Proto commits in googleprojectzero/fuzzilli

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-06-30

[binaryen-integration] Add memories to WasmModuleMetadata Bug:498924945 TAG=agy Change-Id: I3a8d353800bf9349ea23e446e3562c49af98f3de Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9475800 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

The documentation is generated from this commit.

2026-06-26

[js] Support Compiling and Lifting All LValues as Destructuring Targets Bug: 515363087 Change-Id: Ib12bedcdabb2681a10afcce1bb26dae5a89c56f1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9453876 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[wasm] Add isFinal attribute to WasmTypeDescription etc. This CL adds `isFinal` to WasmTypeDescription and subclasses WasmArrayTypeDescription, WasmStructTypeDescription, WasmSignatureTypeDescription. In code generators, we only use non-final super types. All generated types are final with a probability of 25%. Bug: 517707090 Change-Id: I47df3b1b8f06f5b133f3a349f0c1c7aeebdc975f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9464195 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

2026-06-25

[stats] Aggregate contributor statistics across nodes and reduce log noise Optimize the reporting of poorly performing code generators and program templates by aggregating their stats across all fuzzer nodes and centralizing the output on the main thread. This makes log messages more actionable and easier to read and navigate in cloud logging. Key changes: - Moved the generator/template stats from individual worker threads to the root node. - Merged validSamples and interestingSamples into correctSamples. - Print compact, table-based logs. - Reduced log frequency to every 5th statistics update and on termination. TAG=agy Bug: 465497343 Change-Id: I146e8b08057ee1ed84cf64c8f308b6be7b63bbf3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9432454 Reviewed-by: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

[js, modules] Generate cyclic imports Cyclic imports require knowing which modules and exports we will generate *later*. Add the "pending module" concept to support this. We use .jsAnything as the type for the variables which will be exported later - it's hard to decide a better type upfront and those won't technically be true (since we might access a "var" variable before it has its final value). TAG=agy CONV=9d719888-54be-4548-b5e1-2eec15f7d6bc Bug: 342521422 Change-Id: I4f9621d5771244a12e18937688fed3327757658d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9408620 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>

2026-06-23

[js] Nested Destructuring: Refactoring and Duplicate Code Elimination Follow Up From https://crrev.com/i/9379120 Bug: 515363087 Change-Id: I8ea35cd8e941ab586b34365462582280dde80f8f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9419397 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

2026-06-22

[js] Nested Destructuring: Implement Re-Assignment In both loop headers and simple declarations, Destructuring was only supported with variable declarations (let/const/var keyword); it can now be utilized for re-assigning existing variables. Bug: 515363087 Change-Id: I081689487006a3f63aec5a07df924038d853bf51 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9425996 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@google.com>

Reland: [wasm] Add superType input to WasmDefineSignatureType This CL adds an optional superType input to the WasmDefineSignatureType JS operation. It also extends WasmSignatureTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I1004b24c3d3df8f0b41ba9bf7ad41df9155770c1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9425995 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Michael Achenbach <machenbach@google.com>

Reland: [wasm] Add superType input to WasmDefineStructType This CL adds an optional superType input to the WasmDefineStructType JS operation. It also extends WasmStructTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I9c0b3eb323e8251dffae80008df385eb945dc673 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9426034 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

Reland: [wasm] Add superType input to WasmDefineArrayType This CL adds an optional superType input to the WasmDefineArrayType JS operation. It also extends WasmArrayTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I70b82608d49514ce29666f3e4d8d2ced5d8dcae0 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9425994 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org>

2026-06-18

Revert changes to WasmDefineArrayType and WasmDefineStructType Revert "[wasm] Add superType input to WasmDefineArrayType" This reverts commit 3a03d76997cbcc7a33645b9a3bd3191290b0796e. Revert "[wasm] Add superType input to WasmDefineStructType" This reverts commit 5ce4c591ff4e52356e369a149c67ec3e0364973c. Also bump protobuf version. Bug: 524213342, 517707090 Change-Id: I0d10c4d9123292dd184281de0f0c02a12a199f13 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9425034 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

2026-06-16

Revert "[wasm] Add superType input to WasmDefineSignatureType" This reverts commit e1776516c3ceb3b17ec63df6395ffe0c8dd5efc5. Reason for revert: Check whether this caused a spike in use-before-def failures Failure Link: https://g-issues.chromium.org/issues/524213342 Original change's description: > [wasm] Add superType input to WasmDefineSignatureType > > This CL adds an optional superType input to the WasmDefineSignatureType > JS operation. It also extends WasmSignatureTypeDescription to take an > optional superType parameter that it passes on to the > WasmTypeDescription constructor. > > Bug: 517707090 > Change-Id: I0b6aa71450534d0a113d8bd4f3d57195d2d7245d > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9358622 > Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> > Reviewed-by: Matthias Liedtke <mliedtke@google.com> Bug: 517707090 Change-Id: I8d11e29e493b23cc55a245937d7b0927ad91026b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9413674 Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-06-15

