WasmJSString type This CL is the first in a sequence of commits that add support for the JS String Builtins proposal. Specifically, it adds the WasmJSString type as a wrapper around WasmExtern. Bug: 533397004 Change-Id: I8d417c231eafb2f8eb95a05bef6477bf0f6d11f9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9540615 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

2026-07-21

(Modified/Patched) Reland of "[compiler][js] Add Support for Private Properties" This reverts commit 8ed2644935ddc425837881792b56128778a5c6e2. Reason for revert: Reland with correction To statically prevent the bug from happening again (at compile time): - `GuardableOperation` is now a protocol requiring `isGuarded: Bool` and a `withGuardedState(_:) -> GuardableOperation` mapping function. - All 19 guardable subclasses now explicitly declare their own storage for `isGuarded` and provide a concrete implementation returning a toggled copy of themselves. - The fragile static `switch` evaluation has been deleted entirely in favor of polymorphic dispatch (`op.withGuardedState(true)`). Original change's description: > Revert "[compiler][js] Add Support for Private Properties" > > This reverts commit cbaa148e4efdbcd0dde37d175f97111a7dc112ec. > > Reason for revert: > Increased Fuzzilli crashiness: > Fuzzilli/JsOperations.swift:121: Fatal error: All guardable operations should be handled > > Original change's description: > > [compiler][js] Add Support for Private Properties > > > > We are adding support so the following JS: > > > > ``` > > class A { > > #p = 42; > > get #val() { return this.#p; } > > set #val(v) { this.#p = v; } > > > > #m() { return this.#val; } > > > > test() { > > this.#val = 100; > > return this.#m(); > > } > > } > > ``` > > > > can be compiled with `swift run FuzzILTool --compile` and lifted back to > > JS with `swift run FuzzILTool --lift[Corpus]ToJS`. This should allow > > over a thousand more test262 to be be loaded as seeds and to pass the > > `transpile_tests.py` chain. > > > > Bug: 534650967 > > Change-Id: I9bed5e50f6975027c3afe06cdef6dbe5405d4264 > > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9542977 > > Commit-Queue: Raphaël Hérouart <rherouart@google.com> > > Reviewed-by: Michael Achenbach <machenbach@google.com> > > Bug: 534650967 > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Change-Id: I92f07b9e8165c1a696b14052e98a6af9b5bd3e2b > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9573635 > Auto-Submit: Michael Achenbach <machenbach@google.com> > Commit-Queue: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> > Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Bug: 534650967 Change-Id: I7626b7478d7cd302ba730957bcc0a0dac142d7ec Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9573636 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

Revert "[compiler][js] Add Support for Private Properties" This reverts commit cbaa148e4efdbcd0dde37d175f97111a7dc112ec. Reason for revert: Increased Fuzzilli crashiness: Fuzzilli/JsOperations.swift:121: Fatal error: All guardable operations should be handled Original change's description: > [compiler][js] Add Support for Private Properties > > We are adding support so the following JS: > > ``` > class A { > #p = 42; > get #val() { return this.#p; } > set #val(v) { this.#p = v; } > > #m() { return this.#val; } > > test() { > this.#val = 100; > return this.#m(); > } > } > ``` > > can be compiled with `swift run FuzzILTool --compile` and lifted back to > JS with `swift run FuzzILTool --lift[Corpus]ToJS`. This should allow > over a thousand more test262 to be be loaded as seeds and to pass the > `transpile_tests.py` chain. > > Bug: 534650967 > Change-Id: I9bed5e50f6975027c3afe06cdef6dbe5405d4264 > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9542977 > Commit-Queue: Raphaël Hérouart <rherouart@google.com> > Reviewed-by: Michael Achenbach <machenbach@google.com> Bug: 534650967 No-Presubmit: true No-Tree-Checks: true No-Try: true Change-Id: I92f07b9e8165c1a696b14052e98a6af9b5bd3e2b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9573635 Auto-Submit: Michael Achenbach <machenbach@google.com> Commit-Queue: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com>