[js] Implement deeply nested destructuring and reassignment patterns This patch replaces the flat `DestructObject` and `DestructArray` instructions with a recursive `DestructuringPattern` AST and FuzzIL implementation. Key capabilities introduced: - Deeply nested array and object patterns (e.g., `let { a: [ b, { c } ] } = obj`) - Default values for both flat bindings and nested patterns - Computed property keys in object destructuring - Proper elision and rest element support within nested contexts - Generalizes both variable declaration (`Destruct`) and reassignment (`DestructAndReassign`) Bug: 515363087 Change-Id: I79fff58c693a5fc8879c00e439f9ad56655c42e7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9379120 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

2026-06-12

[wasm] Add superType input to WasmDefineSignatureType This CL adds an optional superType input to the WasmDefineSignatureType JS operation. It also extends WasmSignatureTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I0b6aa71450534d0a113d8bd4f3d57195d2d7245d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9358622 Commit-Queue: Leon Bettscheider <bettscheider@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[wasm] Add superType input to WasmDefineStructType This CL adds an optional superType input to the WasmDefineStructType JS operation. It also extends WasmStructTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I4490df2cee14c2d2b7905bad520f47cf08beeff8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9362881 Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[wasm] Add superType input to WasmDefineArrayType This CL adds an optional superType input to the WasmDefineArrayType JS operation. It also extends WasmArrayTypeDescription to take an optional superType parameter that it passes on to the WasmTypeDescription constructor. Bug: 517707090 Change-Id: I8c388cf5acc269935dbec19cc07dd62beb870b05 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9362880 Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-06-09

[js] Do not accept destructuring in forIn Loops and Disposable Declarations Bug: 515363087 Change-Id: Ia5de523536d0be873ea6dfa58260f80b8402536a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9371140 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

2026-06-08

[js, modules] Add support for dynamic imports Bug: 398218423 Change-Id: I0fe7cd10030e18c3014e4c8220830631d1b92cce Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9355960 Auto-Submit: Olivier Flückiger <olivf@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[js] Compile Destructuring Patterns JS --> FuzzIL Bug: 515363087 Change-Id: I3653827b5d1467c95c607306bb42cfa97d8cb0a9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9366042 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-06-03

[js] Using "using" in for_of loops. Bug: 515363087 Change-Id: I6fd7618baa5c357d2ab21fe0610f2d53ce4effd1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9345643 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Raphaël Hérouart <rherouart@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

2026-06-02

[wasm] Support return_call_ref This CL adds support for the return_call_ref instruction. Bug: 474940922 Change-Id: I8b53203020238fc24c002cbe27f8f60c7fa7fee7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9317782 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-06-01

[wasm] Support call_ref This CL adds support for the call_ref instruction. Bug: 474940922 Change-Id: If708e70dc9fcdd2f53f218f85e93c3d807a5ab9a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9330021 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[wasm] Implement ref.as_non_null Bug: 474940922 Change-Id: I20f142ba41d3efa88872ae0dfa308170a8c0ff11 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956716 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>

[js] Compile ForOf Loop with destructuring to FuzzIL Bug: 515363087 Change-Id: I8b5f3189ad34b3a6e117e3cf066e6afe62c20aba Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9336920 Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-05-28

[wasm] Re-add ILType to WasmTableGet The table type can be easily inferred by the input table, so the table.get doesn't need a type immediate. For fuzzilli however, the input table can also come from JS (created by CreateWasmTable). Later on, the fuzzer can replace that table input with an arbitrary other input. This means that we need to encode the element type in the table.get operation, so that the JSTyper always knows the correct result type. I removed this in commit 7e5724ccc4551bf54773cb14450dc6f65c01f6ae (among other things that are indeed unnecessary). Bug: 430171132 Change-Id: Icffc95fadb79979d7125a33d797868c5a6ad50e5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9337021 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Leon Bettscheider <bettscheider@google.com>

[wasm] Support ref.func This CL adds support for the ref.func instruction. Bug: 474940922 Change-Id: I885b966598a9d72c161d2ef7bee910032576a53d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9296864 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-05-27

[js] Refactor Loops to mutualize common code. Bug: 515363087 Change-Id: I41e4b487ee08dbf7da22959c6c1d08e4099a6ad4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9317282 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Auto-Submit: Raphaël Hérouart <rherouart@google.com>

[wasm] Support br_on_cast_fail This CL adds support for the br_on_cast_fail instruction. Bug: 474940922 Change-Id: Icacbd109fff843179f69806769437322f14326c8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9299601 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

[js, modules] implement namespaced imports and import defer Support for "import * as ns" import syntax, including the deferred import variant. Other imports (named, default, etc.) are future work. https://github.com/tc39/proposal-defer-import-eval Bug: 398218423 Change-Id: If0e691054f0668cd4eed2bbdc9532b0c520fec4a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9313400 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Olivier Flückiger <olivf@google.com>

2026-05-26

wasm-gc: Support br_on_cast This CL adds support for the br_on_cast instruction. Bug: 474940922 Change-Id: Iadb552b42b1c721d0b5c462afda75aff91bb4791 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9300280 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-05-22

[js] Fix fuzzing with Workers 1) Hide variables outside the worker function so that the function doesn't use them. 2) Make the main thread wait for the worker to finish. Fixed: 497549860 Change-Id: If3b22fae7e61cca33b1c55fbfab3fcf9f5f6abaf Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9282445 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>

[js] Support for_of with object destructuring Bug: 515363087 Change-Id: I06060612d8eee9bf783a849352435c5b4bf9c893 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9317280 Auto-Submit: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com>

2026-05-21

[wasm] Implement wide arithmetic instructions Bug: 514906333 Change-Id: Ib94a058c73bab07f1b9292e102439af847593006 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9310083 Reviewed-by: Leon Bettscheider <bettscheider@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[js] Add Support for "for await" with destructuring Bug: 514576448 Change-Id: I7d2b1580b49211e1ec184f78798588eb7b4ea6ca Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9313600 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Raphaël Hérouart <rherouart@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-05-20

[js] Add Support for "for await" Bug: 514576448 Change-Id: I5b818576409d654a039edac6dbcfa959352018aa Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9296863 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Marja Hölttä <marja@google.com> Auto-Submit: Raphaël Hérouart <rherouart@google.com>

2026-05-19

[wasm] Add support for acquire-release in rmw operations Bug: 447125167 Change-Id: Ifa7899b5e12a30718f64ccac36e693aa91020e5d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9288582 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com>

[wasm] Add support for acquire-release in loads & stores Bug: 447125167 Change-Id: I694c2feac0d42f1afb47f3ec2e9c94b2401382fe Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9279080 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2026-05-12

Add outputs to WasmBranchIf This CL includes outputs in the IL, similarly to how we already do for WasmBranchOnNull. So they won’t be dropped, but spilled. We also don't drop outputs of WasmBranch now, as this code is unreachable. Change-Id: I7b6e9ee6a1bb91aa23dab5e68cf0237742f073ef Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9273901 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-05-11

[general] Add parameterizable jsMaps To support assumptions regarding the typing of a `jsMap`'s elements, this CL makes `jsMap` optionally parametrizable through the `createJsMapType` function. This CL also introduces a `CreateMap` operation that persists the key and value type arguments for the map. This CL avoids introducing type serialization for the type arguments, storing the type group names instead. Parameterized iterables details: https://github.com/googleprojectzero/fuzzilli/commit/cc0ff3462034371b99626393258576f913f57178 Bug: 510424762 Change-Id: I570fb962dc027d48e222acc62b85609cd1048d15 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9274841 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Tigran Bantikyan <bantikyan@google.com>

wasm-gc: Support br_on_non_null This CL adds support for the br_on_non_null instruction. Bug: 474940922 Change-Id: I485b7b49e5c036acb29d55acfadaa707a6bf5664 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9274500 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-05-06

wasm-gc: Support br_on_null This CL adds support for the br_on_null instruction. Bug: 474940922 Change-Id: Ifbbc676becc471382ef35c347fc578437bab6063 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9250640 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-05-04

[js, bundles] Add modules A bundle can contain one or several modules. A module provides a .moduleTopLevle | .javascript context. Imports and exports can occur only in the .moduleTopLevel context. For now, modules can only have very simple imports and exports: export {v1 as export0_1, v2 as export0_2}; import {v1 as v3, v2 as v4} from 'a.mjs'; More complex cases will be added later. Bug: 342521422 Change-Id: Ie4b0b30ce2976981a5ec2279d3214196e1e62a6b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9230416 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com>