2026-07-20

[compiler][js] Add Support for Private Properties We are adding support so the following JS: ``` class A { #p = 42; get #val() { return this.#p; } set #val(v) { this.#p = v; } #m() { return this.#val; } test() { this.#val = 100; return this.#m(); } } ``` can be compiled with `swift run FuzzILTool --compile` and lifted back to JS with `swift run FuzzILTool --lift[Corpus]ToJS`. This should allow over a thousand more test262 to be be loaded as seeds and to pass the `transpile_tests.py` chain. Bug: 534650967 Change-Id: I9bed5e50f6975027c3afe06cdef6dbe5405d4264 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9542977 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com>

2026-07-10

[wasm] Support start functions This CL adds support for generating start functions in Wasm modules. The start function is chosen at random. To make tests pass deterministically, buildWasmModule() now has a `possiblyWithStartFunction` boolean parameter, which is `false` in tests. Bug: 521299807 Change-Id: I00979a94424aa48804bc066a83c8a5ad18a05ee7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9520875 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

2026-07-09

[Compiler] Add support for parameter destructuring This CL adds support for compiling JavaScript function parameter destructuring (objects and arrays) into FuzzIL, and lifting it back to JS. Computed Keys and Inner Default Values ain't supported. Bug: 515363087 Change-Id: I6157c3e634c91bcc6bedefeaf7b0861be1fe64b2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9464375 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

2026-06-30

[binaryen-integration] Add memories to WasmModuleMetadata Bug:498924945 TAG=agy Change-Id: I3a8d353800bf9349ea23e446e3562c49af98f3de Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9475800 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-06-26

[js] Support Compiling and Lifting All LValues as Destructuring Targets Bug: 515363087 Change-Id: Ib12bedcdabb2681a10afcce1bb26dae5a89c56f1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9453876 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[wasm] Add isFinal attribute to WasmTypeDescription etc. This CL adds `isFinal` to WasmTypeDescription and subclasses WasmArrayTypeDescription, WasmStructTypeDescription, WasmSignatureTypeDescription. In code generators, we only use non-final super types. All generated types are final with a probability of 25%. Bug: 517707090 Change-Id: I47df3b1b8f06f5b133f3a349f0c1c7aeebdc975f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9464195 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

2026-06-25

[stats] Aggregate contributor statistics across nodes and reduce log noise Optimize the reporting of poorly performing code generators and program templates by aggregating their stats across all fuzzer nodes and centralizing the output on the main thread. This makes log messages more actionable and easier to read and navigate in cloud logging. Key changes: - Moved the generator/template stats from individual worker threads to the root node. - Merged validSamples and interestingSamples into correctSamples. - Print compact, table-based logs. - Reduced log frequency to every 5th statistics update and on termination. TAG=agy Bug: 465497343 Change-Id: I146e8b08057ee1ed84cf64c8f308b6be7b63bbf3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9432454 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

[js, modules] Generate cyclic imports Cyclic imports require knowing which modules and exports we will generate *later*. Add the "pending module" concept to support this. We use .jsAnything as the type for the variables which will be exported later - it's hard to decide a better type upfront and those won't technically be true (since we might access a "var" variable before it has its final value). TAG=agy CONV=9d719888-54be-4548-b5e1-2eec15f7d6bc Bug: 342521422 Change-Id: I4f9621d5771244a12e18937688fed3327757658d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9408620 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>

2026-06-23

[js] Nested Destructuring: Refactoring and Duplicate Code Elimination Follow Up From https://crrev.com/i/9379120 Bug: 515363087 Change-Id: I8ea35cd8e941ab586b34365462582280dde80f8f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9419397 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

2026-06-22

[js] Nested Destructuring: Implement Re-Assignment In both loop headers and simple declarations, Destructuring was only supported with variable declarations (let/const/var keyword); it can now be utilized for re-assigning existing variables. Bug: 515363087 Change-Id: I081689487006a3f63aec5a07df924038d853bf51 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9425996 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@google.com>