2026-04-30

[general] Add parameterizable jsArrays Fuzzilli's `jsArray`s are defined using a non-parameterized `iterable`. To support assumptions regarding the typing of a `jsArray`'s elements, this CL makes `jsArray` optionally parametrizable through the `createJsArrayType` function. This CL avoids introducing type serialization for the type argument. Rather, the CreateArray operation stores the type argument's group name. As a result, types without an associated group name, such as `.string` or `.iterable`, should not be used as a type argument. Parameterized iterables details: https://github.com/googleprojectzero/fuzzilli/commit/cc0ff3462034371b99626393258576f913f57178 Fixed: 503429420 Change-Id: I3c3d2f56b7bd4eba14682ac496b097df9f57cd7f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9249980 Commit-Queue: Tigran Bantikyan <bantikyan@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-04-29

[binaryen-integration] Add required operation Bug: 498924945 Change-Id: Ib4dcf00db95622059098e1afa1d3680d78dba060 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9232421 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@google.com>

2026-04-27

[wasm] Adapt (return_)call_indirect to use wasm-gc signatures Bug: 445356784 Change-Id: If9706cdc8876721e00289eb096f35b555981c129 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9151896 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2026-04-24

[wasm] Adapt Wasm tables to track functions via wasm-gc signatures Bug: 445356784 Change-Id: Ie030285f1545181e55eabdabe2afa4793e2a69c9 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9133336 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com>

2026-04-23

[protobuf] Fix missing label in ast.proto This was only added to the generated file, not to the source. Bug: 504947197 Change-Id: I255fd5471f0aa8270615bb34594e16daa5f57608 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9230417 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@google.com> Reviewed-by: Marja Hölttä <marja@google.com>

2026-04-22

Add JS to FuzzIL compilation for labeled block statements In subsequent CLs, I'll add support for if/else, switch, and loops (and "continue lbl;"). Bug: 504947197 Change-Id: Idfcd4c6f263b184057a6adbc0478fde6b1b24b34 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9223779 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-04-20

Add support for labels and break-to-label to generated block statements This CL extends code generation with break statements in block statements, such as: L1: { // ... break L1; // ... } Change-Id: I4d2ec93db1e6ade577618e9dc6d89e35fa6f806f Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9211136 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-04-16

[js] Add bundles Bundles can contain multiple scripts which will be executed sequentially. Modules will be added as a follow up. Bug: 342521422 Change-Id: Icedae3b6805bf6db0359bb6fbdff69cfb2f0d48a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9184296 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Marja Hölttä <marja@chromium.org>

2026-04-13

Add support for integer enumerations Fuzzilli currently only has support for enumerations with string values. Being able to represent integer enumerations through the Fuzzilli type system would reduce the amount of supporting code that profile authors need to write. For instance, if a method has an argument that is of an integer enumeration type, the current approach would be to mark the argument as a `integer` in the Fuzzilli profile and write a custom CodeGenerator that constains the argument's values to those of the enumeration. The author cannot rely on CodeGenerators such as `MethodCallGenerator`, since these will overwhelmingly provide incorrect integer values for this argument. This CL introduces the `intEnumeration` type to Fuzzilli to support integer enumerations. The changes follow the example set by the existing `enumeration`. Namely, the introduction of a `customName` field for integers allows Fuzzilli to reliably distinguish regular integer variabels from intEnumeration variables. Rather than complicating the `isEnumeration` and `isEnumerationOrNamedString` properties on `ILType`, this CL also introduces an `isEnumeration` parameter to the `TypeExtension` constructor to explicitly identify enumerations. Fixed: 500001059 Change-Id: Ia5b2c632864a0b9fa7e7d4c7357f0de3e0a5e23c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9182892 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2026-04-08

Add JS-to-FuzzIL transpilation for default params This CL adds JS to FuzzIL transpilation support for default parameters in the context of functions. Change-Id: If3451444a6ef0ce032825039a92acbef340438ed Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9182176 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

Add default parameters to generated functions This CL adds support for default parameters in generated functions. Methods with default parameters, and JS to FuzzIL compilation code will be added later. Change-Id: I5b3583a8656c72a4068c497677bd6f18c98badb8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9176497 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Leon Bettscheider <bettscheider@google.com>

2026-03-31

Enable more getters and setters This enables computed getters and setters for classes and adds the remaining bits to support computed getters and setters for object expressions. Also fully supports and tests getters and setters with non-identifier names for classes. Bug: 446634535 Change-Id: Ib18477c237674b8b9c911f36ba3e53daed136fb8 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9100459 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