Reland: [wasm] Add superType input to WasmDefineSignatureType This CL adds an optional superType input to the WasmDefineSignatureType JS operation. It also extends WasmSignatureTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I1004b24c3d3df8f0b41ba9bf7ad41df9155770c1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9425995 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Michael Achenbach <machenbach@google.com>

Reland: [wasm] Add superType input to WasmDefineStructType This CL adds an optional superType input to the WasmDefineStructType JS operation. It also extends WasmStructTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I9c0b3eb323e8251dffae80008df385eb945dc673 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9426034 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

Reland: [wasm] Add superType input to WasmDefineArrayType This CL adds an optional superType input to the WasmDefineArrayType JS operation. It also extends WasmArrayTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I70b82608d49514ce29666f3e4d8d2ced5d8dcae0 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9425994 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

2026-06-18

Revert changes to WasmDefineArrayType and WasmDefineStructType Revert "[wasm] Add superType input to WasmDefineArrayType" This reverts commit 3a03d76997cbcc7a33645b9a3bd3191290b0796e. Revert "[wasm] Add superType input to WasmDefineStructType" This reverts commit 5ce4c591ff4e52356e369a149c67ec3e0364973c. Also bump protobuf version. Bug: 524213342, 517707090 Change-Id: I0d10c4d9123292dd184281de0f0c02a12a199f13 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9425034 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

2026-06-16

Revert "[wasm] Add superType input to WasmDefineSignatureType" This reverts commit e1776516c3ceb3b17ec63df6395ffe0c8dd5efc5. Reason for revert: Check whether this caused a spike in use-before-def failures Failure Link: https://g-issues.chromium.org/issues/524213342 Original change's description: > [wasm] Add superType input to WasmDefineSignatureType > > This CL adds an optional superType input to the WasmDefineSignatureType > JS operation. It also extends WasmSignatureTypeDescription to take an > optional superType parameter that it passes on to the > WasmTypeDescription constructor. > > Bug: 517707090 > Change-Id: I0b6aa71450534d0a113d8bd4f3d57195d2d7245d > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9358622 > Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> > Reviewed-by: Matthias Liedtke <mliedtke@google.com> Bug: 517707090 Change-Id: I8d11e29e493b23cc55a245937d7b0927ad91026b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9413674 Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-06-15

[js] Implement deeply nested destructuring and reassignment patterns This patch replaces the flat `DestructObject` and `DestructArray` instructions with a recursive `DestructuringPattern` AST and FuzzIL implementation. Key capabilities introduced: - Deeply nested array and object patterns (e.g., `let { a: [ b, { c } ] } = obj`) - Default values for both flat bindings and nested patterns - Computed property keys in object destructuring - Proper elision and rest element support within nested contexts - Generalizes both variable declaration (`Destruct`) and reassignment (`DestructAndReassign`) Bug: 515363087 Change-Id: I79fff58c693a5fc8879c00e439f9ad56655c42e7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9379120 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

2026-06-12

[wasm] Add superType input to WasmDefineSignatureType This CL adds an optional superType input to the WasmDefineSignatureType JS operation. It also extends WasmSignatureTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I0b6aa71450534d0a113d8bd4f3d57195d2d7245d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9358622 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[wasm] Add superType input to WasmDefineStructType This CL adds an optional superType input to the WasmDefineStructType JS operation. It also extends WasmStructTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I4490df2cee14c2d2b7905bad520f47cf08beeff8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9362881 Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[wasm] Add superType input to WasmDefineArrayType This CL adds an optional superType input to the WasmDefineArrayType JS operation. It also extends WasmArrayTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I8c388cf5acc269935dbec19cc07dd62beb870b05 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9362880 Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-06-09

[js] Do not accept destructuring in forIn Loops and Disposable Declarations Bug: 515363087 Change-Id: Ia5de523536d0be873ea6dfa58260f80b8402536a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9371140 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

2026-06-08

[js, modules] Add support for dynamic imports Bug: 398218423 Change-Id: I0fe7cd10030e18c3014e4c8220830631d1b92cce Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9355960 Auto-Submit: Olivier Flückiger <olivf@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[js] Compile Destructuring Patterns JS --> FuzzIL Bug: 515363087 Change-Id: I3653827b5d1467c95c607306bb42cfa97d8cb0a9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9366042 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-06-03

[js] Using "using" in for_of loops. Bug: 515363087 Change-Id: I6fd7618baa5c357d2ab21fe0610f2d53ce4effd1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9345643 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

2026-06-02

[wasm] Support return_call_ref This CL adds support for the return_call_ref instruction. Bug: 474940922 Change-Id: I8b53203020238fc24c002cbe27f8f60c7fa7fee7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9317782 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-06-01

[wasm] Support call_ref This CL adds support for the call_ref instruction. Bug: 474940922 Change-Id: If708e70dc9fcdd2f53f218f85e93c3d807a5ab9a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9330021 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[wasm] Implement ref.as_non_null Bug: 474940922 Change-Id: I20f142ba41d3efa88872ae0dfa308170a8c0ff11 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956716 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>

[js] Compile ForOf Loop with destructuring to FuzzIL Bug: 515363087 Change-Id: I8b5f3189ad34b3a6e117e3cf066e6afe62c20aba Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9336920 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-05-28

[wasm] Re-add ILType to WasmTableGet The table type can be easily inferred by the input table, so the table.get doesn't need a type immediate. For fuzzilli however, the input table can also come from JS (created by CreateWasmTable). Later on, the fuzzer can replace that table input with an arbitrary other input. This means that we need to encode the element type in the table.get operation, so that the JSTyper always knows the correct result type. I removed this in commit 7e5724ccc4551bf54773cb14450dc6f65c01f6ae (among other things that are indeed unnecessary). Bug: 430171132 Change-Id: Icffc95fadb79979d7125a33d797868c5a6ad50e5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9337021 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>

[wasm] Support ref.func This CL adds support for the ref.func instruction. Bug: 474940922 Change-Id: I885b966598a9d72c161d2ef7bee910032576a53d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9296864 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-05-27

[js] Refactor Loops to mutualize common code. Bug: 515363087 Change-Id: I41e4b487ee08dbf7da22959c6c1d08e4099a6ad4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9317282 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Auto-Submit: Raphaël Hérouart <rherouart@google.com>

[wasm] Support br_on_cast_fail This CL adds support for the br_on_cast_fail instruction. Bug: 474940922 Change-Id: Icacbd109fff843179f69806769437322f14326c8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9299601 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[js, modules] implement namespaced imports and import defer Support for "import * as ns" import syntax, including the deferred import variant. Other imports (named, default, etc.) are future work. https://github.com/tc39/proposal-defer-import-eval Bug: 398218423 Change-Id: If0e691054f0668cd4eed2bbdc9532b0c520fec4a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9313400 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Olivier Flückiger <olivf@google.com>

2026-05-26

wasm-gc: Support br_on_cast This CL adds support for the br_on_cast instruction. Bug: 474940922 Change-Id: Iadb552b42b1c721d0b5c462afda75aff91bb4791 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9300280 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-05-22

[js] Fix fuzzing with Workers 1) Hide variables outside the worker function so that the function doesn't use them. 2) Make the main thread wait for the worker to finish. Fixed: 497549860 Change-Id: If3b22fae7e61cca33b1c55fbfab3fcf9f5f6abaf Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9282445 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>

[js] Support for_of with object destructuring Bug: 515363087 Change-Id: I06060612d8eee9bf783a849352435c5b4bf9c893 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9317280 Auto-Submit: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

2026-05-21

[wasm] Implement wide arithmetic instructions Bug: 514906333 Change-Id: Ib94a058c73bab07f1b9292e102439af847593006 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9310083 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[js] Add Support for "for await" with destructuring Bug: 514576448 Change-Id: I7d2b1580b49211e1ec184f78798588eb7b4ea6ca Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9313600 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-05-20

[js] Add Support for "for await" Bug: 514576448 Change-Id: I5b818576409d654a039edac6dbcfa959352018aa Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9296863 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Auto-Submit: Raphaël Hérouart <rherouart@google.com>