2026-03-25

Support more property names Similar to method names, this supports all allowed ways to define properties. Approximated valid identifiers will be used as is, everything else will be quoted, except positive integers. Since such a property can leak into the type information of an object or class, also all property accesses are adapted now, similar to method calls. This also refactors the import of object fields and methods, unifying the same property-key logic used in class definitions. Computed getters and setters for object literals and classes are still a TODO. This also lifts some restrictions from runtime assisted mutators, which previously only allowed simple identifiers as property names. Bug: 446634535 Change-Id: I35a65c0073fee9bac238205557958e80c60e1186 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9111376 Commit-Queue: Michael Achenbach <machenbach@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-03-20

[wasm] Simplify Table.get/set The TableType will need to be adapted for tracking wasm-gc signatures. I just couldn't find a good reason why we'd need to store the TableType on Table.get and Table.set? Bug: 445356784 Change-Id: Ia115d287b27cc18f52a48ddce25b897f1a19b293 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9123736 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

Refactoring: Merge static and instance class member instructions This simplifies and reduces a lot of code and prepares adding support for more kinds of class members without exploding the number of instructions due to the additional factor 2 for static and instance members. Concretely this merges instructions for all members (properties, elements and methods) that have a static and non-static (instance) variant. The static bit is represented by a variable in the instruction. This was also tested locally with and without this change, both with large number for class-related code generators. Both versions resulted in similar correctness stats without any crashes. Bug: 446634535 Change-Id: I57b3261e202dffeb57704d0040b2a8d02b50a9e6 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9094176 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

2026-03-18

[wasm] Use wasm-gc signatures for wasm functions While this changes the IL to emit wasm-gc signatures for the functions, it doesn't yet actually allow using wasm-gc types in them. A few places (WasmDefineTable and WasmCallIndirect / WasmReturnCallIndirect) still need to be adapted to allow wasm-gc types before we can actually allow indexed wasm-gc types in function signatures. Bug: 445356784 Change-Id: I5715f584cfa5ee664f957a28e28bf80b6f3cdd9e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9115296 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com>

2026-03-17

[wasm] Remove parameter and return types from WasmJsCall Bug: 445356784 Change-Id: I0eb33e4e3f800919b5c92bf6ce48ded45d372ac5 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9108176 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2026-03-16

[wasm] Remove parameter and return types from wasmReturnCallDirect Same as commit 226938a27cb4ac261fdae1bd7ae68cc6f7ac1d6f but now for the tail call variant (in preparation for using wasm-gc signatures for wasm functions.) Bug: 445356784 Change-Id: I5b2501b45a4a3f7e15c8814008d2d6d5bc9a9974 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9108116 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Manos Koukoutos <manoskouk@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>

2026-02-25

[wasm] Added ref.cast instruction Fuzzilli functionality for ref.cast added similarly to ref.test Bug: 474940922 Change-Id: I7cd3a28b05b7289c8ea0836be0c6d1024556e24c Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8995238 Commit-Queue: Doga Yüksel <dyuksel@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-02-17

[wasm] Migrate tags to use wasm-gc signatures With all instructions interacting with Wasm tags switched over to using wasm-gc signatures in previous changes, tags can now also be adapted to use wasm-gc types in their signature (their parameter types). Note that it is also possible to define tags from JS, e.g.: > new WebAssembly.Tag({parameters: ['i32']}) However, these tags do not support index types in the JS API spec, so they can continue using the current mechanism for their type information. Bug: 448860865 Change-Id: If558f0562609d7a26a0119a4055184506351bd52 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956197 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Migrate try-table to use wasm-gc signatures Bug: 448860865 Change-Id: I01de000a5ae5fae47634ca64edad7dfd9d028695 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956318 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Doga Yüksel <dyuksel@google.com>

[wasm] Migrate legacy try-delegate to use wasm-gc signatures Bug: 448860865 Change-Id: I89bdc92e1757a68dec64da8a7ab90e7c397694eb Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956317 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Migrate legacy try-catch to use wasm-gc signatures Bug: 448860865 Change-Id: Ifd01ae66b862e844bfbdb781dac36b3a8ba2d0bd Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956316 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Doga Yüksel <dyuksel@google.com>

[wasm] Introduce WasmDefineAdHocModuleSignatureType Similar to commit 72dd5d7d9fcb648881543cd31bbac0d1baaa106f but on a wasm module level instead of inside a wasm function. This is a conservative workaround to ensure that we don't lose any chances of emitting operations that previously used static ILTypes but will depend on a signature input for the migration to wasm-gc. Bug: 448860865 Change-Id: Ife60126cabb8c49a0493736603611b9b2dd3e67b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8938986 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2026-02-11