2026-05-19

[wasm] Add support for acquire-release in rmw operations Bug: 447125167 Change-Id: Ifa7899b5e12a30718f64ccac36e693aa91020e5d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9288582 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com>

[wasm] Add support for acquire-release in loads & stores Bug: 447125167 Change-Id: I694c2feac0d42f1afb47f3ec2e9c94b2401382fe Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9279080 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2026-05-12

Add outputs to WasmBranchIf This CL includes outputs in the IL, similarly to how we already do for WasmBranchOnNull. So they won’t be dropped, but spilled. We also don't drop outputs of WasmBranch now, as this code is unreachable. Change-Id: I7b6e9ee6a1bb91aa23dab5e68cf0237742f073ef Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9273901 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-05-11

[general] Add parameterizable jsMaps To support assumptions regarding the typing of a `jsMap`'s elements, this CL makes `jsMap` optionally parametrizable through the `createJsMapType` function. This CL also introduces a `CreateMap` operation that persists the key and value type arguments for the map. This CL avoids introducing type serialization for the type arguments, storing the type group names instead. Parameterized iterables details: https://github.com/googleprojectzero/fuzzilli/commit/cc0ff3462034371b99626393258576f913f57178 Bug: 510424762 Change-Id: I570fb962dc027d48e222acc62b85609cd1048d15 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9274841 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Tigran Bantikyan <bantikyan@google.com>

wasm-gc: Support br_on_non_null This CL adds support for the br_on_non_null instruction. Bug: 474940922 Change-Id: I485b7b49e5c036acb29d55acfadaa707a6bf5664 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9274500 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-05-06

wasm-gc: Support br_on_null This CL adds support for the br_on_null instruction. Bug: 474940922 Change-Id: Ifbbc676becc471382ef35c347fc578437bab6063 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9250640 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-05-04

[js, bundles] Add modules A bundle can contain one or several modules. A module provides a .moduleTopLevle | .javascript context. Imports and exports can occur only in the .moduleTopLevel context. For now, modules can only have very simple imports and exports: export {v1 as export0_1, v2 as export0_2}; import {v1 as v3, v2 as v4} from 'a.mjs'; More complex cases will be added later. Bug: 342521422 Change-Id: Ie4b0b30ce2976981a5ec2279d3214196e1e62a6b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9230416 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>

2026-04-30

[general] Add parameterizable jsArrays Fuzzilli's `jsArray`s are defined using a non-parameterized `iterable`. To support assumptions regarding the typing of a `jsArray`'s elements, this CL makes `jsArray` optionally parametrizable through the `createJsArrayType` function. This CL avoids introducing type serialization for the type argument. Rather, the CreateArray operation stores the type argument's group name. As a result, types without an associated group name, such as `.string` or `.iterable`, should not be used as a type argument. Parameterized iterables details: https://github.com/googleprojectzero/fuzzilli/commit/cc0ff3462034371b99626393258576f913f57178 Fixed: 503429420 Change-Id: I3c3d2f56b7bd4eba14682ac496b097df9f57cd7f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9249980 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-04-29

[binaryen-integration] Add required operation Bug: 498924945 Change-Id: Ib4dcf00db95622059098e1afa1d3680d78dba060 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9232421 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com>

2026-04-27

[wasm] Adapt (return_)call_indirect to use wasm-gc signatures Bug: 445356784 Change-Id: If9706cdc8876721e00289eb096f35b555981c129 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9151896 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2026-04-24

[wasm] Adapt Wasm tables to track functions via wasm-gc signatures Bug: 445356784 Change-Id: Ie030285f1545181e55eabdabe2afa4793e2a69c9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9133336 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com>

2026-04-23

[protobuf] Fix missing label in ast.proto This was only added to the generated file, not to the source. Bug: 504947197 Change-Id: I255fd5471f0aa8270615bb34594e16daa5f57608 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9230417 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Marja Hölttä <marja@google.com>

2026-04-22

Add JS to FuzzIL compilation for labeled block statements In subsequent CLs, I'll add support for if/else, switch, and loops (and "continue lbl;"). Bug: 504947197 Change-Id: Idfcd4c6f263b184057a6adbc0478fde6b1b24b34 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9223779 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-04-20