[wasm] Added ref.test instruction and code generators wasmRefTest operation was added which can work with either concrete or abstract wasm types. Since concrete types need a type definition there are two code generators; one where we need such a type definition to already exist and a more generic one that tests against abstract types. Bug: 474940922 Change-Id: I148c1bc44c8649fcdb92d0afc52efa3af8d34b33 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8952838 Commit-Queue: Doga Yüksel <dyuksel@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2026-01-30

[dumpling] Add differential statistics to logs. Had some logs about them, but removed them for review. Now it is time to add proper reporting. Bug:441467877 Change-Id: I03bf6a6ae447caa4bc3eae202709fb2976a017c0 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8969557 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Danylo Mocherniuk <mdanylo@google.com>

2026-01-27

[parser] Support rest parameters on transpiling JS -> FuzzIL This fixes https://github.com/googleprojectzero/fuzzilli/issues/546 Change-Id: I8331dd909c05a51bfe73749e8677b18501e261bd Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8956179 Reviewed-by: Michael Achenbach <machenbach@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com>

2026-01-19

[wasm] Remove parameter and return types from WasmCallDirect Bug: 445356784 Change-Id: Idbe0b038ecd47b371639219edababaf7e33d1054 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8929536 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Remove return types from wasmReturn Bug: 445356784 Change-Id: Ia9ced154e6f1ce465c257e0e17c53782ec13f442 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926836 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Remove parameter types from wasmReassign Bug: 445356784 Change-Id: If6049b20eb2a77ce27c04412f571af7626b4216b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926700 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Remove parameter types from wasmBranchTable Bug: 445356784 Change-Id: Ia1a6b4606ba85e5c6f0093cc8c43cc4726a7b907 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926699 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Remove paramterTypes from WasmBranchIf Bug: 445356784 Change-Id: I5d827c480f633e4efe565ac139f91c4fb5e04e79 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926698 Reviewed-by: Doga Yüksel <dyuksel@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

[wasm] Remove parameterTypes from WasmBranch Bug: 445356784 Change-Id: I960d64621c3faac93083b44935382a05dee93d84 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926697 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Doga Yüksel <dyuksel@google.com>

[wasm] Prepare WasmThrow to use wasm-gc types By removing the types from the WasmThrow, this prepares Fuzzilli to adapt the tags as a next step to use wasm-gc signatures instead of static parameter types (there might be more dependencies for that). Bug: 445356784 Change-Id: I852a84efd928ed593bbb84105a95ab7a09cde9a7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8926696 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Doga Yüksel <dyuksel@google.com>

[wasm] Add WasmRefEq operation and generator Adds support for ref.eq instruction to be generated Bug: 474940922 Change-Id: I7b88ceffed5252878132406da30a570be01f13ad Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8933276 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Doga Yüksel <dyuksel@google.com>

2026-01-14

Add WasmStructNew operation and generator Adds support for wasm struct.new operation to be able to generate structs with initial non-default values. Bug: 474940922 Change-Id: Ic8f1cc8d7f9dc24dc73b342fb3d55c35e1a33446 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8921896 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Dominik Klemba <tacet@google.com> Commit-Queue: Doga Yüksel <dyuksel@google.com>

[wasm] Use a wasm-gc signature for wasm blocks Bug: 445356784 Change-Id: Ic309942aac909ffa6397fc889fd4cd8fe86e6b4e Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8914596 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Pawel Krawczyk <pawkra@google.com>

[wasm] Use a wasm-gc signature as input for if-else-endif Similar to commit 3b241b0b0ea992ce6e99433a44b18bdfdaa92ba1 this change makes wasm's if-else control flow blocks use wasm-gc signatures as inputs instead of having the signature stored as a property inside the operation. This allows using wasm-gc index types inside these signatures. Bug: 445356784 Change-Id: I8315f64be536a1882ab9d4d39a3b7b72eb690456 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8914456 Reviewed-by: Pawel Krawczyk <pawkra@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2025-12-18

Shared references - wasmRefI31 Bug: 448349112 Change-Id: Icef73c9f72668e31b48d6c71699b0392f20a5fb2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8832118 Auto-Submit: Pawel Krawczyk <pawkra@google.com> Reviewed-by: Danylo Mocherniuk <mdanylo@google.com> Commit-Queue: Pawel Krawczyk <pawkra@google.com>

2025-12-12

Preserve leading comments when transpiling JS JS files often contain meta data in leading comments. We require these comments to be able to execute JS code again after transpiling it with the FuzzILTool. This preserves such comments, whenever the `--outputPathJS` option is used. The comments are extracted using information from the Babel AST in the parser. Bug: 442444727 Change-Id: Ibc9fda5f99a69123672b75970f9b5801c2695074 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8839676 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

2025-12-08

[wasm] Change loops to use wasm-gc signatures This allows using parameter types which are indexed types (things like `(ref null 1)`). Implementation: - Each WasmLoop instruction now takes its signature as the first input. - The static signature types are removed from the begin and endLoop. - The loop code generator emits an "ad hoc" signature in order to emit signatures for which we already have corresponding inputs available. Bug: 445356784 Change-Id: Ic58ab7d6a092a39de77c974142dd7f976786e8e1 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8792956 Reviewed-by: Pawel Krawczyk <pawkra@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2025-12-02

Revert "Add support for shared references." This reverts commit e35cbb5b7b784cae910776e4edeefc8553316d56. Reason for revert: Crashes and not reviewed yet. Original change's description: > Add support for shared references. > > Generating shared ref variables to be done in following CLs. > > See https://github.com/WebAssembly/shared-everything-threads/blob/main/proposals/shared-everything-threads/Overview.md. > > Bug: 448349112 > Change-Id: I3358ce9cdd528147b66f1954ef1a008b048e06df > Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8734256 > Commit-Queue: Matthias Liedtke <mliedtke@google.com> > Reviewed-by: Dominik Klemba <tacet@google.com> > Commit-Queue: Pawel Krawczyk <pawkra@google.com> Bug: 448349112 No-Presubmit: true No-Tree-Checks: true No-Try: true Change-Id: I8bc73bef53d053078db9318de6408d4dbf2f4cda Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8810396 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>

Add support for shared references. Generating shared ref variables to be done in following CLs. See https://github.com/WebAssembly/shared-everything-threads/blob/main/proposals/shared-everything-threads/Overview.md. Bug: 448349112 Change-Id: I3358ce9cdd528147b66f1954ef1a008b048e06df Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8734256 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Dominik Klemba <tacet@google.com> Commit-Queue: Pawel Krawczyk <pawkra@google.com>

2025-11-25

[wasm] Add a new operation for defining signatures directly inside a function To allow defining a block with a wasm-gc signature while already being in the .wasmFunction context, this change adds a new operation WasmDefineAdHocSignature. This way statements requiring a signature type input can directly embed this signature definition inside the function. Bug: 445356784 Change-Id: I56754224551ea82883c71410f4aca957b7bf24d4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8787096 Reviewed-by: Pawel Krawczyk <pawkra@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2025-10-09

Add support for table.init and table.copy instructions. Bug: 427115604 Change-Id: I0a79b5dc133a09c1ec84b78b966bc6c27d9aa3f2 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8643536 Auto-Submit: Pawel Krawczyk <pawkra@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2025-10-02

Support computed class methods This adds support for computed class method (static and instance) to fuzzIL and to the compiler for imports. Supporting computed getters/setters and indexed methods + indexed getters/setters is still future work. However, this adds a compiler test file with the full array of cases that we could support, not-yet-supported cases commented out for now. This slightly refactors the compiler AST and shares property keys for methods and properties, which can have the same structure. In general, most of the boiler-plate code is similar to the existing code for BeginClass{Instance|Static}Method with changes for computed properties similar to BeginClassComputedProperty or BeginObjectLiteralComputedMethod. Similar to computed object methods, a caveat is that the typer might not be able to compute available method names to be called. Bug: 446634535 BYPASS_LARGE_CHANGE_WARNING: tests for completeness are large Change-Id: I30a85eadbc0fe466a9fbc7dbfa3bb7aad5b51f7d Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8614819 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

2025-09-23

Add explicit resource management to the fuzzIL compiler This enables parsing and importing some of the syntax provided by the explicit-resource-management feature. The first stage is to parse `using` and `await using` statements and add them to the AST for the fuzzIL compiler. The second stage is to represent them with named variables, similar to other (const, let, var) named variables. We cannot just extend the existing named variables with a few more declaration types, since (async) disposable variables are also separate instructions, to enforce their respective syntactic constraints. This does not yet enable many useful examples though. We do not yet support disposable variables in loops. Nor does the fuzzIL compiler support computed properties yet, which are typically used in conjunction with disposable variables. Bug: 441669678 Change-Id: I63bcf8a8e2ed250c23a3017aab396d777ef9c900 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8552137 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>