Add support for labels and break-to-label to generated block statements This CL extends code generation with break statements in block statements, such as: L1: { // ... break L1; // ... } Change-Id: I4d2ec93db1e6ade577618e9dc6d89e35fa6f806f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9211136 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-04-16

[js] Add bundles Bundles can contain multiple scripts which will be executed sequentially. Modules will be added as a follow up. Bug: 342521422 Change-Id: Icedae3b6805bf6db0359bb6fbdff69cfb2f0d48a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9184296 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@chromium.org>

2026-04-13

Add support for integer enumerations Fuzzilli currently only has support for enumerations with string values. Being able to represent integer enumerations through the Fuzzilli type system would reduce the amount of supporting code that profile authors need to write. For instance, if a method has an argument that is of an integer enumeration type, the current approach would be to mark the argument as a `integer` in the Fuzzilli profile and write a custom CodeGenerator that constains the argument's values to those of the enumeration. The author cannot rely on CodeGenerators such as `MethodCallGenerator`, since these will overwhelmingly provide incorrect integer values for this argument. This CL introduces the `intEnumeration` type to Fuzzilli to support integer enumerations. The changes follow the example set by the existing `enumeration`. Namely, the introduction of a `customName` field for integers allows Fuzzilli to reliably distinguish regular integer variabels from intEnumeration variables. Rather than complicating the `isEnumeration` and `isEnumerationOrNamedString` properties on `ILType`, this CL also introduces an `isEnumeration` parameter to the `TypeExtension` constructor to explicitly identify enumerations. Fixed: 500001059 Change-Id: Ia5b2c632864a0b9fa7e7d4c7357f0de3e0a5e23c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9182892 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2026-04-08

Add JS-to-FuzzIL transpilation for default params This CL adds JS to FuzzIL transpilation support for default parameters in the context of functions. Change-Id: If3451444a6ef0ce032825039a92acbef340438ed Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9182176 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

Add default parameters to generated functions This CL adds support for default parameters in generated functions. Methods with default parameters, and JS to FuzzIL compilation code will be added later. Change-Id: I5b3583a8656c72a4068c497677bd6f18c98badb8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9176497 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-03-31

Enable more getters and setters This enables computed getters and setters for classes and adds the remaining bits to support computed getters and setters for object expressions. Also fully supports and tests getters and setters with non-identifier names for classes. Bug: 446634535 Change-Id: Ib18477c237674b8b9c911f36ba3e53daed136fb8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9100459 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

2026-03-25

Support more property names Similar to method names, this supports all allowed ways to define properties. Approximated valid identifiers will be used as is, everything else will be quoted, except positive integers. Since such a property can leak into the type information of an object or class, also all property accesses are adapted now, similar to method calls. This also refactors the import of object fields and methods, unifying the same property-key logic used in class definitions. Computed getters and setters for object literals and classes are still a TODO. This also lifts some restrictions from runtime assisted mutators, which previously only allowed simple identifiers as property names. Bug: 446634535 Change-Id: I35a65c0073fee9bac238205557958e80c60e1186 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9111376 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-03-20

[wasm] Simplify Table.get/set The TableType will need to be adapted for tracking wasm-gc signatures. I just couldn't find a good reason why we'd need to store the TableType on Table.get and Table.set? Bug: 445356784 Change-Id: Ia115d287b27cc18f52a48ddce25b897f1a19b293 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9123736 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

Refactoring: Merge static and instance class member instructions This simplifies and reduces a lot of code and prepares adding support for more kinds of class members without exploding the number of instructions due to the additional factor 2 for static and instance members. Concretely this merges instructions for all members (properties, elements and methods) that have a static and non-static (instance) variant. The static bit is represented by a variable in the instruction. This was also tested locally with and without this change, both with large number for class-related code generators. Both versions resulted in similar correctness stats without any crashes. Bug: 446634535 Change-Id: I57b3261e202dffeb57704d0040b2a8d02b50a9e6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9094176 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

2026-03-18

[wasm] Use wasm-gc signatures for wasm functions While this changes the IL to emit wasm-gc signatures for the functions, it doesn't yet actually allow using wasm-gc types in them. A few places (WasmDefineTable and WasmCallIndirect / WasmReturnCallIndirect) still need to be adapted to allow wasm-gc types before we can actually allow indexed wasm-gc types in function signatures. Bug: 445356784 Change-Id: I5715f584cfa5ee664f957a28e28bf80b6f3cdd9e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9115296 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com>

2026-03-17

[wasm] Remove parameter and return types from WasmJsCall Bug: 445356784 Change-Id: I0eb33e4e3f800919b5c92bf6ce48ded45d372ac5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9108176 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2026-03-16

[wasm] Remove parameter and return types from wasmReturnCallDirect Same as commit 226938a27cb4ac261fdae1bd7ae68cc6f7ac1d6f but now for the tail call variant (in preparation for using wasm-gc signatures for wasm functions.) Bug: 445356784 Change-Id: I5b2501b45a4a3f7e15c8814008d2d6d5bc9a9974 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9108116 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Manos Koukoutos <manoskouk@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>

2026-02-25

[wasm] Added ref.cast instruction Fuzzilli functionality for ref.cast added similarly to ref.test Bug: 474940922 Change-Id: I7cd3a28b05b7289c8ea0836be0c6d1024556e24c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8995238 Commit-Queue: Doga Yüksel <dyuksel@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-02-17

[wasm] Migrate tags to use wasm-gc signatures With all instructions interacting with Wasm tags switched over to using wasm-gc signatures in previous changes, tags can now also be adapted to use wasm-gc types in their signature (their parameter types). Note that it is also possible to define tags from JS, e.g.: > new WebAssembly.Tag({parameters: ['i32']}) However, these tags do not support index types in the JS API spec, so they can continue using the current mechanism for their type information. Bug: 448860865 Change-Id: If558f0562609d7a26a0119a4055184506351bd52 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956197 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Migrate try-table to use wasm-gc signatures Bug: 448860865 Change-Id: I01de000a5ae5fae47634ca64edad7dfd9d028695 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956318 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Doga Yüksel <dyuksel@google.com>

[wasm] Migrate legacy try-delegate to use wasm-gc signatures Bug: 448860865 Change-Id: I89bdc92e1757a68dec64da8a7ab90e7c397694eb Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956317 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Migrate legacy try-catch to use wasm-gc signatures Bug: 448860865 Change-Id: Ifd01ae66b862e844bfbdb781dac36b3a8ba2d0bd Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956316 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Doga Yüksel <dyuksel@google.com>

[wasm] Introduce WasmDefineAdHocModuleSignatureType Similar to commit 72dd5d7d9fcb648881543cd31bbac0d1baaa106f but on a wasm module level instead of inside a wasm function. This is a conservative workaround to ensure that we don't lose any chances of emitting operations that previously used static ILTypes but will depend on a signature input for the migration to wasm-gc. Bug: 448860865 Change-Id: Ife60126cabb8c49a0493736603611b9b2dd3e67b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8938986 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2026-02-11

[wasm] Added ref.test instruction and code generators wasmRefTest operation was added which can work with either concrete or abstract wasm types. Since concrete types need a type definition there are two code generators; one where we need such a type definition to already exist and a more generic one that tests against abstract types. Bug: 474940922 Change-Id: I148c1bc44c8649fcdb92d0afc52efa3af8d34b33 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8952838 Commit-Queue: Doga Yüksel <dyuksel@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-01-30

[dumpling] Add differential statistics to logs. Had some logs about them, but removed them for review. Now it is time to add proper reporting. Bug:441467877 Change-Id: I03bf6a6ae447caa4bc3eae202709fb2976a017c0 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8969557 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Danylo Mocherniuk <mdanylo@google.com>

2026-01-27

[parser] Support rest parameters on transpiling JS -> FuzzIL This fixes https://github.com/googleprojectzero/fuzzilli/issues/546 Change-Id: I8331dd909c05a51bfe73749e8677b18501e261bd Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956179 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>