2025-09-19

[wasm] Add signature type definition to wasm type groups This is the very first step in allowing "full" wasm-gc signatures with indexed reference types as parameters and output types. This only adds an option to define such signatures inside a Wasm type group and use them in a few selected statements like `ref.null` but doesn't adapt any of the complex statements like wasm function definitions, blocks, loops, ... It also doesn't add code generators for signature types, so as a first step they are "ProgramBuilder vaporware" for writing test cases. Bug: 445356784 Change-Id: I5b9d2ff4791fcb09c4c41d4685949d2b6b460685 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8595216 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by: Manos Koukoutos <manoskouk@google.com>

2025-09-18

Add support for named strings, use for timezones This adds a new concept: "named strings", which are string-typed objects that are expected to have greater structure. Like options bags, producing generators can be registered for these. Unfortunately I don't have a good way of testing this since I can't see any way to trawl through the generated code other than parsing the output of dumpCurrentProgram(). Seems to work, though. Change-Id: I6a6a6964fef394af4595f0302d785a9c6da27de3 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8593716 Reviewed-by: Carl Smith <cffsmith@google.com> Commit-Queue: Manish Goregaokar <manishearth@google.com>

2025-09-11

Add support for defining and droppining element segments. Prepare code for using them in initialize and copy bulk instructions. Bug:427115604 Change-Id: I3f5a2b28e8116ead775306fecea55b5d23f82eca Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8578256 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Pawel Krawczyk <pawkra@google.com>

2025-09-01

Add support for memory.copy instruction Bug: 427115604 Change-Id: I523ff10c7ecdefeb98b523ebfbc3783c3bef4bf7 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8539457 Commit-Queue: Pawel Krawczyk <pawkra@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Pawel Krawczyk <pawkra@google.com>

2025-08-29

Make setProperty a GuardableOperation This patch makes setProperty inherit from GuardableOperation instead of JsOperation and adds guards in CodeGenerators using setProperty to prevent invalid programs. Bug: 40272934 Change-Id: Ib2d54fa42da6e4d17caf039d1e489472f079e497 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8543120 Reviewed-by: Hendrik Wüthrich <whendrik@google.com> Commit-Queue: Hendrik Wüthrich <whendrik@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Hendrik Wüthrich <whendrik@google.com>

2025-08-26

Add support for passive data segments. Bug: 427115604 Change-Id: I0183b6166bed142f52da7eb6d372cf79310c2d85 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8525856 Commit-Queue: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Pawel Krawczyk <pawkra@google.com> Auto-Submit: Pawel Krawczyk <pawkra@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

2025-08-21

[wasm] Add WasmTableSize and WasmTableGrow operations This introduces the WasmTableSize and WasmTableGrow operations to support table sizing and growing. The supported operations now include: - table.size - table.grow Change-Id: I18f0ad21961d773e386949854db114e7530881ee Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8485526 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Auto-Submit: Dominik Klemba <tacet@google.com> Commit-Queue: Dominik Klemba <tacet@google.com>

2025-08-05

[wasm] Add support for atomic Cmpxchg operations This introduces the WasmAtomicCmpxchg operation to support the atomic compare-exchange operation. The supported operations now include atomic: - Cmpxchg These are available in various 8, 16, 32, and 64-bit versions. Bug: 427134598 Change-Id: Ie246c58ed6a93dc8bdcc8504c798c8c309e39324 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8472916 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Dominik Klemba <tacet@google.com>

2025-07-31

[wasm] Add support for atomic RMW operations This introduces the WasmAtomicRMW operation to support various atomic Read-Modify-Write (RMW) operation instructions. The supported operations now include atomic: - Add - Sub - And - Or - Xor - Exchange These are available in various 8, 16, 32, and 64-bit versions. Bug: 427134598 Change-Id: I5fb2f2e1e77b27a782a46c84c67254cf80a23a4b Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8462196 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Dominik Klemba <tacet@google.com>

2025-07-29

[wasm] add any.convert_extern, extern.convert_any Very boring instructions but these instructions use the newly added subtyping of heap types, so an `extern.convert_any` can consume an indexed struct, indexed array, i31ref, or any other subtype of anyref including non-nullable types. Bug: 430171132 Change-Id: I948535446b6f340cf6ff2f55e6cb68cdfb6f3d2a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8457859 Reviewed-by: Manos Koukoutos <manoskouk@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com>

2025-07-25

[wasm] Implement initial WebAssembly atomics support - add atomic load operations - add atomic store operations Bug: 427134598 Change-Id: I8c98733a0958c3b0e95ca3f2bce7b7e0e02d91cb Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8443158 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Dominik Klemba <tacet@google.com>