2026-01-19

[wasm] Remove parameter and return types from WasmCallDirect Bug: 445356784 Change-Id: Idbe0b038ecd47b371639219edababaf7e33d1054 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8929536 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Remove return types from wasmReturn Bug: 445356784 Change-Id: Ia9ced154e6f1ce465c257e0e17c53782ec13f442 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926836 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Remove parameter types from wasmReassign Bug: 445356784 Change-Id: If6049b20eb2a77ce27c04412f571af7626b4216b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926700 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Remove parameter types from wasmBranchTable Bug: 445356784 Change-Id: Ia1a6b4606ba85e5c6f0093cc8c43cc4726a7b907 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926699 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Remove paramterTypes from WasmBranchIf Bug: 445356784 Change-Id: I5d827c480f633e4efe565ac139f91c4fb5e04e79 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926698 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Remove parameterTypes from WasmBranch Bug: 445356784 Change-Id: I960d64621c3faac93083b44935382a05dee93d84 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926697 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Doga Yüksel <dyuksel@google.com>

[wasm] Prepare WasmThrow to use wasm-gc types By removing the types from the WasmThrow, this prepares Fuzzilli to adapt the tags as a next step to use wasm-gc signatures instead of static parameter types (there might be more dependencies for that). Bug: 445356784 Change-Id: I852a84efd928ed593bbb84105a95ab7a09cde9a7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926696 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Doga Yüksel <dyuksel@google.com>

[wasm] Add WasmRefEq operation and generator Adds support for ref.eq instruction to be generated Bug: 474940922 Change-Id: I7b88ceffed5252878132406da30a570be01f13ad Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8933276 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Doga Yüksel <dyuksel@google.com>

2026-01-14

Add WasmStructNew operation and generator Adds support for wasm struct.new operation to be able to generate structs with initial non-default values. Bug: 474940922 Change-Id: Ic8f1cc8d7f9dc24dc73b342fb3d55c35e1a33446 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8921896 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Dominik Klemba <tacet@google.com> Commit-Queue: Doga Yüksel <dyuksel@google.com>

[wasm] Use a wasm-gc signature for wasm blocks Bug: 445356784 Change-Id: Ic309942aac909ffa6397fc889fd4cd8fe86e6b4e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8914596 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Pawel Krawczyk <pawkra@google.com>

[wasm] Use a wasm-gc signature as input for if-else-endif Similar to commit 3b241b0b0ea992ce6e99433a44b18bdfdaa92ba1 this change makes wasm's if-else control flow blocks use wasm-gc signatures as inputs instead of having the signature stored as a property inside the operation. This allows using wasm-gc index types inside these signatures. Bug: 445356784 Change-Id: I8315f64be536a1882ab9d4d39a3b7b72eb690456 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8914456 Reviewed-by: Pawel Krawczyk <pawkra@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2025-12-18

Shared references - wasmRefI31 Bug: 448349112 Change-Id: Icef73c9f72668e31b48d6c71699b0392f20a5fb2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8832118 Auto-Submit: Pawel Krawczyk <pawkra@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Pawel Krawczyk <pawkra@google.com>

2025-12-12

Preserve leading comments when transpiling JS JS files often contain meta data in leading comments. We require these comments to be able to execute JS code again after transpiling it with the FuzzILTool. This preserves such comments, whenever the `--outputPathJS` option is used. The comments are extracted using information from the Babel AST in the parser. Bug: 442444727 Change-Id: Ibc9fda5f99a69123672b75970f9b5801c2695074 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8839676 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

2025-12-08

[wasm] Change loops to use wasm-gc signatures This allows using parameter types which are indexed types (things like `(ref null 1)`). Implementation: - Each WasmLoop instruction now takes its signature as the first input. - The static signature types are removed from the begin and endLoop. - The loop code generator emits an "ad hoc" signature in order to emit signatures for which we already have corresponding inputs available. Bug: 445356784 Change-Id: Ic58ab7d6a092a39de77c974142dd7f976786e8e1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8792956 Reviewed-by: Pawel Krawczyk <pawkra@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>